From 78c2a33243690975b048da2aebaf925a93705972 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 05:51:56 -0400
Subject: [PATCH 01/36] [Security Solution][Endpoint] Fix unhandled promise
 rejections in skipped tests (#115354) (#115399)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Fix errors and comment code in middleware (pending to fix this)

* Fix endpoint list middleware test

* Fix policy TA layout test

* Fix test returning missing promise

Co-authored-by: David Sánchez <davidsansol92@gmail.com>
---
 .../search_exceptions.test.tsx                |  1 -
 .../management/pages/endpoint_hosts/mocks.ts  | 39 ++++++-------
 .../endpoint_hosts/store/middleware.test.ts   |  4 +-
 .../policy_trusted_apps_layout.test.tsx       | 56 +++++++++++++------
 4 files changed, 59 insertions(+), 41 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
index d7db249475df7..084978d35d03a 100644
--- a/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
@@ -20,7 +20,6 @@ jest.mock('../../../common/components/user_privileges/use_endpoint_privileges');
 let onSearchMock: jest.Mock;
 const mockUseEndpointPrivileges = useEndpointPrivileges as jest.Mock;
 
-// unhandled promise rejection: https://github.com/elastic/kibana/issues/112699
 describe('Search exceptions', () => {
   let appTestContext: AppContextTestRender;
   let renderResult: ReturnType<AppContextTestRender['render']>;
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/mocks.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/mocks.ts
index e0b5837c2f78a..c724773593f53 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/mocks.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/mocks.ts
@@ -122,30 +122,27 @@ export const endpointActivityLogHttpMock =
         const responseData = fleetActionGenerator.generateResponse({
           agent_id: endpointMetadata.agent.id,
         });
-
         return {
-          body: {
-            page: 1,
-            pageSize: 50,
-            startDate: 'now-1d',
-            endDate: 'now',
-            data: [
-              {
-                type: 'response',
-                item: {
-                  id: '',
-                  data: responseData,
-                },
+          page: 1,
+          pageSize: 50,
+          startDate: 'now-1d',
+          endDate: 'now',
+          data: [
+            {
+              type: 'response',
+              item: {
+                id: '',
+                data: responseData,
               },
-              {
-                type: 'action',
-                item: {
-                  id: '',
-                  data: actionData,
-                },
+            },
+            {
+              type: 'action',
+              item: {
+                id: '',
+                data: actionData,
               },
-            ],
-          },
+            },
+          ],
         };
       },
     },
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
index 43fa4e104067f..81c4dc6f2f7de 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
@@ -61,8 +61,7 @@ jest.mock('../../../../common/lib/kibana');
 
 type EndpointListStore = Store<Immutable<EndpointState>, Immutable<AppAction>>;
 
-// unhandled promise rejection: https://github.com/elastic/kibana/issues/112699
-describe.skip('endpoint list middleware', () => {
+describe('endpoint list middleware', () => {
   const getKibanaServicesMock = KibanaServices.get as jest.Mock;
   let fakeCoreStart: jest.Mocked<CoreStart>;
   let depsStart: DepsStartMock;
@@ -390,7 +389,6 @@ describe.skip('endpoint list middleware', () => {
 
     it('should call get Activity Log API with correct paging options', async () => {
       dispatchUserChangedUrl();
-
       const updatePagingDispatched = waitForAction('endpointDetailsActivityLogUpdatePaging');
       dispatchGetActivityLogPaging({ page: 3 });
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.test.tsx
index e519d19d60fdc..43e19c00bcc8e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.test.tsx
@@ -19,20 +19,14 @@ import { createLoadedResourceState, isLoadedResourceState } from '../../../../..
 import { getPolicyDetailsArtifactsListPath } from '../../../../../common/routing';
 import { EndpointDocGenerator } from '../../../../../../../common/endpoint/generate_data';
 import { policyListApiPathHandlers } from '../../../store/test_mock_utils';
-import { licenseService } from '../../../../../../common/hooks/use_license';
+import {
+  EndpointPrivileges,
+  useEndpointPrivileges,
+} from '../../../../../../common/components/user_privileges/use_endpoint_privileges';
 
 jest.mock('../../../../trusted_apps/service');
-jest.mock('../../../../../../common/hooks/use_license', () => {
-  const licenseServiceInstance = {
-    isPlatinumPlus: jest.fn(),
-  };
-  return {
-    licenseService: licenseServiceInstance,
-    useLicense: () => {
-      return licenseServiceInstance;
-    },
-  };
-});
+jest.mock('../../../../../../common/components/user_privileges/use_endpoint_privileges');
+const mockUseEndpointPrivileges = useEndpointPrivileges as jest.Mock;
 
 let mockedContext: AppContextTestRender;
 let waitForAction: MiddlewareActionSpyHelper['waitForAction'];
@@ -42,8 +36,17 @@ let coreStart: AppContextTestRender['coreStart'];
 let http: typeof coreStart.http;
 const generator = new EndpointDocGenerator();
 
-// unhandled promise rejection: https://github.com/elastic/kibana/issues/112699
-describe.skip('Policy trusted apps layout', () => {
+describe('Policy trusted apps layout', () => {
+  const loadedUserEndpointPrivilegesState = (
+    endpointOverrides: Partial<EndpointPrivileges> = {}
+  ): EndpointPrivileges => ({
+    loading: false,
+    canAccessFleet: true,
+    canAccessEndpointManagement: true,
+    isPlatinumPlus: true,
+    ...endpointOverrides,
+  });
+
   beforeEach(() => {
     mockedContext = createAppRootMockRenderer();
     http = mockedContext.coreStart.http;
@@ -59,6 +62,14 @@ describe.skip('Policy trusted apps layout', () => {
           });
         }
 
+        // GET Agent status for agent policy
+        if (path === '/api/fleet/agent-status') {
+          return Promise.resolve({
+            results: { events: 0, total: 5, online: 3, error: 1, offline: 1 },
+            success: true,
+          });
+        }
+
         // Get package data
         // Used in tests that route back to the list
         if (policyListApiHandlers[path]) {
@@ -78,6 +89,10 @@ describe.skip('Policy trusted apps layout', () => {
     render = () => mockedContext.render(<PolicyTrustedAppsLayout />);
   });
 
+  afterAll(() => {
+    mockUseEndpointPrivileges.mockReset();
+  });
+
   afterEach(() => reactTestingLibrary.cleanup());
 
   it('should renders layout with no existing TA data', async () => {
@@ -121,7 +136,11 @@ describe.skip('Policy trusted apps layout', () => {
   });
 
   it('should hide assign button on empty state with unassigned policies when downgraded to a gold or below license', async () => {
-    (licenseService.isPlatinumPlus as jest.Mock).mockReturnValue(false);
+    mockUseEndpointPrivileges.mockReturnValue(
+      loadedUserEndpointPrivilegesState({
+        isPlatinumPlus: false,
+      })
+    );
     const component = render();
     mockedContext.history.push(getPolicyDetailsArtifactsListPath('1234'));
 
@@ -133,8 +152,13 @@ describe.skip('Policy trusted apps layout', () => {
     });
     expect(component.queryByTestId('assign-ta-button')).toBeNull();
   });
+
   it('should hide the `Assign trusted applications` button when there is data and the license is downgraded to gold or below', async () => {
-    (licenseService.isPlatinumPlus as jest.Mock).mockReturnValue(false);
+    mockUseEndpointPrivileges.mockReturnValue(
+      loadedUserEndpointPrivilegesState({
+        isPlatinumPlus: false,
+      })
+    );
     TrustedAppsHttpServiceMock.mockImplementation(() => {
       return {
         getTrustedAppsList: () => getMockListResponse(),

From 2d953bc83c34cb427030815bf976cc7d1660f594 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 06:12:26 -0400
Subject: [PATCH 02/36] Fix alerts Count table title overflow wraps prematurely
 (#115364) (#115510)

Co-authored-by: Pablo Machado <pablo.nevesmachado@elastic.co>
---
 .../components/alerts_kpis/alerts_count_panel/index.tsx     | 2 +-
 .../components/alerts_kpis/alerts_histogram_panel/index.tsx | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.tsx
index 29324d186784e..c8d45ca67068a 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_count_panel/index.tsx
@@ -94,7 +94,7 @@ export const AlertsCountPanel = memo<AlertsCountPanelProps>(
         <KpiPanel hasBorder data-test-subj="alertsCountPanel">
           <HeaderSection
             id={uniqueQueryId}
-            title={i18n.COUNT_TABLE_TITLE}
+            title={<span className="eui-textBreakNormal">{i18n.COUNT_TABLE_TITLE}</span>}
             titleSize="s"
             hideSubtitle
           >
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
index 0613c619d89b9..07fa81f27684c 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_kpis/alerts_histogram_panel/index.tsx
@@ -257,7 +257,11 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
     }, [showLinkToAlerts, goToDetectionEngine, formatUrl]);
 
     const titleText = useMemo(
-      () => (onlyField == null ? title : i18n.TOP(onlyField)),
+      () => (
+        <span className="eui-textBreakNormal">
+          {onlyField == null ? title : i18n.TOP(onlyField)}
+        </span>
+      ),
       [onlyField, title]
     );
 

From 65786cf25123381e5124c76687f7b0a15600b68e Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 06:17:37 -0400
Subject: [PATCH 03/36] [Security Solution][Endpoint] Change Trusted Apps to
 use `item_id` as its identifier and Enable Trusted Apps filtering by id in
 the UI (#115276) (#115509)

* Add `item_id` to list of searchable fields
* trusted apps api changes to use `item_id` instead of SO `id`
* Change Policy Details Trusted App "View all details" action URL to show TA list filtered by the TA id

Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
---
 .../list/policy_trusted_apps_list.test.tsx    |  2 +-
 .../list/policy_trusted_apps_list.tsx         |  2 +-
 .../pages/trusted_apps/constants.ts           |  1 +
 .../routes/trusted_apps/handlers.test.ts      |  5 +-
 .../endpoint/routes/trusted_apps/mapping.ts   |  2 +-
 .../routes/trusted_apps/service.test.ts       | 24 +++++-
 .../endpoint/routes/trusted_apps/service.ts   | 77 +++++++++++++------
 7 files changed, 84 insertions(+), 29 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
index a8d3cc1505463..b5bfc16db2899 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
@@ -207,7 +207,7 @@ describe('when rendering the PolicyTrustedAppsList', () => {
     expect(appTestContext.coreStart.application.navigateToApp).toHaveBeenCalledWith(
       APP_ID,
       expect.objectContaining({
-        path: '/administration/trusted_apps?show=edit&id=89f72d8a-05b5-4350-8cad-0dc3661d6e67',
+        path: '/administration/trusted_apps?filter=89f72d8a-05b5-4350-8cad-0dc3661d6e67',
       })
     );
   });
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
index f6afd9d502486..7b1f8753831c8 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
@@ -113,7 +113,7 @@ export const PolicyTrustedAppsList = memo<PolicyTrustedAppsListProps>(
 
       for (const trustedApp of trustedAppItems) {
         const isGlobal = trustedApp.effectScope.type === 'global';
-        const viewUrlPath = getTrustedAppsListPath({ id: trustedApp.id, show: 'edit' });
+        const viewUrlPath = getTrustedAppsListPath({ filter: trustedApp.id });
         const assignedPoliciesMenuItems: ArtifactEntryCollapsibleCardProps['policies'] =
           trustedApp.effectScope.type === 'global'
             ? undefined
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/constants.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/constants.ts
index 0602ae18c1408..beefb8587d787 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/constants.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/constants.ts
@@ -8,6 +8,7 @@
 export const SEARCHABLE_FIELDS: Readonly<string[]> = [
   `name`,
   `description`,
+  'item_id',
   `entries.value`,
   `entries.entries.value`,
 ];
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.test.ts
index 547c1f6a2e5ff..614ad4fb548ea 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.test.ts
@@ -110,7 +110,7 @@ const Gold = licenseMock.createLicense({ license: { type: 'gold', mode: 'gold' }
 const packagePolicyClient =
   createPackagePolicyServiceMock() as jest.Mocked<PackagePolicyServiceInterface>;
 
-describe('handlers', () => {
+describe('TrustedApps API Handlers', () => {
   beforeEach(() => {
     packagePolicyClient.getByIDs.mockReset();
   });
@@ -195,6 +195,7 @@ describe('handlers', () => {
       const mockResponse = httpServerMock.createResponseFactory();
 
       exceptionsListClient.deleteExceptionListItem.mockResolvedValue(null);
+      exceptionsListClient.getExceptionListItem.mockResolvedValue(null);
 
       await deleteTrustedAppHandler(
         createHandlerContextMock(),
@@ -582,7 +583,7 @@ describe('handlers', () => {
     });
 
     it('should return 404 if trusted app does not exist', async () => {
-      exceptionsListClient.getExceptionListItem.mockResolvedValueOnce(null);
+      exceptionsListClient.getExceptionListItem.mockResolvedValue(null);
 
       await updateHandler(
         createHandlerContextMock(),
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts
index 2c085c14db009..08c1a3a809d4a 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.ts
@@ -122,7 +122,7 @@ export const exceptionListItemToTrustedApp = (
     const grouped = entriesToConditionEntriesMap(exceptionListItem.entries);
 
     return {
-      id: exceptionListItem.id,
+      id: exceptionListItem.item_id,
       version: exceptionListItem._version || '',
       name: exceptionListItem.name,
       description: exceptionListItem.description,
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.test.ts
index dce84df735929..c57416ff1c974 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.test.ts
@@ -85,9 +85,10 @@ const TRUSTED_APP: TrustedApp = {
   ],
 };
 
-describe('service', () => {
+describe('TrustedApps service', () => {
   beforeEach(() => {
     exceptionsListClient.deleteExceptionListItem.mockReset();
+    exceptionsListClient.getExceptionListItem.mockReset();
     exceptionsListClient.createExceptionListItem.mockReset();
     exceptionsListClient.findExceptionListItem.mockReset();
     exceptionsListClient.createTrustedAppsList.mockReset();
@@ -96,6 +97,7 @@ describe('service', () => {
 
   describe('deleteTrustedApp', () => {
     it('should delete existing trusted app', async () => {
+      exceptionsListClient.getExceptionListItem.mockResolvedValue(EXCEPTION_LIST_ITEM);
       exceptionsListClient.deleteExceptionListItem.mockResolvedValue(EXCEPTION_LIST_ITEM);
 
       expect(await deleteTrustedApp(exceptionsListClient, { id: '123' })).toBeUndefined();
@@ -107,6 +109,7 @@ describe('service', () => {
     });
 
     it('should throw for non existing trusted app', async () => {
+      exceptionsListClient.getExceptionListItem.mockResolvedValue(null);
       exceptionsListClient.deleteExceptionListItem.mockResolvedValue(null);
 
       await expect(deleteTrustedApp(exceptionsListClient, { id: '123' })).rejects.toBeInstanceOf(
@@ -393,7 +396,7 @@ describe('service', () => {
     });
 
     it('should throw a Not Found error if trusted app is not found prior to making update', async () => {
-      exceptionsListClient.getExceptionListItem.mockResolvedValueOnce(null);
+      exceptionsListClient.getExceptionListItem.mockResolvedValue(null);
       await expect(
         updateTrustedApp(
           exceptionsListClient,
@@ -489,5 +492,22 @@ describe('service', () => {
         TrustedAppNotFoundError
       );
     });
+
+    it('should try to find trusted app by `itemId` and then by `id`', async () => {
+      exceptionsListClient.getExceptionListItem.mockResolvedValue(null);
+      await getTrustedApp(exceptionsListClient, '123').catch(() => Promise.resolve());
+
+      expect(exceptionsListClient.getExceptionListItem).toHaveBeenCalledTimes(2);
+      expect(exceptionsListClient.getExceptionListItem).toHaveBeenNthCalledWith(1, {
+        itemId: '123',
+        id: undefined,
+        namespaceType: 'agnostic',
+      });
+      expect(exceptionsListClient.getExceptionListItem).toHaveBeenNthCalledWith(2, {
+        itemId: undefined,
+        id: '123',
+        namespaceType: 'agnostic',
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.ts
index 856a615c1ffa2..7a4b2372ece8f 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.ts
@@ -15,13 +15,13 @@ import {
   DeleteTrustedAppsRequestParams,
   GetOneTrustedAppResponse,
   GetTrustedAppsListRequest,
-  GetTrustedAppsSummaryResponse,
   GetTrustedAppsListResponse,
+  GetTrustedAppsSummaryRequest,
+  GetTrustedAppsSummaryResponse,
   PostTrustedAppCreateRequest,
   PostTrustedAppCreateResponse,
   PutTrustedAppUpdateRequest,
   PutTrustedAppUpdateResponse,
-  GetTrustedAppsSummaryRequest,
   TrustedApp,
 } from '../../../../common/endpoint/types';
 
@@ -33,8 +33,8 @@ import {
 } from './mapping';
 import {
   TrustedAppNotFoundError,
-  TrustedAppVersionConflictError,
   TrustedAppPolicyNotExistsError,
+  TrustedAppVersionConflictError,
 } from './errors';
 import { PackagePolicyServiceInterface } from '../../../../../fleet/server';
 import { PackagePolicy } from '../../../../../fleet/common';
@@ -87,30 +87,61 @@ const isUserTryingToModifyEffectScopeWithoutPermissions = (
   }
 };
 
-export const deleteTrustedApp = async (
+/**
+ * Attempts to first fine the ExceptionItem using `item_id` and if not found, then a second attempt wil be done
+ * against the Saved Object `id`.
+ * @param exceptionsListClient
+ * @param id
+ */
+export const findTrustedAppExceptionItemByIdOrItemId = async (
   exceptionsListClient: ExceptionListClient,
-  { id }: DeleteTrustedAppsRequestParams
-) => {
-  const exceptionListItem = await exceptionsListClient.deleteExceptionListItem({
-    id,
+  id: string
+): Promise<ExceptionListItemSchema | null> => {
+  const trustedAppExceptionItem = await exceptionsListClient.getExceptionListItem({
+    itemId: id,
+    id: undefined,
+    namespaceType: 'agnostic',
+  });
+
+  if (trustedAppExceptionItem) {
+    return trustedAppExceptionItem;
+  }
+
+  return exceptionsListClient.getExceptionListItem({
     itemId: undefined,
+    id,
     namespaceType: 'agnostic',
   });
+};
 
-  if (!exceptionListItem) {
+export const deleteTrustedApp = async (
+  exceptionsListClient: ExceptionListClient,
+  { id }: DeleteTrustedAppsRequestParams
+): Promise<void> => {
+  const trustedAppExceptionItem = await findTrustedAppExceptionItemByIdOrItemId(
+    exceptionsListClient,
+    id
+  );
+
+  if (!trustedAppExceptionItem) {
     throw new TrustedAppNotFoundError(id);
   }
+
+  await exceptionsListClient.deleteExceptionListItem({
+    id: trustedAppExceptionItem.id,
+    itemId: undefined,
+    namespaceType: 'agnostic',
+  });
 };
 
 export const getTrustedApp = async (
   exceptionsListClient: ExceptionListClient,
   id: string
 ): Promise<GetOneTrustedAppResponse> => {
-  const trustedAppExceptionItem = await exceptionsListClient.getExceptionListItem({
-    itemId: '',
-    id,
-    namespaceType: 'agnostic',
-  });
+  const trustedAppExceptionItem = await findTrustedAppExceptionItemByIdOrItemId(
+    exceptionsListClient,
+    id
+  );
 
   if (!trustedAppExceptionItem) {
     throw new TrustedAppNotFoundError(id);
@@ -189,19 +220,18 @@ export const updateTrustedApp = async (
   updatedTrustedApp: PutTrustedAppUpdateRequest,
   isAtLeastPlatinum: boolean
 ): Promise<PutTrustedAppUpdateResponse> => {
-  const currentTrustedApp = await exceptionsListClient.getExceptionListItem({
-    itemId: '',
-    id,
-    namespaceType: 'agnostic',
-  });
+  const currentTrustedAppExceptionItem = await findTrustedAppExceptionItemByIdOrItemId(
+    exceptionsListClient,
+    id
+  );
 
-  if (!currentTrustedApp) {
+  if (!currentTrustedAppExceptionItem) {
     throw new TrustedAppNotFoundError(id);
   }
 
   if (
     isUserTryingToModifyEffectScopeWithoutPermissions(
-      exceptionListItemToTrustedApp(currentTrustedApp),
+      exceptionListItemToTrustedApp(currentTrustedAppExceptionItem),
       updatedTrustedApp,
       isAtLeastPlatinum
     )
@@ -226,7 +256,10 @@ export const updateTrustedApp = async (
 
   try {
     updatedTrustedAppExceptionItem = await exceptionsListClient.updateExceptionListItem(
-      updatedTrustedAppToUpdateExceptionListItemOptions(currentTrustedApp, updatedTrustedApp)
+      updatedTrustedAppToUpdateExceptionListItemOptions(
+        currentTrustedAppExceptionItem,
+        updatedTrustedApp
+      )
     );
   } catch (e) {
     if (e?.output?.statusCode === 409) {

From 8fec45c45972495ff9f8e95b555509501c2eeadc Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 06:47:44 -0400
Subject: [PATCH 04/36] [Discover] Enable description for saved search modal
 (#114257) (#115514)

* [Discover] enable description for saved search

* [Discover] remove i18n translations for removed description

* [Discover] apply Tim's suggestion

* [Discover] update snapshot

* [Discover] reorder top nav buttons in tests

* [Description] fix description save action

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Dmitry Tomashevich <39378793+Dmitriynj@users.noreply.github.com>
---
 .../components/top_nav/discover_topnav.test.tsx  |  2 +-
 .../components/top_nav/get_top_nav_links.test.ts | 16 +++++++++-------
 .../main/components/top_nav/get_top_nav_links.ts |  4 +++-
 .../main/components/top_nav/on_save_search.tsx   | 10 +++++-----
 .../embeddable/saved_search_embeddable.tsx       |  4 ++++
 .../plugins/translations/translations/ja-JP.json |  1 -
 .../plugins/translations/translations/zh-CN.json |  1 -
 7 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/src/plugins/discover/public/application/apps/main/components/top_nav/discover_topnav.test.tsx b/src/plugins/discover/public/application/apps/main/components/top_nav/discover_topnav.test.tsx
index 4b572f6e348b8..808346b53304c 100644
--- a/src/plugins/discover/public/application/apps/main/components/top_nav/discover_topnav.test.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/top_nav/discover_topnav.test.tsx
@@ -42,7 +42,7 @@ describe('Discover topnav component', () => {
     const props = getProps(true);
     const component = shallowWithIntl(<DiscoverTopNav {...props} />);
     const topMenuConfig = component.props().config.map((obj: TopNavMenuData) => obj.id);
-    expect(topMenuConfig).toEqual(['options', 'new', 'save', 'open', 'share', 'inspect']);
+    expect(topMenuConfig).toEqual(['options', 'new', 'open', 'share', 'inspect', 'save']);
   });
 
   test('generated config of TopNavMenu config is correct when no discover save permissions are assigned', () => {
diff --git a/src/plugins/discover/public/application/apps/main/components/top_nav/get_top_nav_links.test.ts b/src/plugins/discover/public/application/apps/main/components/top_nav/get_top_nav_links.test.ts
index d31ac6e0f2fea..20c5b9bae332d 100644
--- a/src/plugins/discover/public/application/apps/main/components/top_nav/get_top_nav_links.test.ts
+++ b/src/plugins/discover/public/application/apps/main/components/top_nav/get_top_nav_links.test.ts
@@ -53,13 +53,6 @@ test('getTopNavLinks result', () => {
         "run": [Function],
         "testId": "discoverNewButton",
       },
-      Object {
-        "description": "Save Search",
-        "id": "save",
-        "label": "Save",
-        "run": [Function],
-        "testId": "discoverSaveButton",
-      },
       Object {
         "description": "Open Saved Search",
         "id": "open",
@@ -81,6 +74,15 @@ test('getTopNavLinks result', () => {
         "run": [Function],
         "testId": "openInspectorButton",
       },
+      Object {
+        "description": "Save Search",
+        "emphasize": true,
+        "iconType": "save",
+        "id": "save",
+        "label": "Save",
+        "run": [Function],
+        "testId": "discoverSaveButton",
+      },
     ]
   `);
 });
diff --git a/src/plugins/discover/public/application/apps/main/components/top_nav/get_top_nav_links.ts b/src/plugins/discover/public/application/apps/main/components/top_nav/get_top_nav_links.ts
index 81be662470306..44d2999947f41 100644
--- a/src/plugins/discover/public/application/apps/main/components/top_nav/get_top_nav_links.ts
+++ b/src/plugins/discover/public/application/apps/main/components/top_nav/get_top_nav_links.ts
@@ -76,6 +76,8 @@ export const getTopNavLinks = ({
       defaultMessage: 'Save Search',
     }),
     testId: 'discoverSaveButton',
+    iconType: 'save',
+    emphasize: true,
     run: () => onSaveSearch({ savedSearch, services, indexPattern, navigateTo, state }),
   };
 
@@ -153,9 +155,9 @@ export const getTopNavLinks = ({
   return [
     ...(services.capabilities.advancedSettings.save ? [options] : []),
     newSearch,
-    ...(services.capabilities.discover.save ? [saveSearch] : []),
     openSearch,
     shareSearch,
     inspectSearch,
+    ...(services.capabilities.discover.save ? [saveSearch] : []),
   ];
 };
diff --git a/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx b/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx
index 18766b5df7f33..25b04e12c650a 100644
--- a/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/top_nav/on_save_search.tsx
@@ -98,16 +98,19 @@ export async function onSaveSearch({
   const onSave = async ({
     newTitle,
     newCopyOnSave,
+    newDescription,
     isTitleDuplicateConfirmed,
     onTitleDuplicate,
   }: {
     newTitle: string;
     newCopyOnSave: boolean;
+    newDescription: string;
     isTitleDuplicateConfirmed: boolean;
     onTitleDuplicate: () => void;
   }) => {
     const currentTitle = savedSearch.title;
     savedSearch.title = newTitle;
+    savedSearch.description = newDescription;
     const saveOptions: SaveSavedSearchOptions = {
       onTitleDuplicate,
       copyOnSave: newCopyOnSave,
@@ -136,14 +139,11 @@ export async function onSaveSearch({
       onClose={() => {}}
       title={savedSearch.title ?? ''}
       showCopyOnSave={!!savedSearch.id}
+      description={savedSearch.description}
       objectType={i18n.translate('discover.localMenu.saveSaveSearchObjectType', {
         defaultMessage: 'search',
       })}
-      description={i18n.translate('discover.localMenu.saveSaveSearchDescription', {
-        defaultMessage:
-          'Save your Discover search so you can use it in visualizations and dashboards',
-      })}
-      showDescription={false}
+      showDescription={true}
     />
   );
   showSaveModal(saveModal, services.core.i18n.Context);
diff --git a/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx b/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx
index 8849806cf5959..89c47559d7b4c 100644
--- a/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx
+++ b/src/plugins/discover/public/application/embeddable/saved_search_embeddable.tsx
@@ -402,6 +402,10 @@ export class SavedSearchEmbeddable
     return this.inspectorAdapters;
   }
 
+  public getDescription() {
+    return this.savedSearch.description;
+  }
+
   public destroy() {
     super.destroy();
     if (this.searchProps) {
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 113eae5d08e07..f909a03909e3f 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -2534,7 +2534,6 @@
     "discover.localMenu.openSavedSearchDescription": "保存された検索を開きます",
     "discover.localMenu.openTitle": "開く",
     "discover.localMenu.optionsDescription": "オプション",
-    "discover.localMenu.saveSaveSearchDescription": "ビジュアライゼーションとダッシュボードで使用できるように Discover の検索を保存します",
     "discover.localMenu.saveSaveSearchObjectType": "検索",
     "discover.localMenu.saveSearchDescription": "検索を保存します",
     "discover.localMenu.saveTitle": "保存",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 15933599699eb..4de407cf8e464 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -2560,7 +2560,6 @@
     "discover.localMenu.openSavedSearchDescription": "打开已保存搜索",
     "discover.localMenu.openTitle": "打开",
     "discover.localMenu.optionsDescription": "选项",
-    "discover.localMenu.saveSaveSearchDescription": "保存您的 Discover 搜索，以便可以在可视化和仪表板中使用该搜索",
     "discover.localMenu.saveSaveSearchObjectType": "搜索",
     "discover.localMenu.saveSearchDescription": "保存搜索",
     "discover.localMenu.saveTitle": "保存",

From 44e0e53877b16723cf792e2ebea0e345c6de0231 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 07:10:02 -0400
Subject: [PATCH 05/36] [Security Solution][Rules] Halt Indicator Match
 execution after interval has passed (#115288) (#115517)

* Throw an error to stop execution if IM rule has exceeded its interval

* Extract and unit test our timeout validation

* Add integration test around timeout behavior

Configures a very slow rule to trigger a timeout and assert the
corresponding failure.

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
---
 .../threat_mapping/create_threat_signals.ts   |  6 ++-
 .../signals/threat_mapping/utils.test.ts      | 23 ++++++++++
 .../signals/threat_mapping/utils.ts           | 21 +++++++++
 .../tests/create_threat_matching.ts           | 46 +++++++++++++++++++
 4 files changed, 95 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_threat_signals.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_threat_signals.ts
index 169a820392a6e..677a2028acdf7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_threat_signals.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_threat_signals.ts
@@ -11,7 +11,7 @@ import { getThreatList, getThreatListCount } from './get_threat_list';
 import { CreateThreatSignalsOptions } from './types';
 import { createThreatSignal } from './create_threat_signal';
 import { SearchAfterAndBulkCreateReturnType } from '../types';
-import { combineConcurrentResults } from './utils';
+import { buildExecutionIntervalValidator, combineConcurrentResults } from './utils';
 import { buildThreatEnrichment } from './build_threat_enrichment';
 
 export const createThreatSignals = async ({
@@ -46,6 +46,9 @@ export const createThreatSignals = async ({
   const params = ruleSO.attributes.params;
   logger.debug(buildRuleMessage('Indicator matching rule starting'));
   const perPage = concurrentSearches * itemsPerSearch;
+  const verifyExecutionCanProceed = buildExecutionIntervalValidator(
+    ruleSO.attributes.schedule.interval
+  );
 
   let results: SearchAfterAndBulkCreateReturnType = {
     success: true,
@@ -99,6 +102,7 @@ export const createThreatSignals = async ({
   });
 
   while (threatList.hits.hits.length !== 0) {
+    verifyExecutionCanProceed();
     const chunks = chunk(itemsPerSearch, threatList.hits.hits);
     logger.debug(buildRuleMessage(`${chunks.length} concurrent indicator searches are starting.`));
     const concurrentSearchesPerformed = chunks.map<Promise<SearchAfterAndBulkCreateReturnType>>(
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/utils.test.ts
index ec826b44023f6..f029b02127b08 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/utils.test.ts
@@ -10,6 +10,7 @@ import { sampleSignalHit } from '../__mocks__/es_results';
 import { ThreatMatchNamedQuery } from './types';
 
 import {
+  buildExecutionIntervalValidator,
   calculateAdditiveMax,
   calculateMax,
   calculateMaxLookBack,
@@ -712,4 +713,26 @@ describe('utils', () => {
       });
     });
   });
+
+  describe('buildExecutionIntervalValidator', () => {
+    it('succeeds if the validator is called within the specified interval', () => {
+      const validator = buildExecutionIntervalValidator('1m');
+      expect(() => validator()).not.toThrowError();
+    });
+
+    it('throws an error if the validator is called after the specified interval', async () => {
+      const validator = buildExecutionIntervalValidator('1s');
+
+      await new Promise((r) => setTimeout(r, 1001));
+      expect(() => validator()).toThrowError(
+        'Current rule execution has exceeded its allotted interval (1s) and has been stopped.'
+      );
+    });
+
+    it('throws an error if the interval cannot be parsed', () => {
+      expect(() => buildExecutionIntervalValidator('badString')).toThrowError(
+        'Unable to parse rule interval (badString); stopping rule execution since allotted duration is undefined'
+      );
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/utils.ts
index 4d9fda43f032e..99f6609faec91 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/utils.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
+import moment from 'moment';
+
 import { SearchAfterAndBulkCreateReturnType, SignalSourceHit } from '../types';
+import { parseInterval } from '../utils';
 import { ThreatMatchNamedQuery } from './types';
 
 /**
@@ -146,3 +149,21 @@ export const decodeThreatMatchNamedQuery = (encoded: string): ThreatMatchNamedQu
 
 export const extractNamedQueries = (hit: SignalSourceHit): ThreatMatchNamedQuery[] =>
   hit.matched_queries?.map((match) => decodeThreatMatchNamedQuery(match)) ?? [];
+
+export const buildExecutionIntervalValidator: (interval: string) => () => void = (interval) => {
+  const intervalDuration = parseInterval(interval);
+
+  if (intervalDuration == null) {
+    throw new Error(
+      `Unable to parse rule interval (${interval}); stopping rule execution since allotted duration is undefined.`
+    );
+  }
+
+  const executionEnd = moment().add(intervalDuration);
+  return () => {
+    if (moment().isAfter(executionEnd)) {
+      const message = `Current rule execution has exceeded its allotted interval (${interval}) and has been stopped.`;
+      throw new Error(message);
+    }
+  };
+};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
index 0aad3c699805a..223529fce54f6 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
@@ -411,6 +411,52 @@ export default ({ getService }: FtrProviderContext) => {
         expect(signalsOpen.hits.hits.length).equal(0);
       });
 
+      describe('timeout behavior', () => {
+        it('will return an error if a rule execution exceeds the rule interval', async () => {
+          const rule: CreateRulesSchema = {
+            description: 'Detecting root and admin users',
+            name: 'Query with a short interval',
+            severity: 'high',
+            index: ['auditbeat-*'],
+            type: 'threat_match',
+            risk_score: 55,
+            language: 'kuery',
+            rule_id: 'rule-1',
+            from: '1900-01-01T00:00:00.000Z',
+            query: '*:*',
+            threat_query: '*:*', // broad query to take more time
+            threat_index: ['auditbeat-*'], // We use auditbeat as both the matching index and the threat list for simplicity
+            threat_mapping: [
+              {
+                entries: [
+                  {
+                    field: 'host.name',
+                    value: 'host.name',
+                    type: 'mapping',
+                  },
+                ],
+              },
+            ],
+            threat_filters: [],
+            concurrent_searches: 1,
+            interval: '1s', // short interval
+            items_per_search: 1, // iterate only 1 threat item per loop to ensure we're slow
+          };
+
+          const { id } = await createRule(supertest, rule);
+          await waitForRuleSuccessOrStatus(supertest, id, 'failed');
+
+          const { body } = await supertest
+            .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
+            .set('kbn-xsrf', 'true')
+            .send({ ids: [id] })
+            .expect(200);
+          expect(body[id].current_status.last_failure_message).to.contain(
+            'execution has exceeded its allotted interval'
+          );
+        });
+      });
+
       describe('indicator enrichment', () => {
         before(async () => {
           await esArchiver.load('x-pack/test/functional/es_archives/filebeat/threat_intel');

From 0c86129e4a21838983b23bdbc778d2f20d2751c0 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 07:37:34 -0400
Subject: [PATCH 06/36] [Security Solution][Detections] Hide building block
 rules in "Security/Overview" (#105611) (#115521)

* Hide building block rules in "Security/Overview"

* Add Cypress tests for alerts generated by building block rules

Co-authored-by: Dmitry Shevchenko <dmshevch@gmail.com>

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
Co-authored-by: Dmitry Shevchenko <dmshevch@gmail.com>
---
 .../building_block_alerts.spec.ts             | 40 +++++++++++++++++++
 .../security_solution/cypress/objects/rule.ts | 20 ++++++++++
 .../cypress/screens/overview.ts               |  2 +
 .../cypress/tasks/api_calls/rules.ts          |  1 +
 .../components/signals_by_category/index.tsx  | 15 +++++--
 .../use_filters_for_signals_by_category.ts    | 37 +++++++++++++++++
 6 files changed, 111 insertions(+), 4 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/cypress/integration/detection_alerts/building_block_alerts.spec.ts
 create mode 100644 x-pack/plugins/security_solution/public/overview/components/signals_by_category/use_filters_for_signals_by_category.ts

diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/building_block_alerts.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/building_block_alerts.spec.ts
new file mode 100644
index 0000000000000..262ffe8163e57
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/building_block_alerts.spec.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getBuildingBlockRule } from '../../objects/rule';
+import { OVERVIEW_ALERTS_HISTOGRAM } from '../../screens/overview';
+import { OVERVIEW } from '../../screens/security_header';
+import { goToRuleDetails } from '../../tasks/alerts_detection_rules';
+import { createCustomRuleActivated } from '../../tasks/api_calls/rules';
+import { cleanKibana } from '../../tasks/common';
+import { waitForAlertsToPopulate, waitForTheRuleToBeExecuted } from '../../tasks/create_new_rule';
+import { loginAndWaitForPage } from '../../tasks/login';
+import { navigateFromHeaderTo } from '../../tasks/security_header';
+import { DETECTIONS_RULE_MANAGEMENT_URL } from '../../urls/navigation';
+
+const EXPECTED_NUMBER_OF_ALERTS = 16;
+
+describe('Alerts generated by building block rules', () => {
+  beforeEach(() => {
+    cleanKibana();
+  });
+
+  it('Alerts should be visible on the Rule Detail page and not visible on the Overview page', () => {
+    createCustomRuleActivated(getBuildingBlockRule());
+    loginAndWaitForPage(DETECTIONS_RULE_MANAGEMENT_URL);
+    goToRuleDetails();
+    waitForTheRuleToBeExecuted();
+
+    // Check that generated events are visible on the Details page
+    waitForAlertsToPopulate(EXPECTED_NUMBER_OF_ALERTS);
+
+    navigateFromHeaderTo(OVERVIEW);
+
+    // Check that generated events are hidden on the Overview page
+    cy.get(OVERVIEW_ALERTS_HISTOGRAM).should('contain.text', 'No data to display');
+  });
+});
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index 4b061865d632b..27973854097db 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -58,6 +58,7 @@ export interface CustomRule {
   lookBack: Interval;
   timeline: CompleteTimeline;
   maxSignals: number;
+  buildingBlockType?: string;
 }
 
 export interface ThresholdRule extends CustomRule {
@@ -188,6 +189,25 @@ export const getNewRule = (): CustomRule => ({
   maxSignals: 100,
 });
 
+export const getBuildingBlockRule = (): CustomRule => ({
+  customQuery: 'host.name: *',
+  index: getIndexPatterns(),
+  name: 'Building Block Rule Test',
+  description: 'The new rule description.',
+  severity: 'High',
+  riskScore: '17',
+  tags: ['test', 'newRule'],
+  referenceUrls: ['http://example.com/', 'https://example.com/'],
+  falsePositivesExamples: ['False1', 'False2'],
+  mitre: [getMitre1(), getMitre2()],
+  note: '# test markdown',
+  runsEvery: getRunsEvery(),
+  lookBack: getLookBack(),
+  timeline: getTimeline(),
+  maxSignals: 100,
+  buildingBlockType: 'default',
+});
+
 export const getUnmappedRule = (): CustomRule => ({
   customQuery: '*:*',
   index: ['unmapped*'],
diff --git a/x-pack/plugins/security_solution/cypress/screens/overview.ts b/x-pack/plugins/security_solution/cypress/screens/overview.ts
index 1376a39e5ee79..1945b7e3ce3e7 100644
--- a/x-pack/plugins/security_solution/cypress/screens/overview.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/overview.ts
@@ -166,3 +166,5 @@ export const OVERVIEW_RISKY_HOSTS_VIEW_DASHBOARD_BUTTON =
 export const OVERVIEW_RISKY_HOSTS_TOTAL_EVENT_COUNT = `${OVERVIEW_RISKY_HOSTS_LINKS} [data-test-subj="header-panel-subtitle"]`;
 export const OVERVIEW_RISKY_HOSTS_ENABLE_MODULE_BUTTON =
   '[data-test-subj="risky-hosts-enable-module-button"]';
+
+export const OVERVIEW_ALERTS_HISTOGRAM = '[data-test-subj="alerts-histogram-panel"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/api_calls/rules.ts b/x-pack/plugins/security_solution/cypress/tasks/api_calls/rules.ts
index 04ff0fcabc081..fd2838e5b3caa 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/api_calls/rules.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/api_calls/rules.ts
@@ -114,6 +114,7 @@ export const createCustomRuleActivated = (
       enabled: true,
       tags: ['rule1'],
       max_signals: maxSignals,
+      building_block_type: rule.buildingBlockType,
     },
     headers: { 'kbn-xsrf': 'cypress-creds' },
     failOnStatusCode: false,
diff --git a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
index 321e6d00b5301..cbeb1464e1b41 100644
--- a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/index.tsx
@@ -7,19 +7,24 @@
 
 import React, { useCallback } from 'react';
 import { useDispatch } from 'react-redux';
+import { Filter, Query } from '@kbn/es-query';
 
 import { AlertsHistogramPanel } from '../../../detections/components/alerts_kpis/alerts_histogram_panel';
 import { useSignalIndex } from '../../../detections/containers/detection_engine/alerts/use_signal_index';
 import { setAbsoluteRangeDatePicker } from '../../../common/store/inputs/actions';
-import { Filter, Query } from '../../../../../../../src/plugins/data/public';
+
 import { InputsModelId } from '../../../common/store/inputs/constants';
-import * as i18n from '../../pages/translations';
 import { UpdateDateRange } from '../../../common/components/charts/common';
+
 import { AlertsStackByField } from '../../../detections/components/alerts_kpis/common/types';
 
+import * as i18n from '../../pages/translations';
+
+import { useFiltersForSignalsByCategory } from './use_filters_for_signals_by_category';
+
 interface Props {
   combinedQueries?: string;
-  filters?: Filter[];
+  filters: Filter[];
   headerChildren?: React.ReactNode;
   /** Override all defaults, and only display this field */
   onlyField?: AlertsStackByField;
@@ -43,6 +48,8 @@ const SignalsByCategoryComponent: React.FC<Props> = ({
 }) => {
   const dispatch = useDispatch();
   const { signalIndexName } = useSignalIndex();
+  const filtersForSignalsByCategory = useFiltersForSignalsByCategory(filters);
+
   const updateDateRangeCallback = useCallback<UpdateDateRange>(
     ({ x }) => {
       if (!x) {
@@ -63,7 +70,7 @@ const SignalsByCategoryComponent: React.FC<Props> = ({
   return (
     <AlertsHistogramPanel
       combinedQueries={combinedQueries}
-      filters={filters}
+      filters={filtersForSignalsByCategory}
       headerChildren={headerChildren}
       legendPosition={'right'}
       onlyField={onlyField}
diff --git a/x-pack/plugins/security_solution/public/overview/components/signals_by_category/use_filters_for_signals_by_category.ts b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/use_filters_for_signals_by_category.ts
new file mode 100644
index 0000000000000..6f87cb72763d3
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/overview/components/signals_by_category/use_filters_for_signals_by_category.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import { Filter } from '@kbn/es-query';
+
+import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
+import {
+  buildShowBuildingBlockFilter,
+  buildShowBuildingBlockFilterRuleRegistry,
+} from '../../../detections/components/alerts_table/default_config';
+
+// On the Overview page, in the Detection Alert Trend, we never show
+// "building block" alerts to remove noise from the Overview UI.
+// https://www.elastic.co/guide/en/security/current/building-block-rule.html
+const SHOW_BUILDING_BLOCK_ALERTS = false;
+
+export const useFiltersForSignalsByCategory = (baseFilters: Filter[]) => {
+  // TODO: Once we are past experimental phase this code should be removed
+  const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
+
+  const resultingFilters = useMemo(
+    () => [
+      ...baseFilters,
+      ...(ruleRegistryEnabled
+        ? buildShowBuildingBlockFilterRuleRegistry(SHOW_BUILDING_BLOCK_ALERTS) // TODO: Once we are past experimental phase this code should be removed
+        : buildShowBuildingBlockFilter(SHOW_BUILDING_BLOCK_ALERTS)),
+    ],
+    [baseFilters, ruleRegistryEnabled]
+  );
+
+  return resultingFilters;
+};

From f54724dc2b9f4597b137054864db3e63e6402144 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 07:37:47 -0400
Subject: [PATCH 07/36] [Unified Integrations] Clean up empty states, tutorial
 links and routing to prefer unified integrations (#114911) (#115493)

Cleans up the integrations view and redirects all links to the integration manager.

Co-authored-by: Caroline Horn <549577+cchaos@users.noreply.github.com>
---
 .../chrome/ui/header/collapsible_nav.tsx      |   2 +-
 .../__snapshots__/add_data.test.tsx.snap      |  16 +-
 .../components/add_data/add_data.test.tsx     |   4 +-
 .../components/add_data/add_data.tsx          | 152 +++++++++---------
 .../components/sample_data/index.tsx          |   4 +-
 .../components/tutorial_directory.js          |  56 +------
 .../public/application/components/welcome.tsx |   3 +-
 src/plugins/home/public/index.ts              |   1 -
 src/plugins/home/public/services/index.ts     |   1 -
 .../home/public/services/tutorials/index.ts   |   1 -
 .../tutorials/tutorial_service.mock.ts        |   1 -
 .../tutorials/tutorial_service.test.tsx       |  32 ----
 .../services/tutorials/tutorial_service.ts    |  18 ---
 .../empty_index_list_prompt.tsx               |   2 +-
 .../__snapshots__/overview.test.tsx.snap      | 110 +++----------
 .../public/components/overview/overview.tsx   |  12 +-
 .../public/assets/elastic_beats_card_dark.svg |   1 -
 .../assets/elastic_beats_card_light.svg       |   1 -
 .../__snapshots__/no_data_page.test.tsx.snap  |   4 +-
 .../elastic_agent_card.test.tsx.snap          |  55 ++++++-
 .../elastic_beats_card.test.tsx.snap          |  70 --------
 .../no_data_card/elastic_agent_card.test.tsx  |  10 +-
 .../no_data_card/elastic_agent_card.tsx       |  44 ++++-
 .../no_data_card/elastic_beats_card.test.tsx  |  45 ------
 .../no_data_card/elastic_beats_card.tsx       |  66 --------
 .../no_data_page/no_data_card/index.ts        |   1 -
 .../no_data_page/no_data_page.tsx             |  14 +-
 .../components/app/RumDashboard/RumHome.tsx   |   8 +-
 .../routing/templates/no_data_config.ts       |  10 +-
 .../epm/components/package_list_grid.tsx      |   2 +-
 .../components/home_integration/index.tsx     |   8 -
 .../tutorial_directory_header_link.tsx        |  16 +-
 .../tutorial_directory_notice.tsx             | 147 -----------------
 x-pack/plugins/fleet/public/plugin.ts         |   7 +-
 .../infra/public/pages/logs/page_content.tsx  |   2 +-
 .../infra/public/pages/logs/page_template.tsx |   6 +-
 .../logs/stream/page_no_indices_content.tsx   |   4 +-
 .../infra/public/pages/metrics/index.tsx      |   4 +-
 .../metric_detail/components/invalid_node.tsx |   4 +-
 .../public/pages/metrics/page_template.tsx    |   9 +-
 .../components/app/header/header_menu.tsx     |   2 +-
 .../public/utils/no_data_config.ts            |   7 +-
 .../security_solution/common/constants.ts     |   2 +-
 .../components/overview_empty/index.test.tsx  |  12 +-
 .../components/overview_empty/index.tsx       |  50 ++----
 .../translations/translations/ja-JP.json      |  11 --
 .../translations/translations/zh-CN.json      |  11 --
 x-pack/test/accessibility/apps/home.ts        |  27 ----
 48 files changed, 292 insertions(+), 783 deletions(-)
 delete mode 100644 src/plugins/kibana_react/public/assets/elastic_beats_card_dark.svg
 delete mode 100644 src/plugins/kibana_react/public/assets/elastic_beats_card_light.svg
 delete mode 100644 src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_beats_card.test.tsx.snap
 delete mode 100644 src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_beats_card.test.tsx
 delete mode 100644 src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_beats_card.tsx
 delete mode 100644 x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_notice.tsx

diff --git a/src/core/public/chrome/ui/header/collapsible_nav.tsx b/src/core/public/chrome/ui/header/collapsible_nav.tsx
index ad590865b9e14..ccc0e17b655b1 100644
--- a/src/core/public/chrome/ui/header/collapsible_nav.tsx
+++ b/src/core/public/chrome/ui/header/collapsible_nav.tsx
@@ -362,7 +362,7 @@ export function CollapsibleNav({
               iconType="plusInCircleFilled"
             >
               {i18n.translate('core.ui.primaryNav.addData', {
-                defaultMessage: 'Add data',
+                defaultMessage: 'Add integrations',
               })}
             </EuiButton>
           </EuiCollapsibleNavGroup>
diff --git a/src/plugins/home/public/application/components/add_data/__snapshots__/add_data.test.tsx.snap b/src/plugins/home/public/application/components/add_data/__snapshots__/add_data.test.tsx.snap
index 26b5697f008b6..de6beab31247a 100644
--- a/src/plugins/home/public/application/components/add_data/__snapshots__/add_data.test.tsx.snap
+++ b/src/plugins/home/public/application/components/add_data/__snapshots__/add_data.test.tsx.snap
@@ -17,7 +17,7 @@ exports[`AddData render 1`] = `
             id="homDataAdd__title"
           >
             <FormattedMessage
-              defaultMessage="Get started by adding your data"
+              defaultMessage="Get started by adding integrations"
               id="home.addData.sectionTitle"
               values={Object {}}
             />
@@ -43,17 +43,25 @@ exports[`AddData render 1`] = `
             grow={false}
           >
             <RedirectAppLinks
-              application={Object {}}
+              application={
+                Object {
+                  "capabilities": Object {
+                    "navLinks": Object {
+                      "integrations": true,
+                    },
+                  },
+                }
+              }
             >
               <EuiButton
                 data-test-subj="homeAddData"
                 fill={true}
-                href="/app/home#/tutorial_directory"
+                href="/app/integrations/browse"
                 iconType="plusInCircle"
                 onClick={[Function]}
               >
                 <FormattedMessage
-                  defaultMessage="Add your data"
+                  defaultMessage="Add integrations"
                   id="home.addData.addDataButtonLabel"
                   values={Object {}}
                 />
diff --git a/src/plugins/home/public/application/components/add_data/add_data.test.tsx b/src/plugins/home/public/application/components/add_data/add_data.test.tsx
index 4018ae67c19ee..3aa51f89c7d67 100644
--- a/src/plugins/home/public/application/components/add_data/add_data.test.tsx
+++ b/src/plugins/home/public/application/components/add_data/add_data.test.tsx
@@ -27,7 +27,9 @@ beforeEach(() => {
   jest.clearAllMocks();
 });
 
-const applicationStartMock = {} as unknown as ApplicationStart;
+const applicationStartMock = {
+  capabilities: { navLinks: { integrations: true } },
+} as unknown as ApplicationStart;
 
 const addBasePathMock = jest.fn((path: string) => (path ? path : 'path'));
 
diff --git a/src/plugins/home/public/application/components/add_data/add_data.tsx b/src/plugins/home/public/application/components/add_data/add_data.tsx
index 97ba28a04a07e..50d6079dd8df3 100644
--- a/src/plugins/home/public/application/components/add_data/add_data.tsx
+++ b/src/plugins/home/public/application/components/add_data/add_data.tsx
@@ -22,8 +22,6 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { METRIC_TYPE } from '@kbn/analytics';
 import { ApplicationStart } from 'kibana/public';
 import { createAppNavigationHandler } from '../app_navigation_handler';
-// @ts-expect-error untyped component
-import { Synopsis } from '../synopsis';
 import { getServices } from '../../kibana_services';
 import { RedirectAppLinks } from '../../../../../kibana_react/public';
 
@@ -35,87 +33,91 @@ interface Props {
 
 export const AddData: FC<Props> = ({ addBasePath, application, isDarkMode }) => {
   const { trackUiMetric } = getServices();
+  const canAccessIntegrations = application.capabilities.navLinks.integrations;
+  if (canAccessIntegrations) {
+    return (
+      <>
+        <section className="homDataAdd" aria-labelledby="homDataAdd__title">
+          <EuiFlexGroup alignItems="flexEnd">
+            <EuiFlexItem>
+              <EuiTitle size="s">
+                <h2 id="homDataAdd__title">
+                  <FormattedMessage
+                    id="home.addData.sectionTitle"
+                    defaultMessage="Get started by adding integrations"
+                  />
+                </h2>
+              </EuiTitle>
 
-  return (
-    <>
-      <section className="homDataAdd" aria-labelledby="homDataAdd__title">
-        <EuiFlexGroup alignItems="flexEnd">
-          <EuiFlexItem>
-            <EuiTitle size="s">
-              <h2 id="homDataAdd__title">
-                <FormattedMessage
-                  id="home.addData.sectionTitle"
-                  defaultMessage="Get started by adding your data"
-                />
-              </h2>
-            </EuiTitle>
+              <EuiSpacer />
 
-            <EuiSpacer />
+              <EuiText>
+                <p>
+                  <FormattedMessage
+                    id="home.addData.text"
+                    defaultMessage="To start working with your data, use one of our many ingest options. Collect data from an app or service, or upload a file. If you're not ready to use your own data, add a sample data set."
+                  />
+                </p>
+              </EuiText>
 
-            <EuiText>
-              <p>
-                <FormattedMessage
-                  id="home.addData.text"
-                  defaultMessage="To start working with your data, use one of our many ingest options. Collect data from an app or service, or upload a file. If you're not ready to use your own data, add a sample data set."
-                />
-              </p>
-            </EuiText>
+              <EuiSpacer />
 
-            <EuiSpacer />
+              <EuiFlexGroup gutterSize="m" responsive={false} wrap>
+                <EuiFlexItem grow={false}>
+                  <RedirectAppLinks application={application}>
+                    {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
+                    <EuiButton
+                      data-test-subj="homeAddData"
+                      fill
+                      href={addBasePath('/app/integrations/browse')}
+                      iconType="plusInCircle"
+                      onClick={(event: MouseEvent) => {
+                        trackUiMetric(METRIC_TYPE.CLICK, 'home_tutorial_directory');
+                        createAppNavigationHandler('/app/integrations/browse')(event);
+                      }}
+                    >
+                      <FormattedMessage
+                        id="home.addData.addDataButtonLabel"
+                        defaultMessage="Add integrations"
+                      />
+                    </EuiButton>
+                  </RedirectAppLinks>
+                </EuiFlexItem>
 
-            <EuiFlexGroup gutterSize="m" responsive={false} wrap>
-              <EuiFlexItem grow={false}>
-                <RedirectAppLinks application={application}>
-                  {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
-                  <EuiButton
-                    data-test-subj="homeAddData"
-                    fill
-                    href={addBasePath('/app/home#/tutorial_directory')}
-                    iconType="plusInCircle"
-                    onClick={(event: MouseEvent) => {
-                      trackUiMetric(METRIC_TYPE.CLICK, 'home_tutorial_directory');
-                      createAppNavigationHandler('/app/home#/tutorial_directory')(event);
-                    }}
+                <EuiFlexItem grow={false}>
+                  <EuiButtonEmpty
+                    data-test-subj="addSampleData"
+                    href={addBasePath('#/tutorial_directory/sampleData')}
+                    iconType="documents"
                   >
                     <FormattedMessage
-                      id="home.addData.addDataButtonLabel"
-                      defaultMessage="Add your data"
+                      id="home.addData.sampleDataButtonLabel"
+                      defaultMessage="Try sample data"
                     />
-                  </EuiButton>
-                </RedirectAppLinks>
-              </EuiFlexItem>
-
-              <EuiFlexItem grow={false}>
-                <EuiButtonEmpty
-                  data-test-subj="addSampleData"
-                  href={addBasePath('#/tutorial_directory/sampleData')}
-                  iconType="documents"
-                >
-                  <FormattedMessage
-                    id="home.addData.sampleDataButtonLabel"
-                    defaultMessage="Try sample data"
-                  />
-                </EuiButtonEmpty>
-              </EuiFlexItem>
-            </EuiFlexGroup>
-          </EuiFlexItem>
+                  </EuiButtonEmpty>
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            </EuiFlexItem>
 
-          <EuiFlexItem>
-            <EuiImage
-              alt="Illustration of Elastic data integrations"
-              className="homDataAdd__illustration"
-              src={
-                addBasePath('/plugins/kibanaReact/assets/') +
-                (isDarkMode
-                  ? 'illustration_integrations_darkmode.svg'
-                  : 'illustration_integrations_lightmode.svg')
-              }
-            />
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </section>
+            <EuiFlexItem>
+              <EuiImage
+                alt="Illustration of Elastic data integrations"
+                className="homDataAdd__illustration"
+                src={
+                  addBasePath('/plugins/kibanaReact/assets/') +
+                  (isDarkMode
+                    ? 'illustration_integrations_darkmode.svg'
+                    : 'illustration_integrations_lightmode.svg')
+                }
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </section>
 
-      <EuiHorizontalRule margin="xxl" />
-    </>
-  );
+        <EuiHorizontalRule margin="xxl" />
+      </>
+    );
+  } else {
+    return null;
+  }
 };
diff --git a/src/plugins/home/public/application/components/sample_data/index.tsx b/src/plugins/home/public/application/components/sample_data/index.tsx
index d6b9328f57e9b..b65fbb5d002b0 100644
--- a/src/plugins/home/public/application/components/sample_data/index.tsx
+++ b/src/plugins/home/public/application/components/sample_data/index.tsx
@@ -40,7 +40,7 @@ export function SampleDataCard({ urlBasePath, onDecline, onConfirm }: Props) {
       image={cardGraphicURL}
       textAlign="left"
       title={
-        <FormattedMessage id="home.letsStartTitle" defaultMessage="Start by adding your data" />
+        <FormattedMessage id="home.letsStartTitle" defaultMessage="Start by adding integrations" />
       }
       description={
         <FormattedMessage
@@ -51,7 +51,7 @@ export function SampleDataCard({ urlBasePath, onDecline, onConfirm }: Props) {
       footer={
         <footer>
           <EuiButton fill className="homWelcome__footerAction" onClick={onConfirm}>
-            <FormattedMessage id="home.tryButtonLabel" defaultMessage="Add data" />
+            <FormattedMessage id="home.tryButtonLabel" defaultMessage="Add integrations" />
           </EuiButton>
           <EuiButtonEmpty
             className="homWelcome__footerAction"
diff --git a/src/plugins/home/public/application/components/tutorial_directory.js b/src/plugins/home/public/application/components/tutorial_directory.js
index d7e6c07d6dd18..83e629a7c891e 100644
--- a/src/plugins/home/public/application/components/tutorial_directory.js
+++ b/src/plugins/home/public/application/components/tutorial_directory.js
@@ -9,7 +9,7 @@
 import _ from 'lodash';
 import React from 'react';
 import PropTypes from 'prop-types';
-import { EuiFlexItem, EuiFlexGrid, EuiFlexGroup, EuiSpacer } from '@elastic/eui';
+import { EuiFlexItem, EuiFlexGrid, EuiFlexGroup } from '@elastic/eui';
 import { injectI18n, FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import { Synopsis } from './synopsis';
@@ -33,34 +33,6 @@ class TutorialDirectoryUi extends React.Component {
     const extraTabs = getServices().addDataService.getAddDataTabs();
 
     this.tabs = [
-      {
-        id: ALL_TAB_ID,
-        name: this.props.intl.formatMessage({
-          id: 'home.tutorial.tabs.allTitle',
-          defaultMessage: 'All',
-        }),
-      },
-      {
-        id: 'logging',
-        name: this.props.intl.formatMessage({
-          id: 'home.tutorial.tabs.loggingTitle',
-          defaultMessage: 'Logs',
-        }),
-      },
-      {
-        id: 'metrics',
-        name: this.props.intl.formatMessage({
-          id: 'home.tutorial.tabs.metricsTitle',
-          defaultMessage: 'Metrics',
-        }),
-      },
-      {
-        id: 'security',
-        name: this.props.intl.formatMessage({
-          id: 'home.tutorial.tabs.securitySolutionTitle',
-          defaultMessage: 'Security',
-        }),
-      },
       {
         id: SAMPLE_DATA_TAB_ID,
         name: this.props.intl.formatMessage({
@@ -88,7 +60,6 @@ class TutorialDirectoryUi extends React.Component {
     this.state = {
       selectedTabId: openTab,
       tutorialCards: [],
-      notices: getServices().tutorialService.getDirectoryNotices(),
     };
   }
 
@@ -216,19 +187,6 @@ class TutorialDirectoryUi extends React.Component {
     );
   };
 
-  renderNotices = () => {
-    const notices = getServices().tutorialService.getDirectoryNotices();
-    return notices.length ? (
-      <EuiFlexGroup direction="column" gutterSize="none">
-        {notices.map((DirectoryNotice, index) => (
-          <EuiFlexItem key={index}>
-            <DirectoryNotice />
-          </EuiFlexItem>
-        ))}
-      </EuiFlexGroup>
-    ) : null;
-  };
-
   renderHeaderLinks = () => {
     const headerLinks = getServices().tutorialService.getDirectoryHeaderLinks();
     return headerLinks.length ? (
@@ -245,7 +203,6 @@ class TutorialDirectoryUi extends React.Component {
   render() {
     const headerLinks = this.renderHeaderLinks();
     const tabs = this.getTabs();
-    const notices = this.renderNotices();
 
     return (
       <KibanaPageTemplate
@@ -253,18 +210,15 @@ class TutorialDirectoryUi extends React.Component {
         template="empty"
         pageHeader={{
           pageTitle: (
-            <FormattedMessage id="home.tutorial.addDataToKibanaTitle" defaultMessage="Add data" />
+            <FormattedMessage
+              id="home.tutorial.addDataToKibanaTitle"
+              defaultMessage="Alternative ways to add data"
+            />
           ),
           tabs,
           rightSideItems: headerLinks ? [headerLinks] : [],
         }}
       >
-        {notices && (
-          <>
-            {notices}
-            <EuiSpacer size="s" />
-          </>
-        )}
         {this.renderTabContent()}
       </KibanaPageTemplate>
     );
diff --git a/src/plugins/home/public/application/components/welcome.tsx b/src/plugins/home/public/application/components/welcome.tsx
index ca7e6874c75c2..03dff22c7b33f 100644
--- a/src/plugins/home/public/application/components/welcome.tsx
+++ b/src/plugins/home/public/application/components/welcome.tsx
@@ -48,8 +48,7 @@ export class Welcome extends React.Component<Props> {
   };
 
   private redirecToAddData() {
-    const path = this.services.addBasePath('#/tutorial_directory');
-    window.location.href = path;
+    this.services.application.navigateToApp('integrations', { path: '/browse' });
   }
 
   private onSampleDataDecline = () => {
diff --git a/src/plugins/home/public/index.ts b/src/plugins/home/public/index.ts
index dd02bf65dd8b0..7abaf5d19f008 100644
--- a/src/plugins/home/public/index.ts
+++ b/src/plugins/home/public/index.ts
@@ -23,7 +23,6 @@ export type {
   FeatureCatalogueSolution,
   Environment,
   TutorialVariables,
-  TutorialDirectoryNoticeComponent,
   TutorialDirectoryHeaderLinkComponent,
   TutorialModuleNoticeComponent,
 } from './services';
diff --git a/src/plugins/home/public/services/index.ts b/src/plugins/home/public/services/index.ts
index 65913df6310b1..2ee68a9eef0c2 100644
--- a/src/plugins/home/public/services/index.ts
+++ b/src/plugins/home/public/services/index.ts
@@ -22,7 +22,6 @@ export { TutorialService } from './tutorials';
 export type {
   TutorialVariables,
   TutorialServiceSetup,
-  TutorialDirectoryNoticeComponent,
   TutorialDirectoryHeaderLinkComponent,
   TutorialModuleNoticeComponent,
 } from './tutorials';
diff --git a/src/plugins/home/public/services/tutorials/index.ts b/src/plugins/home/public/services/tutorials/index.ts
index 8de12c31249d8..e007a5ea4d552 100644
--- a/src/plugins/home/public/services/tutorials/index.ts
+++ b/src/plugins/home/public/services/tutorials/index.ts
@@ -11,7 +11,6 @@ export { TutorialService } from './tutorial_service';
 export type {
   TutorialVariables,
   TutorialServiceSetup,
-  TutorialDirectoryNoticeComponent,
   TutorialDirectoryHeaderLinkComponent,
   TutorialModuleNoticeComponent,
 } from './tutorial_service';
diff --git a/src/plugins/home/public/services/tutorials/tutorial_service.mock.ts b/src/plugins/home/public/services/tutorials/tutorial_service.mock.ts
index 0c109d61912ca..ab38a32a1a5b3 100644
--- a/src/plugins/home/public/services/tutorials/tutorial_service.mock.ts
+++ b/src/plugins/home/public/services/tutorials/tutorial_service.mock.ts
@@ -25,7 +25,6 @@ const createMock = (): jest.Mocked<PublicMethodsOf<TutorialService>> => {
   const service = {
     setup: jest.fn(),
     getVariables: jest.fn(() => ({})),
-    getDirectoryNotices: jest.fn(() => []),
     getDirectoryHeaderLinks: jest.fn(() => []),
     getModuleNotices: jest.fn(() => []),
     getCustomStatusCheck: jest.fn(),
diff --git a/src/plugins/home/public/services/tutorials/tutorial_service.test.tsx b/src/plugins/home/public/services/tutorials/tutorial_service.test.tsx
index a88cf526e3716..b90165aafb45f 100644
--- a/src/plugins/home/public/services/tutorials/tutorial_service.test.tsx
+++ b/src/plugins/home/public/services/tutorials/tutorial_service.test.tsx
@@ -27,22 +27,6 @@ describe('TutorialService', () => {
       }).toThrow();
     });
 
-    test('allows multiple register directory notice calls', () => {
-      const setup = new TutorialService().setup();
-      expect(() => {
-        setup.registerDirectoryNotice('abc', () => <div />);
-        setup.registerDirectoryNotice('def', () => <span />);
-      }).not.toThrow();
-    });
-
-    test('throws when same directory notice is registered twice', () => {
-      const setup = new TutorialService().setup();
-      expect(() => {
-        setup.registerDirectoryNotice('abc', () => <div />);
-        setup.registerDirectoryNotice('abc', () => <span />);
-      }).toThrow();
-    });
-
     test('allows multiple register directory header link calls', () => {
       const setup = new TutorialService().setup();
       expect(() => {
@@ -91,22 +75,6 @@ describe('TutorialService', () => {
     });
   });
 
-  describe('getDirectoryNotices', () => {
-    test('returns empty array', () => {
-      const service = new TutorialService();
-      expect(service.getDirectoryNotices()).toEqual([]);
-    });
-
-    test('returns last state of register calls', () => {
-      const service = new TutorialService();
-      const setup = service.setup();
-      const notices = [() => <div />, () => <span />];
-      setup.registerDirectoryNotice('abc', notices[0]);
-      setup.registerDirectoryNotice('def', notices[1]);
-      expect(service.getDirectoryNotices()).toEqual(notices);
-    });
-  });
-
   describe('getDirectoryHeaderLinks', () => {
     test('returns empty array', () => {
       const service = new TutorialService();
diff --git a/src/plugins/home/public/services/tutorials/tutorial_service.ts b/src/plugins/home/public/services/tutorials/tutorial_service.ts
index 839b0702a499e..81b6bbe72e3e9 100644
--- a/src/plugins/home/public/services/tutorials/tutorial_service.ts
+++ b/src/plugins/home/public/services/tutorials/tutorial_service.ts
@@ -11,9 +11,6 @@ import React from 'react';
 /** @public */
 export type TutorialVariables = Partial<Record<string, unknown>>;
 
-/** @public */
-export type TutorialDirectoryNoticeComponent = React.FC;
-
 /** @public */
 export type TutorialDirectoryHeaderLinkComponent = React.FC;
 
@@ -27,7 +24,6 @@ type CustomComponent = () => Promise<React.ReactNode>;
 
 export class TutorialService {
   private tutorialVariables: TutorialVariables = {};
-  private tutorialDirectoryNotices: { [key: string]: TutorialDirectoryNoticeComponent } = {};
   private tutorialDirectoryHeaderLinks: {
     [key: string]: TutorialDirectoryHeaderLinkComponent;
   } = {};
@@ -47,16 +43,6 @@ export class TutorialService {
         this.tutorialVariables[key] = value;
       },
 
-      /**
-       * Registers a component that will be rendered at the top of tutorial directory page.
-       */
-      registerDirectoryNotice: (id: string, component: TutorialDirectoryNoticeComponent) => {
-        if (this.tutorialDirectoryNotices[id]) {
-          throw new Error(`directory notice ${id} already set`);
-        }
-        this.tutorialDirectoryNotices[id] = component;
-      },
-
       /**
        * Registers a component that will be rendered next to tutorial directory title/header area.
        */
@@ -94,10 +80,6 @@ export class TutorialService {
     return this.tutorialVariables;
   }
 
-  public getDirectoryNotices() {
-    return Object.values(this.tutorialDirectoryNotices);
-  }
-
   public getDirectoryHeaderLinks() {
     return Object.values(this.tutorialDirectoryHeaderLinks);
   }
diff --git a/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.tsx
index 1331eb9b7c4ac..d00f9e2368e21 100644
--- a/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.tsx
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.tsx
@@ -91,7 +91,7 @@ export const EmptyIndexListPrompt = ({
               <EuiCard
                 className="inpEmptyState__card"
                 onClick={() => {
-                  navigateToApp('home', { path: '#/tutorial_directory' });
+                  navigateToApp('home', { path: '/app/integrations/browse' });
                   closeFlyout();
                 }}
                 icon={<EuiIcon size="xl" type="database" color="subdued" />}
diff --git a/src/plugins/kibana_overview/public/components/overview/__snapshots__/overview.test.tsx.snap b/src/plugins/kibana_overview/public/components/overview/__snapshots__/overview.test.tsx.snap
index 6da2f95fa394d..babcab15a4974 100644
--- a/src/plugins/kibana_overview/public/components/overview/__snapshots__/overview.test.tsx.snap
+++ b/src/plugins/kibana_overview/public/components/overview/__snapshots__/overview.test.tsx.snap
@@ -226,10 +226,7 @@ exports[`Overview render 1`] = `
       [MockFunction] {
         "calls": Array [
           Array [
-            "/app/home#/tutorial_directory",
-          ],
-          Array [
-            "home#/tutorial_directory",
+            "/app/integrations/browse",
           ],
           Array [
             "kibana_landing_page",
@@ -259,11 +256,7 @@ exports[`Overview render 1`] = `
         "results": Array [
           Object {
             "type": "return",
-            "value": "/app/home#/tutorial_directory",
-          },
-          Object {
-            "type": "return",
-            "value": "home#/tutorial_directory",
+            "value": "/app/integrations/browse",
           },
           Object {
             "type": "return",
@@ -533,10 +526,7 @@ exports[`Overview without features 1`] = `
       [MockFunction] {
         "calls": Array [
           Array [
-            "/app/home#/tutorial_directory",
-          ],
-          Array [
-            "home#/tutorial_directory",
+            "/app/integrations/browse",
           ],
           Array [
             "kibana_landing_page",
@@ -563,16 +553,10 @@ exports[`Overview without features 1`] = `
             "/plugins/kibanaReact/assets/solutions_solution_4.svg",
           ],
           Array [
-            "/app/home#/tutorial_directory",
+            "/app/integrations/browse",
           ],
           Array [
-            "home#/tutorial_directory",
-          ],
-          Array [
-            "/app/home#/tutorial_directory",
-          ],
-          Array [
-            "home#/tutorial_directory",
+            "/app/integrations/browse",
           ],
           Array [
             "kibana_landing_page",
@@ -602,11 +586,7 @@ exports[`Overview without features 1`] = `
         "results": Array [
           Object {
             "type": "return",
-            "value": "/app/home#/tutorial_directory",
-          },
-          Object {
-            "type": "return",
-            "value": "home#/tutorial_directory",
+            "value": "/app/integrations/browse",
           },
           Object {
             "type": "return",
@@ -642,19 +622,11 @@ exports[`Overview without features 1`] = `
           },
           Object {
             "type": "return",
-            "value": "/app/home#/tutorial_directory",
-          },
-          Object {
-            "type": "return",
-            "value": "home#/tutorial_directory",
-          },
-          Object {
-            "type": "return",
-            "value": "/app/home#/tutorial_directory",
+            "value": "/app/integrations/browse",
           },
           Object {
             "type": "return",
-            "value": "home#/tutorial_directory",
+            "value": "/app/integrations/browse",
           },
           Object {
             "type": "return",
@@ -801,10 +773,7 @@ exports[`Overview without solutions 1`] = `
               [MockFunction] {
                 "calls": Array [
                   Array [
-                    "/app/home#/tutorial_directory",
-                  ],
-                  Array [
-                    "home#/tutorial_directory",
+                    "/app/integrations/browse",
                   ],
                   Array [
                     "kibana_landing_page",
@@ -831,20 +800,13 @@ exports[`Overview without solutions 1`] = `
                     "/plugins/kibanaReact/assets/solutions_solution_4.svg",
                   ],
                   Array [
-                    "/app/home#/tutorial_directory",
-                  ],
-                  Array [
-                    "home#/tutorial_directory",
+                    "/app/integrations/browse",
                   ],
                 ],
                 "results": Array [
                   Object {
                     "type": "return",
-                    "value": "/app/home#/tutorial_directory",
-                  },
-                  Object {
-                    "type": "return",
-                    "value": "home#/tutorial_directory",
+                    "value": "/app/integrations/browse",
                   },
                   Object {
                     "type": "return",
@@ -880,11 +842,7 @@ exports[`Overview without solutions 1`] = `
                   },
                   Object {
                     "type": "return",
-                    "value": "/app/home#/tutorial_directory",
-                  },
-                  Object {
-                    "type": "return",
-                    "value": "home#/tutorial_directory",
+                    "value": "/app/integrations/browse",
                   },
                 ],
               }
@@ -898,10 +856,7 @@ exports[`Overview without solutions 1`] = `
               [MockFunction] {
                 "calls": Array [
                   Array [
-                    "/app/home#/tutorial_directory",
-                  ],
-                  Array [
-                    "home#/tutorial_directory",
+                    "/app/integrations/browse",
                   ],
                   Array [
                     "kibana_landing_page",
@@ -928,20 +883,13 @@ exports[`Overview without solutions 1`] = `
                     "/plugins/kibanaReact/assets/solutions_solution_4.svg",
                   ],
                   Array [
-                    "/app/home#/tutorial_directory",
-                  ],
-                  Array [
-                    "home#/tutorial_directory",
+                    "/app/integrations/browse",
                   ],
                 ],
                 "results": Array [
                   Object {
                     "type": "return",
-                    "value": "/app/home#/tutorial_directory",
-                  },
-                  Object {
-                    "type": "return",
-                    "value": "home#/tutorial_directory",
+                    "value": "/app/integrations/browse",
                   },
                   Object {
                     "type": "return",
@@ -977,11 +925,7 @@ exports[`Overview without solutions 1`] = `
                   },
                   Object {
                     "type": "return",
-                    "value": "/app/home#/tutorial_directory",
-                  },
-                  Object {
-                    "type": "return",
-                    "value": "home#/tutorial_directory",
+                    "value": "/app/integrations/browse",
                   },
                 ],
               }
@@ -1001,10 +945,7 @@ exports[`Overview without solutions 1`] = `
       [MockFunction] {
         "calls": Array [
           Array [
-            "/app/home#/tutorial_directory",
-          ],
-          Array [
-            "home#/tutorial_directory",
+            "/app/integrations/browse",
           ],
           Array [
             "kibana_landing_page",
@@ -1031,20 +972,13 @@ exports[`Overview without solutions 1`] = `
             "/plugins/kibanaReact/assets/solutions_solution_4.svg",
           ],
           Array [
-            "/app/home#/tutorial_directory",
-          ],
-          Array [
-            "home#/tutorial_directory",
+            "/app/integrations/browse",
           ],
         ],
         "results": Array [
           Object {
             "type": "return",
-            "value": "/app/home#/tutorial_directory",
-          },
-          Object {
-            "type": "return",
-            "value": "home#/tutorial_directory",
+            "value": "/app/integrations/browse",
           },
           Object {
             "type": "return",
@@ -1080,11 +1014,7 @@ exports[`Overview without solutions 1`] = `
           },
           Object {
             "type": "return",
-            "value": "/app/home#/tutorial_directory",
-          },
-          Object {
-            "type": "return",
-            "value": "home#/tutorial_directory",
+            "value": "/app/integrations/browse",
           },
         ],
       }
diff --git a/src/plugins/kibana_overview/public/components/overview/overview.tsx b/src/plugins/kibana_overview/public/components/overview/overview.tsx
index 07769e2f3c474..6a0279bd12465 100644
--- a/src/plugins/kibana_overview/public/components/overview/overview.tsx
+++ b/src/plugins/kibana_overview/public/components/overview/overview.tsx
@@ -61,7 +61,7 @@ export const Overview: FC<Props> = ({ newsFetchResult, solutions, features }) =>
   const IS_DARK_THEME = uiSettings.get('theme:darkMode');
 
   // Home does not have a locator implemented, so hard-code it here.
-  const addDataHref = addBasePath('/app/home#/tutorial_directory');
+  const addDataHref = addBasePath('/app/integrations/browse');
   const devToolsHref = share.url.locators.get('CONSOLE_APP_LOCATOR')?.useUrl({});
   const managementHref = share.url.locators
     .get('MANAGEMENT_APP_LOCATOR')
@@ -86,8 +86,14 @@ export const Overview: FC<Props> = ({ newsFetchResult, solutions, features }) =>
     }),
     logo: 'logoKibana',
     actions: {
-      beats: {
-        href: addBasePath(`home#/tutorial_directory`),
+      elasticAgent: {
+        title: i18n.translate('kibanaOverview.noDataConfig.title', {
+          defaultMessage: 'Add integrations',
+        }),
+        description: i18n.translate('kibanaOverview.noDataConfig.description', {
+          defaultMessage:
+            'Use Elastic Agent or Beats to collect data and build out Analytics solutions.',
+        }),
       },
     },
     docsLink: docLinks.links.kibana,
diff --git a/src/plugins/kibana_react/public/assets/elastic_beats_card_dark.svg b/src/plugins/kibana_react/public/assets/elastic_beats_card_dark.svg
deleted file mode 100644
index 8652d8d921506..0000000000000
--- a/src/plugins/kibana_react/public/assets/elastic_beats_card_dark.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="450" height="285" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0)"><path fill="url(#paint0_linear)" d="M0 0h450v286.602H0z"/><g clip-path="url(#clip1)" fill-rule="evenodd" clip-rule="evenodd"><path d="M107.704 82.838c-10.955 0-19.866 8.911-19.866 19.866s8.911 19.866 19.866 19.866 19.866-8.911 19.866-19.866-8.911-19.866-19.866-19.866zm0 42.57C95.186 125.408 85 115.223 85 102.704 85 90.186 95.186 80 107.704 80c12.519 0 22.704 10.186 22.704 22.704 0 12.519-10.185 22.704-22.704 22.704z" fill="white"/><path d="M124.732 102.704h-2.838c0-7.824-6.365-14.19-14.19-14.19-7.824 0-14.19 6.366-14.19 14.19h-2.838c0-9.39 7.639-17.028 17.028-17.028 9.39 0 17.028 7.639 17.028 17.028z" fill="#00BFB3"/><path d="M107.704 105.542a2.841 2.841 0 01-2.838-2.838 2.84 2.84 0 012.838-2.838 2.84 2.84 0 012.838 2.838 2.841 2.841 0 01-2.838 2.838zm8.098-8.93l-2.006-2.006-3.227 3.225a5.627 5.627 0 00-2.865-.803 5.682 5.682 0 00-5.676 5.676 5.681 5.681 0 005.676 5.676 5.681 5.681 0 005.676-5.676 5.62 5.62 0 00-.804-2.866l3.226-3.226z" fill="white"/></g><g clip-path="url(#clip2)" fill-rule="evenodd" clip-rule="evenodd"><path d="M207.423 101.053c-1.524-1.791-2.861-3.688-3.149-5.91-.412-3.166.829-6.464 3.237-8.604 1.965-1.747 4.499-2.644 7.12-2.47a9.778 9.778 0 015.6 2.166l1.851-2.142a12.585 12.585 0 00-7.285-2.858c-3.386-.179-6.641.932-9.172 3.184-3.101 2.756-4.697 7.004-4.165 11.09.406 3.122 2.224 5.567 4.087 7.715l1.876-2.171z" fill="#00BFB3"/><path d="M211.733 105.526l12.351 14.441 15.423-17.545c1.934-2.199 4.127-4.692 4.401-7.71.272-3-.984-6.132-3.278-8.173a9.775 9.775 0 00-7.121-2.469 9.786 9.786 0 00-6.784 3.288l-14.992 18.168zm12.323 18.772l-16.03-18.74 16.543-20.046c2.286-2.571 5.39-4.077 8.773-4.276 3.385-.198 6.641.931 9.173 3.183 2.955 2.627 4.571 6.668 4.219 10.55-.357 3.94-2.985 6.927-5.095 9.328l-17.583 20.001z" fill="white"/></g><path d="M319.137 104.123v-2.838h42.57v2.838h-42.57z" fill="#00BFB3"/><path d="M339.003 81.419h2.838v42.57h-2.838v-42.57z" fill="#00BFB3"/><path d="M321.975 84.257v14.19h-2.838V81.42h17.028v2.838h-14.19zM358.869 84.257h-14.19v-2.838h17.028v17.028h-2.838v-14.19zM321.975 121.151h14.19v2.838h-17.028v-17.028h2.838v14.19zM358.869 106.961h2.838v17.028h-17.028v-2.838h14.19v-14.19z" fill="white"/><g clip-path="url(#clip3)" fill-rule="evenodd" clip-rule="evenodd"><path d="M109.123 179.331a2.841 2.841 0 00-2.838 2.838 2.841 2.841 0 002.838 2.838 2.841 2.841 0 002.838-2.838 2.841 2.841 0 00-2.838-2.838zm0 8.514a5.682 5.682 0 01-5.676-5.676 5.682 5.682 0 015.676-5.676 5.682 5.682 0 015.676 5.676 5.682 5.682 0 01-5.676 5.676z" fill="#00BFB3"/><path d="M92.095 167.979a2.84 2.84 0 01-2.838-2.838 2.84 2.84 0 012.838-2.838 2.84 2.84 0 012.838 2.838 2.84 2.84 0 01-2.838 2.838zm5.676-2.838a5.681 5.681 0 00-5.676-5.676 5.681 5.681 0 00-5.676 5.676 5.682 5.682 0 005.676 5.676 5.643 5.643 0 002.866-.803l7.483 7.482 2.006-2.006-7.482-7.483a5.637 5.637 0 00.803-2.866zM126.151 162.303a2.841 2.841 0 012.838 2.838 2.841 2.841 0 01-2.838 2.838 2.841 2.841 0 01-2.838-2.838 2.841 2.841 0 012.838-2.838zm-10.349 15.193l7.483-7.482a5.642 5.642 0 002.866.803 5.681 5.681 0 005.676-5.676 5.68 5.68 0 00-5.676-5.676 5.681 5.681 0 00-5.676 5.676c0 1.048.307 2.022.803 2.866l-7.482 7.483 2.006 2.006zM92.095 202.035a2.84 2.84 0 01-2.838-2.838 2.84 2.84 0 012.838-2.838 2.84 2.84 0 012.838 2.838 2.84 2.84 0 01-2.838 2.838zm10.349-15.193l-7.483 7.482a5.643 5.643 0 00-2.866-.803 5.682 5.682 0 00-5.676 5.676 5.682 5.682 0 005.676 5.676 5.682 5.682 0 005.676-5.676 5.634 5.634 0 00-.803-2.866l7.482-7.483-2.006-2.006zM126.151 202.035a2.841 2.841 0 01-2.838-2.838 2.841 2.841 0 012.838-2.838 2.841 2.841 0 012.838 2.838 2.841 2.841 0 01-2.838 2.838zm0-8.514a5.642 5.642 0 00-2.866.803l-7.483-7.482-2.006 2.006 7.482 7.483a5.64 5.64 0 00-.803 2.866 5.682 5.682 0 005.676 5.676 5.681 5.681 0 005.676-5.676 5.681 5.681 0 00-5.676-5.676z" fill="white"/></g><g clip-path="url(#clip4)" fill-rule="evenodd" clip-rule="evenodd"><path d="M239.608 194.875v-2.708a5.748 5.748 0 005.74-5.741 5.702 5.702 0 00-3.644-5.33l-1.033-.407.195-1.093c.152-.847.225-1.631.225-2.393 0-7.47-6.077-13.546-13.545-13.546a13.496 13.496 0 00-13.154 10.366l-.224.935-.959.095a8.542 8.542 0 00-7.721 8.535c0 4.73 3.848 8.579 8.578 8.579v2.708c-6.224 0-11.289-5.063-11.289-11.287a11.24 11.24 0 019.225-11.098 16.194 16.194 0 0115.544-11.541c8.963 0 16.255 7.29 16.255 16.254 0 .601-.038 1.207-.114 1.837a8.383 8.383 0 014.371 7.386c0 4.659-3.792 8.449-8.45 8.449z" fill="white"/><path d="M221.048 203.454h3.367l11.172-17.017h-13.551l8.84-14.201h-3.315l-10.593 17.017h13.404l-9.324 14.201z" fill="#00BFB3"/></g><path d="M340.422 160.884h2.838v42.57h-2.838v-42.57z" fill="#00BFB3"/><path d="M337.584 200.616v2.838h-17.028v-42.57h17.028v2.838h-14.19v36.894h14.19zM360.288 163.722h-14.19v-2.838h17.028v42.57h-17.028v-2.838h14.19v-36.894z" fill="white"/></g><defs><clipPath id="clip0"><path fill="white" d="M0 0h450v285H0z"/></clipPath><clipPath id="clip1"><path fill="white" transform="translate(85 80)" d="M0 0h45.408v45.408H0z"/></clipPath><clipPath id="clip2"><path fill="white" transform="translate(201.359 80)" d="M0 0h45.408v45.408H0z"/></clipPath><clipPath id="clip3"><path fill="white" transform="translate(86.419 159.465)" d="M0 0h45.408v45.408H0z"/></clipPath><clipPath id="clip4"><path fill="white" transform="translate(202.778 159.465)" d="M0 0h45.408v45.408H0z"/></clipPath><linearGradient id="paint0_linear" x1="225" y1="221.5" x2="225" y2="286.602" gradientUnits="userSpaceOnUse"><stop stop-color="#1D1E24"/><stop offset="1" stop-color="#151619"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/src/plugins/kibana_react/public/assets/elastic_beats_card_light.svg b/src/plugins/kibana_react/public/assets/elastic_beats_card_light.svg
deleted file mode 100644
index f54786c1b950c..0000000000000
--- a/src/plugins/kibana_react/public/assets/elastic_beats_card_light.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="450" height="285" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0)"><path fill="url(#paint0_linear)" d="M0 0h450v286.602H0z"/><g clip-path="url(#clip1)" fill-rule="evenodd" clip-rule="evenodd"><path d="M107.704 82.838c-10.955 0-19.866 8.911-19.866 19.866s8.911 19.866 19.866 19.866 19.866-8.911 19.866-19.866-8.911-19.866-19.866-19.866zm0 42.57C95.186 125.408 85 115.223 85 102.704 85 90.186 95.186 80 107.704 80c12.519 0 22.704 10.186 22.704 22.704 0 12.519-10.185 22.704-22.704 22.704z" fill="#535766"/><path d="M124.732 102.704h-2.838c0-7.824-6.365-14.19-14.19-14.19-7.824 0-14.19 6.366-14.19 14.19h-2.838c0-9.39 7.639-17.028 17.028-17.028 9.39 0 17.028 7.639 17.028 17.028z" fill="#00BFB3"/><path d="M107.704 105.542a2.841 2.841 0 01-2.838-2.838 2.84 2.84 0 012.838-2.838 2.84 2.84 0 012.838 2.838 2.841 2.841 0 01-2.838 2.838zm8.098-8.93l-2.006-2.006-3.227 3.225a5.627 5.627 0 00-2.865-.803 5.682 5.682 0 00-5.676 5.676 5.681 5.681 0 005.676 5.676 5.681 5.681 0 005.676-5.676 5.62 5.62 0 00-.804-2.866l3.226-3.226z" fill="#535766"/></g><g clip-path="url(#clip2)" fill-rule="evenodd" clip-rule="evenodd"><path d="M207.423 101.053c-1.524-1.791-2.861-3.688-3.149-5.91-.412-3.166.829-6.464 3.237-8.604 1.965-1.747 4.499-2.644 7.12-2.47a9.778 9.778 0 015.6 2.166l1.851-2.142a12.585 12.585 0 00-7.285-2.858c-3.386-.179-6.641.932-9.172 3.184-3.101 2.756-4.697 7.004-4.165 11.09.406 3.122 2.224 5.567 4.087 7.715l1.876-2.171z" fill="#00BFB3"/><path d="M211.733 105.526l12.351 14.441 15.423-17.545c1.934-2.199 4.127-4.692 4.401-7.71.272-3-.984-6.132-3.278-8.173a9.775 9.775 0 00-7.121-2.469 9.786 9.786 0 00-6.784 3.288l-14.992 18.168zm12.323 18.772l-16.03-18.74 16.543-20.046c2.286-2.571 5.39-4.077 8.773-4.276 3.385-.198 6.641.931 9.173 3.183 2.955 2.627 4.571 6.668 4.219 10.55-.357 3.94-2.985 6.927-5.095 9.328l-17.583 20.001z" fill="#535766"/></g><path d="M319.137 104.123v-2.838h42.57v2.838h-42.57z" fill="#00BFB3"/><path d="M339.003 81.419h2.838v42.57h-2.838v-42.57z" fill="#00BFB3"/><path d="M321.975 84.257v14.19h-2.838V81.42h17.028v2.838h-14.19zM358.869 84.257h-14.19v-2.838h17.028v17.028h-2.838v-14.19zM321.975 121.151h14.19v2.838h-17.028v-17.028h2.838v14.19zM358.869 106.961h2.838v17.028h-17.028v-2.838h14.19v-14.19z" fill="#535766"/><g clip-path="url(#clip3)" fill-rule="evenodd" clip-rule="evenodd"><path d="M109.123 179.331a2.841 2.841 0 00-2.838 2.838 2.841 2.841 0 002.838 2.838 2.841 2.841 0 002.838-2.838 2.841 2.841 0 00-2.838-2.838zm0 8.514a5.682 5.682 0 01-5.676-5.676 5.682 5.682 0 015.676-5.676 5.682 5.682 0 015.676 5.676 5.682 5.682 0 01-5.676 5.676z" fill="#00BFB3"/><path d="M92.095 167.979a2.84 2.84 0 01-2.838-2.838 2.84 2.84 0 012.838-2.838 2.84 2.84 0 012.838 2.838 2.84 2.84 0 01-2.838 2.838zm5.676-2.838a5.681 5.681 0 00-5.676-5.676 5.681 5.681 0 00-5.676 5.676 5.682 5.682 0 005.676 5.676 5.643 5.643 0 002.866-.803l7.483 7.482 2.006-2.006-7.482-7.483a5.637 5.637 0 00.803-2.866zM126.151 162.303a2.841 2.841 0 012.838 2.838 2.841 2.841 0 01-2.838 2.838 2.841 2.841 0 01-2.838-2.838 2.841 2.841 0 012.838-2.838zm-10.349 15.193l7.483-7.482a5.642 5.642 0 002.866.803 5.681 5.681 0 005.676-5.676 5.68 5.68 0 00-5.676-5.676 5.681 5.681 0 00-5.676 5.676c0 1.048.307 2.022.803 2.866l-7.482 7.483 2.006 2.006zM92.095 202.035a2.84 2.84 0 01-2.838-2.838 2.84 2.84 0 012.838-2.838 2.84 2.84 0 012.838 2.838 2.84 2.84 0 01-2.838 2.838zm10.349-15.193l-7.483 7.482a5.643 5.643 0 00-2.866-.803 5.682 5.682 0 00-5.676 5.676 5.682 5.682 0 005.676 5.676 5.682 5.682 0 005.676-5.676 5.634 5.634 0 00-.803-2.866l7.482-7.483-2.006-2.006zM126.151 202.035a2.841 2.841 0 01-2.838-2.838 2.841 2.841 0 012.838-2.838 2.841 2.841 0 012.838 2.838 2.841 2.841 0 01-2.838 2.838zm0-8.514a5.642 5.642 0 00-2.866.803l-7.483-7.482-2.006 2.006 7.482 7.483a5.64 5.64 0 00-.803 2.866 5.682 5.682 0 005.676 5.676 5.681 5.681 0 005.676-5.676 5.681 5.681 0 00-5.676-5.676z" fill="#535766"/></g><g clip-path="url(#clip4)" fill-rule="evenodd" clip-rule="evenodd"><path d="M239.608 194.875v-2.708a5.748 5.748 0 005.74-5.741 5.702 5.702 0 00-3.644-5.33l-1.033-.407.195-1.093c.152-.847.225-1.631.225-2.393 0-7.47-6.077-13.546-13.545-13.546a13.496 13.496 0 00-13.154 10.366l-.224.935-.959.095a8.542 8.542 0 00-7.721 8.535c0 4.73 3.848 8.579 8.578 8.579v2.708c-6.224 0-11.289-5.063-11.289-11.287a11.24 11.24 0 019.225-11.098 16.194 16.194 0 0115.544-11.541c8.963 0 16.255 7.29 16.255 16.254 0 .601-.038 1.207-.114 1.837a8.383 8.383 0 014.371 7.386c0 4.659-3.792 8.449-8.45 8.449z" fill="#535766"/><path d="M221.048 203.454h3.367l11.172-17.017h-13.551l8.84-14.201h-3.315l-10.593 17.017h13.404l-9.324 14.201z" fill="#00BFB3"/></g><path d="M340.422 160.884h2.838v42.57h-2.838v-42.57z" fill="#00BFB3"/><path d="M337.584 200.616v2.838h-17.028v-42.57h17.028v2.838h-14.19v36.894h14.19zM360.288 163.722h-14.19v-2.838h17.028v42.57h-17.028v-2.838h14.19v-36.894z" fill="#535766"/></g><defs><clipPath id="clip0"><path fill="white" d="M0 0h450v285H0z"/></clipPath><clipPath id="clip1"><path fill="white" transform="translate(85 80)" d="M0 0h45.408v45.408H0z"/></clipPath><clipPath id="clip2"><path fill="white" transform="translate(201.359 80)" d="M0 0h45.408v45.408H0z"/></clipPath><clipPath id="clip3"><path fill="white" transform="translate(86.419 159.465)" d="M0 0h45.408v45.408H0z"/></clipPath><clipPath id="clip4"><path fill="white" transform="translate(202.778 159.465)" d="M0 0h45.408v45.408H0z"/></clipPath><linearGradient id="paint0_linear" x1="225" y1="221.5" x2="225" y2="286.602" gradientUnits="userSpaceOnUse"><stop stop-color="white"/><stop offset="1" stop-color="#F3F5F7"/></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/__snapshots__/no_data_page.test.tsx.snap b/src/plugins/kibana_react/public/page_template/no_data_page/__snapshots__/no_data_page.test.tsx.snap
index d8bc5745ec8e5..8842a3c9f5842 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/__snapshots__/no_data_page.test.tsx.snap
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/__snapshots__/no_data_page.test.tsx.snap
@@ -73,9 +73,9 @@ exports[`NoDataPage render 1`] = `
     </EuiFlexItem>
     <EuiFlexItem
       className="kbnNoDataPageContents__item"
-      key="empty-page-beats-action"
+      key="empty-page-agent-action"
     >
-      <ElasticBeatsCard
+      <ElasticAgentCard
         solution="Elastic"
       />
     </EuiFlexItem>
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
index 3f72ae5597a98..f66d05140b2e9 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
@@ -13,7 +13,36 @@ exports[`ElasticAgentCard props button 1`] = `
   href="/app/integrations/browse"
   image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
   paddingSize="l"
-  title="Add Elastic Agent"
+  title={
+    <EuiScreenReaderOnly>
+      <span>
+        Add Elastic Agent
+      </span>
+    </EuiScreenReaderOnly>
+  }
+/>
+`;
+
+exports[`ElasticAgentCard props category 1`] = `
+<EuiCard
+  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+  footer={
+    <EuiButton
+      fill={true}
+    >
+      Add Elastic Agent
+    </EuiButton>
+  }
+  href="/app/integrations/browse/custom"
+  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+  paddingSize="l"
+  title={
+    <EuiScreenReaderOnly>
+      <span>
+        Add Elastic Agent
+      </span>
+    </EuiScreenReaderOnly>
+  }
 />
 `;
 
@@ -30,7 +59,13 @@ exports[`ElasticAgentCard props href 1`] = `
   href="#"
   image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
   paddingSize="l"
-  title="Add Elastic Agent"
+  title={
+    <EuiScreenReaderOnly>
+      <span>
+        Add Elastic Agent
+      </span>
+    </EuiScreenReaderOnly>
+  }
 />
 `;
 
@@ -48,7 +83,13 @@ exports[`ElasticAgentCard props recommended 1`] = `
   href="/app/integrations/browse"
   image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
   paddingSize="l"
-  title="Add Elastic Agent"
+  title={
+    <EuiScreenReaderOnly>
+      <span>
+        Add Elastic Agent
+      </span>
+    </EuiScreenReaderOnly>
+  }
 />
 `;
 
@@ -65,6 +106,12 @@ exports[`ElasticAgentCard renders 1`] = `
   href="/app/integrations/browse"
   image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
   paddingSize="l"
-  title="Add Elastic Agent"
+  title={
+    <EuiScreenReaderOnly>
+      <span>
+        Add Elastic Agent
+      </span>
+    </EuiScreenReaderOnly>
+  }
 />
 `;
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_beats_card.test.tsx.snap b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_beats_card.test.tsx.snap
deleted file mode 100644
index af26f9e93ebac..0000000000000
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_beats_card.test.tsx.snap
+++ /dev/null
@@ -1,70 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`ElasticBeatsCard props button 1`] = `
-<EuiCard
-  description="Use Beats to add data from various systems to Elasticsearch."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Button
-    </EuiButton>
-  }
-  href="/app/home#/tutorial_directory"
-  image="/plugins/kibanaReact/assets/elastic_beats_card_light.svg"
-  paddingSize="l"
-  title="Add data"
-/>
-`;
-
-exports[`ElasticBeatsCard props href 1`] = `
-<EuiCard
-  description="Use Beats to add data from various systems to Elasticsearch."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Button
-    </EuiButton>
-  }
-  href="#"
-  image="/plugins/kibanaReact/assets/elastic_beats_card_light.svg"
-  paddingSize="l"
-  title="Add data"
-/>
-`;
-
-exports[`ElasticBeatsCard props recommended 1`] = `
-<EuiCard
-  betaBadgeLabel="Recommended"
-  description="Use Beats to add data from various systems to Elasticsearch."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Add data
-    </EuiButton>
-  }
-  href="/app/home#/tutorial_directory"
-  image="/plugins/kibanaReact/assets/elastic_beats_card_light.svg"
-  paddingSize="l"
-  title="Add data"
-/>
-`;
-
-exports[`ElasticBeatsCard renders 1`] = `
-<EuiCard
-  description="Use Beats to add data from various systems to Elasticsearch."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Add data
-    </EuiButton>
-  }
-  href="/app/home#/tutorial_directory"
-  image="/plugins/kibanaReact/assets/elastic_beats_card_light.svg"
-  paddingSize="l"
-  title="Add data"
-/>
-`;
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.test.tsx b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.test.tsx
index 45cc32cae06d6..b971abf06a437 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.test.tsx
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.test.tsx
@@ -14,7 +14,10 @@ jest.mock('../../../context', () => ({
   ...jest.requireActual('../../../context'),
   useKibana: jest.fn().mockReturnValue({
     services: {
-      http: { basePath: { prepend: jest.fn((path: string) => (path ? path : 'path')) } },
+      http: {
+        basePath: { prepend: jest.fn((path: string) => (path ? path : 'path')) },
+      },
+      application: { capabilities: { navLinks: { integrations: true } } },
       uiSettings: { get: jest.fn() },
     },
   }),
@@ -41,5 +44,10 @@ describe('ElasticAgentCard', () => {
       const component = shallow(<ElasticAgentCard href="#" button="Button" solution="Solution" />);
       expect(component).toMatchSnapshot();
     });
+
+    test('category', () => {
+      const component = shallow(<ElasticAgentCard category="custom" solution="Solution" />);
+      expect(component).toMatchSnapshot();
+    });
   });
 });
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
index f071bd9fab25a..5a91e568471d1 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
@@ -9,7 +9,7 @@
 import React, { FunctionComponent } from 'react';
 import { i18n } from '@kbn/i18n';
 import { CoreStart } from 'kibana/public';
-import { EuiButton, EuiCard } from '@elastic/eui';
+import { EuiButton, EuiCard, EuiTextColor, EuiScreenReaderOnly } from '@elastic/eui';
 import { useKibana } from '../../../context';
 import { NoDataPageActions, NO_DATA_RECOMMENDED } from '../no_data_page';
 
@@ -27,13 +27,40 @@ export const ElasticAgentCard: FunctionComponent<ElasticAgentCardProps> = ({
   href,
   button,
   layout,
+  category,
   ...cardRest
 }) => {
   const {
-    services: { http },
+    services: { http, application },
   } = useKibana<CoreStart>();
   const addBasePath = http.basePath.prepend;
-  const basePathUrl = '/plugins/kibanaReact/assets/';
+  const image = addBasePath(`/plugins/kibanaReact/assets/elastic_agent_card.svg`);
+  const canAccessFleet = application.capabilities.navLinks.integrations;
+  const hasCategory = category ? `/${category}` : '';
+
+  if (!canAccessFleet) {
+    return (
+      <EuiCard
+        paddingSize="l"
+        image={image}
+        title={
+          <EuiTextColor color="default">
+            {i18n.translate('kibana-react.noDataPage.elasticAgentCard.noPermission.title', {
+              defaultMessage: `Contact your administrator`,
+            })}
+          </EuiTextColor>
+        }
+        description={
+          <EuiTextColor color="default">
+            {i18n.translate('kibana-react.noDataPage.elasticAgentCard.noPermission.description', {
+              defaultMessage: `This integration is not yet enabled. Your administrator has the required permissions to turn it on.`,
+            })}
+          </EuiTextColor>
+        }
+        isDisabled
+      />
+    );
+  }
 
   const defaultCTAtitle = i18n.translate('kibana-react.noDataPage.elasticAgentCard.title', {
     defaultMessage: 'Add Elastic Agent',
@@ -51,12 +78,17 @@ export const ElasticAgentCard: FunctionComponent<ElasticAgentCardProps> = ({
   return (
     <EuiCard
       paddingSize="l"
-      href={href ?? addBasePath('/app/integrations/browse')}
-      title={title || defaultCTAtitle}
+      image={image}
+      href={href ?? addBasePath(`/app/integrations/browse${hasCategory}`)}
+      // Bad hack to fix the need for an a11y title even though the button exists
+      title={
+        <EuiScreenReaderOnly>
+          <span>{defaultCTAtitle}</span>
+        </EuiScreenReaderOnly>
+      }
       description={i18n.translate('kibana-react.noDataPage.elasticAgentCard.description', {
         defaultMessage: `Use Elastic Agent for a simple, unified way to collect data from your machines.`,
       })}
-      image={addBasePath(`${basePathUrl}elastic_agent_card.svg`)}
       betaBadgeLabel={recommended ? NO_DATA_RECOMMENDED : undefined}
       footer={footer}
       layout={layout as 'vertical' | undefined}
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_beats_card.test.tsx b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_beats_card.test.tsx
deleted file mode 100644
index 6ea41bf6b3e1f..0000000000000
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_beats_card.test.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { shallow } from 'enzyme';
-import React from 'react';
-import { ElasticBeatsCard } from './elastic_beats_card';
-
-jest.mock('../../../context', () => ({
-  ...jest.requireActual('../../../context'),
-  useKibana: jest.fn().mockReturnValue({
-    services: {
-      http: { basePath: { prepend: jest.fn((path: string) => (path ? path : 'path')) } },
-      uiSettings: { get: jest.fn() },
-    },
-  }),
-}));
-
-describe('ElasticBeatsCard', () => {
-  test('renders', () => {
-    const component = shallow(<ElasticBeatsCard solution="Solution" />);
-    expect(component).toMatchSnapshot();
-  });
-
-  describe('props', () => {
-    test('recommended', () => {
-      const component = shallow(<ElasticBeatsCard recommended solution="Solution" />);
-      expect(component).toMatchSnapshot();
-    });
-
-    test('button', () => {
-      const component = shallow(<ElasticBeatsCard button="Button" solution="Solution" />);
-      expect(component).toMatchSnapshot();
-    });
-
-    test('href', () => {
-      const component = shallow(<ElasticBeatsCard href="#" button="Button" solution="Solution" />);
-      expect(component).toMatchSnapshot();
-    });
-  });
-});
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_beats_card.tsx b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_beats_card.tsx
deleted file mode 100644
index 0372d12096489..0000000000000
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_beats_card.tsx
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { FunctionComponent } from 'react';
-import { i18n } from '@kbn/i18n';
-import { CoreStart } from 'kibana/public';
-import { EuiButton, EuiCard } from '@elastic/eui';
-import { useKibana } from '../../../context';
-import { NoDataPageActions, NO_DATA_RECOMMENDED } from '../no_data_page';
-
-export type ElasticBeatsCardProps = NoDataPageActions & {
-  solution: string;
-};
-
-export const ElasticBeatsCard: FunctionComponent<ElasticBeatsCardProps> = ({
-  recommended,
-  title,
-  button,
-  href,
-  solution, // unused for now
-  layout,
-  ...cardRest
-}) => {
-  const {
-    services: { http, uiSettings },
-  } = useKibana<CoreStart>();
-  const addBasePath = http.basePath.prepend;
-  const basePathUrl = '/plugins/kibanaReact/assets/';
-  const IS_DARK_THEME = uiSettings.get('theme:darkMode');
-
-  const defaultCTAtitle = i18n.translate('kibana-react.noDataPage.elasticBeatsCard.title', {
-    defaultMessage: 'Add data',
-  });
-
-  const footer =
-    typeof button !== 'string' && typeof button !== 'undefined' ? (
-      button
-    ) : (
-      // The href and/or onClick are attached to the whole Card, so the button is just for show.
-      // Do not add the behavior here too or else it will propogate through
-      <EuiButton fill>{button || title || defaultCTAtitle}</EuiButton>
-    );
-
-  return (
-    <EuiCard
-      paddingSize="l"
-      href={href ?? addBasePath('/app/home#/tutorial_directory')}
-      title={title || defaultCTAtitle}
-      description={i18n.translate('kibana-react.noDataPage.elasticBeatsCard.description', {
-        defaultMessage: `Use Beats to add data from various systems to Elasticsearch.`,
-      })}
-      image={addBasePath(
-        `${basePathUrl}elastic_beats_card_${IS_DARK_THEME ? 'dark' : 'light'}.svg`
-      )}
-      betaBadgeLabel={recommended ? NO_DATA_RECOMMENDED : undefined}
-      footer={footer}
-      layout={layout as 'vertical' | undefined}
-      {...cardRest}
-    />
-  );
-};
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/index.ts b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/index.ts
index 3744239d9a472..e05d4d9675ca9 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/index.ts
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/index.ts
@@ -7,5 +7,4 @@
  */
 
 export * from './elastic_agent_card';
-export * from './elastic_beats_card';
 export * from './no_data_card';
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_page.tsx b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_page.tsx
index 56eb0f34617d6..b2d9ef6ca5008 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_page.tsx
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_page.tsx
@@ -22,7 +22,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { KibanaPageTemplateProps } from '../page_template';
 
-import { ElasticAgentCard, ElasticBeatsCard, NoDataCard } from './no_data_card';
+import { ElasticAgentCard, NoDataCard } from './no_data_card';
 import { KibanaPageTemplateSolutionNavAvatar } from '../solution_nav';
 
 export const NO_DATA_PAGE_MAX_WIDTH = 950;
@@ -55,6 +55,10 @@ export type NoDataPageActions = Partial<EuiCardProps> & {
    * Remapping `onClick` to any element
    */
   onClick?: MouseEventHandler<HTMLElement>;
+  /**
+   * Category to auto-select within Fleet
+   */
+  category?: string;
 };
 
 export type NoDataPageActionsProps = Record<string, NoDataPageActions>;
@@ -107,18 +111,12 @@ export const NoDataPage: FunctionComponent<NoDataPageProps> = ({
   const actionsKeys = Object.keys(sortedData);
   const renderActions = useMemo(() => {
     return Object.values(sortedData).map((action, i) => {
-      if (actionsKeys[i] === 'elasticAgent') {
+      if (actionsKeys[i] === 'elasticAgent' || actionsKeys[i] === 'beats') {
         return (
           <EuiFlexItem key={`empty-page-agent-action`} className="kbnNoDataPageContents__item">
             <ElasticAgentCard solution={solution} {...action} />
           </EuiFlexItem>
         );
-      } else if (actionsKeys[i] === 'beats') {
-        return (
-          <EuiFlexItem key={`empty-page-beats-action`} className="kbnNoDataPageContents__item">
-            <ElasticBeatsCard solution={solution} {...action} />
-          </EuiFlexItem>
-        );
       } else {
         return (
           <EuiFlexItem
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/RumHome.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/RumHome.tsx
index 2de6f1d063522..cc4bd0d14e290 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/RumHome.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/RumHome.tsx
@@ -37,18 +37,18 @@ export function RumHome() {
             defaultMessage: 'Observability',
           }),
           actions: {
-            beats: {
+            elasticAgent: {
               title: i18n.translate('xpack.apm.ux.overview.beatsCard.title', {
-                defaultMessage: 'Add RUM data',
+                defaultMessage: 'Add the APM integration',
               }),
               description: i18n.translate(
                 'xpack.apm.ux.overview.beatsCard.description',
                 {
                   defaultMessage:
-                    'Use the RUM (JS) agent to collect user experience data.',
+                    'Enable RUM with the APM agent to collect user experience data.',
                 }
               ),
-              href: core.http.basePath.prepend(`/app/home#/tutorial/apm`),
+              href: core.http.basePath.prepend(`integrations/detail/apm`),
             },
           },
           docsLink: core.docLinks.links.observability.guide,
diff --git a/x-pack/plugins/apm/public/components/routing/templates/no_data_config.ts b/x-pack/plugins/apm/public/components/routing/templates/no_data_config.ts
index 868db57a0efdc..92b2b1bc3d229 100644
--- a/x-pack/plugins/apm/public/components/routing/templates/no_data_config.ts
+++ b/x-pack/plugins/apm/public/components/routing/templates/no_data_config.ts
@@ -24,18 +24,18 @@ export function getNoDataConfig({
         defaultMessage: 'Observability',
       }),
       actions: {
-        beats: {
-          title: i18n.translate('xpack.apm.noDataConfig.beatsCard.title', {
-            defaultMessage: 'Add data with APM agents',
+        elasticAgent: {
+          title: i18n.translate('xpack.apm.ux.overview.agent.title', {
+            defaultMessage: 'Add the APM integration',
           }),
           description: i18n.translate(
-            'xpack.apm.noDataConfig.beatsCard.description',
+            'xpack.apm.ux.overview.agent.description',
             {
               defaultMessage:
                 'Use APM agents to collect APM data. We make it easy with agents for many popular languages.',
             }
           ),
-          href: basePath + `/app/home#/tutorial/apm`,
+          href: basePath + `/app/integrations/detail/apm`,
         },
       },
       docsLink,
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid.tsx
index 00adb2a7b4ffb..d2d361cd212a6 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid.tsx
@@ -240,7 +240,7 @@ function MissingIntegrationContent({
               </EuiLink>
             ),
             discussForumLink: (
-              <EuiLink href="https://discuss.elastic.co/tag/fleet" external target="_blank">
+              <EuiLink href="https://discuss.elastic.co/tag/integrations" external target="_blank">
                 <FormattedMessage
                   id="xpack.fleet.integrations.discussForumLink"
                   defaultMessage="discuss forum"
diff --git a/x-pack/plugins/fleet/public/components/home_integration/index.tsx b/x-pack/plugins/fleet/public/components/home_integration/index.tsx
index 27509d9c45e6e..56123e5f32dee 100644
--- a/x-pack/plugins/fleet/public/components/home_integration/index.tsx
+++ b/x-pack/plugins/fleet/public/components/home_integration/index.tsx
@@ -7,19 +7,11 @@
 
 import React from 'react';
 import type {
-  TutorialDirectoryNoticeComponent,
   TutorialDirectoryHeaderLinkComponent,
   TutorialModuleNoticeComponent,
 } from 'src/plugins/home/public';
 import { EuiLoadingSpinner } from '@elastic/eui';
 
-const TutorialDirectoryNoticeLazy = React.lazy(() => import('./tutorial_directory_notice'));
-export const TutorialDirectoryNotice: TutorialDirectoryNoticeComponent = () => (
-  <React.Suspense fallback={<EuiLoadingSpinner />}>
-    <TutorialDirectoryNoticeLazy />
-  </React.Suspense>
-);
-
 const TutorialDirectoryHeaderLinkLazy = React.lazy(
   () => import('./tutorial_directory_header_link')
 );
diff --git a/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx b/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx
index 074a1c40bdb19..18fdd875c7379 100644
--- a/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx
+++ b/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_header_link.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { memo, useState, useEffect } from 'react';
+import React, { memo, useState } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiButtonEmpty } from '@elastic/eui';
 import type { TutorialDirectoryHeaderLinkComponent } from 'src/plugins/home/public';
@@ -13,25 +13,15 @@ import type { TutorialDirectoryHeaderLinkComponent } from 'src/plugins/home/publ
 import { RedirectAppLinks } from '../../../../../../src/plugins/kibana_react/public';
 import { useLink, useCapabilities, useStartServices } from '../../hooks';
 
-import { tutorialDirectoryNoticeState$ } from './tutorial_directory_notice';
-
 const TutorialDirectoryHeaderLink: TutorialDirectoryHeaderLinkComponent = memo(() => {
   const { getHref } = useLink();
   const { application } = useStartServices();
   const { show: hasIngestManager } = useCapabilities();
-  const [noticeState, setNoticeState] = useState({
+  const [noticeState] = useState({
     settingsDataLoaded: false,
-    hasSeenNotice: false,
   });
 
-  useEffect(() => {
-    const subscription = tutorialDirectoryNoticeState$.subscribe((value) => setNoticeState(value));
-    return () => {
-      subscription.unsubscribe();
-    };
-  }, []);
-
-  return hasIngestManager && noticeState.settingsDataLoaded && noticeState.hasSeenNotice ? (
+  return hasIngestManager && noticeState.settingsDataLoaded ? (
     <RedirectAppLinks application={application}>
       <EuiButtonEmpty size="s" iconType="link" flush="right" href={getHref('integrations')}>
         <FormattedMessage
diff --git a/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_notice.tsx b/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_notice.tsx
deleted file mode 100644
index e784ff1ac6adb..0000000000000
--- a/x-pack/plugins/fleet/public/components/home_integration/tutorial_directory_notice.tsx
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { memo, useState, useCallback, useEffect } from 'react';
-import { BehaviorSubject } from 'rxjs';
-import styled from 'styled-components';
-import { FormattedMessage } from '@kbn/i18n/react';
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiButton,
-  EuiButtonEmpty,
-  EuiLink,
-  EuiCallOut,
-  EuiSpacer,
-} from '@elastic/eui';
-import type { TutorialDirectoryNoticeComponent } from 'src/plugins/home/public';
-
-import { RedirectAppLinks } from '../../../../../../src/plugins/kibana_react/public';
-import {
-  sendPutSettings,
-  useGetSettings,
-  useLink,
-  useCapabilities,
-  useStartServices,
-} from '../../hooks';
-
-const FlexItemButtonWrapper = styled(EuiFlexItem)`
-  &&& {
-    margin-bottom: 0;
-  }
-`;
-
-export const tutorialDirectoryNoticeState$ = new BehaviorSubject({
-  settingsDataLoaded: false,
-  hasSeenNotice: false,
-});
-
-const TutorialDirectoryNotice: TutorialDirectoryNoticeComponent = memo(() => {
-  const { getHref } = useLink();
-  const { application } = useStartServices();
-  const { show: hasIngestManager } = useCapabilities();
-  const { data: settingsData, isLoading } = useGetSettings();
-  const [dismissedNotice, setDismissedNotice] = useState<boolean>(false);
-
-  const dismissNotice = useCallback(async () => {
-    setDismissedNotice(true);
-    await sendPutSettings({
-      has_seen_add_data_notice: true,
-    });
-  }, []);
-
-  useEffect(() => {
-    tutorialDirectoryNoticeState$.next({
-      settingsDataLoaded: !isLoading,
-      hasSeenNotice: Boolean(dismissedNotice || settingsData?.item?.has_seen_add_data_notice),
-    });
-  }, [isLoading, settingsData, dismissedNotice]);
-
-  const hasSeenNotice =
-    isLoading || settingsData?.item?.has_seen_add_data_notice || dismissedNotice;
-
-  return hasIngestManager && !hasSeenNotice ? (
-    <>
-      <EuiCallOut
-        iconType="cheer"
-        title={
-          <FormattedMessage
-            id="xpack.fleet.homeIntegration.tutorialDirectory.noticeTitle"
-            defaultMessage="{newPrefix} Elastic Agent integrations"
-            values={{
-              newPrefix: (
-                <strong>
-                  <FormattedMessage
-                    id="xpack.fleet.homeIntegration.tutorialDirectory.noticeTitle.newPrefix"
-                    defaultMessage="Now generally available:"
-                  />
-                </strong>
-              ),
-            }}
-          />
-        }
-      >
-        <p>
-          <FormattedMessage
-            id="xpack.fleet.homeIntegration.tutorialDirectory.noticeText"
-            defaultMessage="Elastic Agent integrations provide a simple, unified way to add monitoring for logs, metrics, and other types of data to your hosts.
-              You no longer need to install multiple Beats, which makes it easier and faster to deploy policies across your infrastructure.
-              For more information, read our {blogPostLink}."
-            values={{
-              blogPostLink: (
-                <EuiLink
-                  href="https://ela.st/elastic-agent-ga-announcement"
-                  external
-                  target="_blank"
-                >
-                  <FormattedMessage
-                    id="xpack.fleet.homeIntegration.tutorialDirectory.noticeText.blogPostLink"
-                    defaultMessage="announcement blog post"
-                  />
-                </EuiLink>
-              ),
-            }}
-          />
-        </p>
-        <EuiFlexGroup gutterSize="s">
-          <FlexItemButtonWrapper grow={false}>
-            <div>
-              <RedirectAppLinks application={application}>
-                <EuiButton size="s" href={getHref('integrations')}>
-                  <FormattedMessage
-                    id="xpack.fleet.homeIntegration.tutorialDirectory.fleetAppButtonText"
-                    defaultMessage="Try Integrations"
-                  />
-                </EuiButton>
-              </RedirectAppLinks>
-            </div>
-          </FlexItemButtonWrapper>
-          <FlexItemButtonWrapper grow={false}>
-            <div>
-              <EuiButtonEmpty
-                size="s"
-                onClick={() => {
-                  dismissNotice();
-                }}
-              >
-                <FormattedMessage
-                  id="xpack.fleet.homeIntegration.tutorialDirectory.dismissNoticeButtonText"
-                  defaultMessage="Dismiss message"
-                />
-              </EuiButtonEmpty>
-            </div>
-          </FlexItemButtonWrapper>
-        </EuiFlexGroup>
-      </EuiCallOut>
-      <EuiSpacer size="m" />
-    </>
-  ) : null;
-});
-
-// Needed for React.lazy
-// eslint-disable-next-line import/no-default-export
-export default TutorialDirectoryNotice;
diff --git a/x-pack/plugins/fleet/public/plugin.ts b/x-pack/plugins/fleet/public/plugin.ts
index e1f263b0763e8..4a2a6900cc78c 100644
--- a/x-pack/plugins/fleet/public/plugin.ts
+++ b/x-pack/plugins/fleet/public/plugin.ts
@@ -44,11 +44,7 @@ import { CUSTOM_LOGS_INTEGRATION_NAME, INTEGRATIONS_BASE_PATH } from './constant
 import { licenseService } from './hooks';
 import { setHttpClient } from './hooks/use_request';
 import { createPackageSearchProvider } from './search_provider';
-import {
-  TutorialDirectoryNotice,
-  TutorialDirectoryHeaderLink,
-  TutorialModuleNotice,
-} from './components/home_integration';
+import { TutorialDirectoryHeaderLink, TutorialModuleNotice } from './components/home_integration';
 import { createExtensionRegistrationCallback } from './services/ui_extensions';
 import type { UIExtensionRegistrationCallback, UIExtensionsStorage } from './types';
 import { LazyCustomLogsAssetsExtension } from './lazy_custom_logs_assets_extension';
@@ -197,7 +193,6 @@ export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDep
 
     // Register components for home/add data integration
     if (deps.home) {
-      deps.home.tutorials.registerDirectoryNotice(PLUGIN_ID, TutorialDirectoryNotice);
       deps.home.tutorials.registerDirectoryHeaderLink(PLUGIN_ID, TutorialDirectoryHeaderLink);
       deps.home.tutorials.registerModuleNotice(PLUGIN_ID, TutorialModuleNotice);
 
diff --git a/x-pack/plugins/infra/public/pages/logs/page_content.tsx b/x-pack/plugins/infra/public/pages/logs/page_content.tsx
index d8b5667e60d04..a82cb55dc7241 100644
--- a/x-pack/plugins/infra/public/pages/logs/page_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/page_content.tsx
@@ -84,7 +84,7 @@ export const LogsPageContent: React.FunctionComponent = () => {
             </EuiHeaderLink>
             <AlertDropdown />
             <EuiHeaderLink
-              href={kibana.services?.application?.getUrlForApp('/home#/tutorial_directory/logging')}
+              href={kibana.services?.application?.getUrlForApp('/integrations/browse')}
               color="primary"
               iconType="indexOpen"
             >
diff --git a/x-pack/plugins/infra/public/pages/logs/page_template.tsx b/x-pack/plugins/infra/public/pages/logs/page_template.tsx
index 7ee60ab84bf25..6de13b495f0ba 100644
--- a/x-pack/plugins/infra/public/pages/logs/page_template.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/page_template.tsx
@@ -44,13 +44,13 @@ export const LogsPageTemplate: React.FC<LogsPageTemplateProps> = ({
         actions: {
           beats: {
             title: i18n.translate('xpack.infra.logs.noDataConfig.beatsCard.title', {
-              defaultMessage: 'Add logs with Beats',
+              defaultMessage: 'Add a logging integration',
             }),
             description: i18n.translate('xpack.infra.logs.noDataConfig.beatsCard.description', {
               defaultMessage:
-                'Use Beats to send logs to Elasticsearch. We make it easy with modules for many popular systems and apps.',
+                'Use the Elastic Agent or Beats to send logs to Elasticsearch. We make it easy with integrations for many popular systems and apps.',
             }),
-            href: basePath + `/app/home#/tutorial_directory/logging`,
+            href: basePath + `/app/integrations/browse`,
           },
         },
         docsLink: docLinks.links.observability.guide,
diff --git a/x-pack/plugins/infra/public/pages/logs/stream/page_no_indices_content.tsx b/x-pack/plugins/infra/public/pages/logs/stream/page_no_indices_content.tsx
index bc3bc22f3f1b2..2259a8d3528af 100644
--- a/x-pack/plugins/infra/public/pages/logs/stream/page_no_indices_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/stream/page_no_indices_content.tsx
@@ -22,8 +22,8 @@ export const LogsPageNoIndicesContent = () => {
   const canConfigureSource = application?.capabilities?.logs?.configureSource ? true : false;
 
   const tutorialLinkProps = useLinkProps({
-    app: 'home',
-    hash: '/tutorial_directory/logging',
+    app: 'integrations',
+    hash: '/browse',
   });
 
   return (
diff --git a/x-pack/plugins/infra/public/pages/metrics/index.tsx b/x-pack/plugins/infra/public/pages/metrics/index.tsx
index ae375dc504e7a..1a79cd996087d 100644
--- a/x-pack/plugins/infra/public/pages/metrics/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/index.tsx
@@ -93,9 +93,7 @@ export const InfrastructurePage = ({ match }: RouteComponentProps) => {
                         <Route path={'/inventory'} component={AnomalyDetectionFlyout} />
                         <MetricsAlertDropdown />
                         <EuiHeaderLink
-                          href={kibana.services?.application?.getUrlForApp(
-                            '/home#/tutorial_directory/metrics'
-                          )}
+                          href={kibana.services?.application?.getUrlForApp('/integrations/browse')}
                           color="primary"
                           iconType="indexOpen"
                         >
diff --git a/x-pack/plugins/infra/public/pages/metrics/metric_detail/components/invalid_node.tsx b/x-pack/plugins/infra/public/pages/metrics/metric_detail/components/invalid_node.tsx
index 2a436eac30b2c..17e6382ce65cc 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metric_detail/components/invalid_node.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/metric_detail/components/invalid_node.tsx
@@ -18,8 +18,8 @@ interface InvalidNodeErrorProps {
 
 export const InvalidNodeError: React.FunctionComponent<InvalidNodeErrorProps> = ({ nodeName }) => {
   const tutorialLinkProps = useLinkProps({
-    app: 'home',
-    hash: '/tutorial_directory/metrics',
+    app: 'integrations',
+    hash: '/browse',
   });
 
   return (
diff --git a/x-pack/plugins/infra/public/pages/metrics/page_template.tsx b/x-pack/plugins/infra/public/pages/metrics/page_template.tsx
index 41ea12c280841..4da671283644d 100644
--- a/x-pack/plugins/infra/public/pages/metrics/page_template.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/page_template.tsx
@@ -10,7 +10,6 @@ import { i18n } from '@kbn/i18n';
 import { useKibanaContextForPlugin } from '../../hooks/use_kibana';
 import type { LazyObservabilityPageTemplateProps } from '../../../../observability/public';
 import { KibanaPageTemplateProps } from '../../../../../../src/plugins/kibana_react/public';
-import { useLinkProps } from '../../hooks/use_link_props';
 
 interface MetricsPageTemplateProps extends LazyObservabilityPageTemplateProps {
   hasData?: boolean;
@@ -30,11 +29,6 @@ export const MetricsPageTemplate: React.FC<MetricsPageTemplateProps> = ({
     },
   } = useKibanaContextForPlugin();
 
-  const tutorialLinkProps = useLinkProps({
-    app: 'home',
-    hash: '/tutorial_directory/metrics',
-  });
-
   const noDataConfig: KibanaPageTemplateProps['noDataConfig'] = hasData
     ? undefined
     : {
@@ -44,13 +38,12 @@ export const MetricsPageTemplate: React.FC<MetricsPageTemplateProps> = ({
         actions: {
           beats: {
             title: i18n.translate('xpack.infra.metrics.noDataConfig.beatsCard.title', {
-              defaultMessage: 'Add metrics with Beats',
+              defaultMessage: 'Add a metrics integration',
             }),
             description: i18n.translate('xpack.infra.metrics.noDataConfig.beatsCard.description', {
               defaultMessage:
                 'Use Beats to send metrics data to Elasticsearch. We make it easy with modules for many popular systems and apps.',
             }),
-            ...tutorialLinkProps,
           },
         },
         docsLink: docLinks.links.observability.guide,
diff --git a/x-pack/plugins/observability/public/components/app/header/header_menu.tsx b/x-pack/plugins/observability/public/components/app/header/header_menu.tsx
index 707cb241501fd..0ed01b7d3673e 100644
--- a/x-pack/plugins/observability/public/components/app/header/header_menu.tsx
+++ b/x-pack/plugins/observability/public/components/app/header/header_menu.tsx
@@ -26,7 +26,7 @@ export function ObservabilityHeaderMenu(): React.ReactElement | null {
       <EuiHeaderLinks>
         <EuiHeaderLink
           color="primary"
-          href={prepend('/app/home#/tutorial_directory/logging')}
+          href={prepend('/app/integrations/browse')}
           iconType="indexOpen"
         >
           {addDataLinkText}
diff --git a/x-pack/plugins/observability/public/utils/no_data_config.ts b/x-pack/plugins/observability/public/utils/no_data_config.ts
index 1e16fb145bdce..2c87b1434a0b4 100644
--- a/x-pack/plugins/observability/public/utils/no_data_config.ts
+++ b/x-pack/plugins/observability/public/utils/no_data_config.ts
@@ -24,12 +24,15 @@ export function getNoDataConfig({
         defaultMessage: 'Observability',
       }),
       actions: {
-        beats: {
+        elasticAgent: {
+          title: i18n.translate('xpack.observability.noDataConfig.beatsCard.title', {
+            defaultMessage: 'Add integrations',
+          }),
           description: i18n.translate('xpack.observability.noDataConfig.beatsCard.description', {
             defaultMessage:
               'Use Beats and APM agents to send observability data to Elasticsearch. We make it easy with support for many popular systems, apps, and languages.',
           }),
-          href: basePath.prepend(`/app/home#/tutorial_directory/logging`),
+          href: basePath.prepend(`/app/integrations`),
         },
       },
       docsLink,
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 5c41e92661e58..5a7e19e2cdd05 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -16,7 +16,7 @@ export const APP_NAME = 'Security';
 export const APP_ICON = 'securityAnalyticsApp';
 export const APP_ICON_SOLUTION = 'logoSecurity';
 export const APP_PATH = `/app/security`;
-export const ADD_DATA_PATH = `/app/home#/tutorial_directory/security`;
+export const ADD_DATA_PATH = `/app/integrations/browse/security`;
 export const DEFAULT_BYTES_FORMAT = 'format:bytes:defaultPattern';
 export const DEFAULT_DATE_FORMAT = 'dateFormat';
 export const DEFAULT_DATE_FORMAT_TZ = 'dateFormat:tz';
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_empty/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_empty/index.test.tsx
index 5fa2725f9ee6f..61e9e66f1bb87 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_empty/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_empty/index.test.tsx
@@ -45,9 +45,10 @@ describe('OverviewEmpty', () => {
       expect(wrapper.find('[data-test-subj="empty-page"]').prop('noDataConfig')).toEqual({
         actions: {
           elasticAgent: {
+            category: 'security',
             description:
-              'Use Elastic Agent to collect security events and protect your endpoints from threats. Manage your agents in Fleet and add integrations with a single click.',
-            href: '/app/integrations/browse/security',
+              'Use Elastic Agent to collect security events and protect your endpoints from threats.',
+            title: 'Add a Security integration',
           },
         },
         docsLink: 'https://www.elastic.co/guide/en/security/mocked-test-branch/index.html',
@@ -68,8 +69,11 @@ describe('OverviewEmpty', () => {
     it('render with correct actions ', () => {
       expect(wrapper.find('[data-test-subj="empty-page"]').prop('noDataConfig')).toEqual({
         actions: {
-          beats: {
-            href: '/app/home#/tutorial_directory/security',
+          elasticAgent: {
+            category: 'security',
+            description:
+              'Use Elastic Agent to collect security events and protect your endpoints from threats.',
+            title: 'Add a Security integration',
           },
         },
         docsLink: 'https://www.elastic.co/guide/en/security/mocked-test-branch/index.html',
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_empty/index.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_empty/index.tsx
index bc76333943191..9b20c079002e6 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_empty/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_empty/index.tsx
@@ -5,13 +5,10 @@
  * 2.0.
  */
 
-import React, { useMemo } from 'react';
+import React from 'react';
 import { i18n } from '@kbn/i18n';
 import { useKibana } from '../../../common/lib/kibana';
-import { ADD_DATA_PATH } from '../../../../common/constants';
-import { pagePathGetters } from '../../../../../fleet/public';
 import { SOLUTION_NAME } from '../../../../public/common/translations';
-import { useUserPrivileges } from '../../../common/components/user_privileges';
 
 import {
   KibanaPageTemplate,
@@ -19,42 +16,27 @@ import {
 } from '../../../../../../../src/plugins/kibana_react/public';
 
 const OverviewEmptyComponent: React.FC = () => {
-  const { http, docLinks } = useKibana().services;
-  const basePath = http.basePath.get();
-  const canAccessFleet = useUserPrivileges().endpointPrivileges.canAccessFleet;
-  const integrationsPathComponents = pagePathGetters.integrations_all({ category: 'security' });
-
-  const agentAction: NoDataPageActionsProps = useMemo(
-    () => ({
-      elasticAgent: {
-        href: `${basePath}${integrationsPathComponents[0]}${integrationsPathComponents[1]}`,
-        description: i18n.translate(
-          'xpack.securitySolution.pages.emptyPage.beatsCard.description',
-          {
-            defaultMessage:
-              'Use Elastic Agent to collect security events and protect your endpoints from threats. Manage your agents in Fleet and add integrations with a single click.',
-          }
-        ),
-      },
-    }),
-    [basePath, integrationsPathComponents]
-  );
-
-  const beatsAction: NoDataPageActionsProps = useMemo(
-    () => ({
-      beats: {
-        href: `${basePath}${ADD_DATA_PATH}`,
-      },
-    }),
-    [basePath]
-  );
+  const { docLinks } = useKibana().services;
+
+  const agentAction: NoDataPageActionsProps = {
+    elasticAgent: {
+      category: 'security',
+      title: i18n.translate('xpack.securitySolution.pages.emptyPage.beatsCard.title', {
+        defaultMessage: 'Add a Security integration',
+      }),
+      description: i18n.translate('xpack.securitySolution.pages.emptyPage.beatsCard.description', {
+        defaultMessage:
+          'Use Elastic Agent to collect security events and protect your endpoints from threats.',
+      }),
+    },
+  };
 
   return (
     <KibanaPageTemplate
       data-test-subj="empty-page"
       noDataConfig={{
         solution: SOLUTION_NAME,
-        actions: canAccessFleet ? agentAction : beatsAction,
+        actions: agentAction,
         docsLink: docLinks.links.siem.gettingStarted,
       }}
     />
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index f909a03909e3f..95f6909b12f6c 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -3014,11 +3014,7 @@
     "home.tutorial.savedObject.unableToAddErrorMessage": "{savedObjectsLength} 件中 {errorsLength} 件の kibana オブジェクトが追加できません。エラー：{errorMessage}",
     "home.tutorial.selectionLegend": "デプロイタイプ",
     "home.tutorial.selfManagedButtonLabel": "自己管理",
-    "home.tutorial.tabs.allTitle": "すべて",
-    "home.tutorial.tabs.loggingTitle": "ログ",
-    "home.tutorial.tabs.metricsTitle": "メトリック",
     "home.tutorial.tabs.sampleDataTitle": "サンプルデータ",
-    "home.tutorial.tabs.securitySolutionTitle": "セキュリティ",
     "home.tutorial.unexpectedStatusCheckStateErrorDescription": "予期せぬステータス確認ステータス {statusCheckState}",
     "home.tutorial.unhandledInstructionTypeErrorDescription": "予期せぬ指示タイプ {visibleInstructions}",
     "home.tutorialDirectory.featureCatalogueDescription": "一般的なアプリやサービスからデータを取り込みます。",
@@ -4209,8 +4205,6 @@
     "kibana-react.noDataPage.cantDecide.link": "詳細については、ドキュメントをご確認ください。",
     "kibana-react.noDataPage.elasticAgentCard.description": "Elasticエージェントを使用すると、シンプルで統一された方法でコンピューターからデータを収集するできます。",
     "kibana-react.noDataPage.elasticAgentCard.title": "Elasticエージェントの追加",
-    "kibana-react.noDataPage.elasticBeatsCard.description": "Beatsを使用して、さまざまなシステムのデータをElasticsearchに追加します。",
-    "kibana-react.noDataPage.elasticBeatsCard.title": "データの追加",
     "kibana-react.noDataPage.intro": "データを追加して開始するか、{solution}については{link}をご覧ください。",
     "kibana-react.noDataPage.intro.link": "詳細",
     "kibana-react.noDataPage.noDataPage.recommended": "推奨",
@@ -11205,12 +11199,7 @@
     "xpack.fleet.fleetServerUpgradeModal.modalTitle": "エージェントをFleetサーバーに登録",
     "xpack.fleet.fleetServerUpgradeModal.onPremDescriptionMessage": "Fleetサーバーが使用できます。スケーラビリティとセキュリティが改善されています。{existingAgentsMessage} Fleetを使用し続けるには、Fleetサーバーと新しいバージョンのElasticエージェントを各ホストにインストールする必要があります。詳細については、{link}をご覧ください。",
     "xpack.fleet.genericActionsMenuText": "開く",
-    "xpack.fleet.homeIntegration.tutorialDirectory.dismissNoticeButtonText": "メッセージを消去",
     "xpack.fleet.homeIntegration.tutorialDirectory.fleetAppButtonText": "統合を試す",
-    "xpack.fleet.homeIntegration.tutorialDirectory.noticeText": "Elasticエージェント統合では、シンプルかつ統合された方法で、ログ、メトリック、他の種類のデータの監視をホストに追加することができます。複数のBeatsをインストールする必要はありません。このため、インフラストラクチャ全体でのポリシーのデプロイが簡単で高速になりました。詳細については、{blogPostLink}をお読みください。",
-    "xpack.fleet.homeIntegration.tutorialDirectory.noticeText.blogPostLink": "発表ブログ投稿",
-    "xpack.fleet.homeIntegration.tutorialDirectory.noticeTitle": "{newPrefix} Elasticエージェント統合",
-    "xpack.fleet.homeIntegration.tutorialDirectory.noticeTitle.newPrefix": "<b>一般公開へ：</b>",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText": "{notePrefix}このモジュールの新しいバージョンは{availableAsIntegrationLink}です。統合と新しいElasticエージェントの詳細については、{blogPostLink}をお読みください。",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText.blogPostLink": "発表ブログ投稿",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText.integrationLink": "Elasticエージェント統合として提供",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 4de407cf8e464..80dad5a2c0c8b 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -3043,11 +3043,7 @@
     "home.tutorial.savedObject.unableToAddErrorMessage": "{savedObjectsLength} 个 kibana 对象中有 {errorsLength} 个无法添加，错误：{errorMessage}",
     "home.tutorial.selectionLegend": "部署类型",
     "home.tutorial.selfManagedButtonLabel": "自管型",
-    "home.tutorial.tabs.allTitle": "全部",
-    "home.tutorial.tabs.loggingTitle": "日志",
-    "home.tutorial.tabs.metricsTitle": "指标",
     "home.tutorial.tabs.sampleDataTitle": "样例数据",
-    "home.tutorial.tabs.securitySolutionTitle": "安全",
     "home.tutorial.unexpectedStatusCheckStateErrorDescription": "意外的状态检查状态 {statusCheckState}",
     "home.tutorial.unhandledInstructionTypeErrorDescription": "未处理的指令类型 {visibleInstructions}",
     "home.tutorialDirectory.featureCatalogueDescription": "从热门应用和服务中采集数据。",
@@ -4249,8 +4245,6 @@
     "kibana-react.noDataPage.cantDecide.link": "请参阅我们的文档以了解更多信息。",
     "kibana-react.noDataPage.elasticAgentCard.description": "使用 Elastic 代理以简单统一的方式从您的计算机中收集数据。",
     "kibana-react.noDataPage.elasticAgentCard.title": "添加 Elastic 代理",
-    "kibana-react.noDataPage.elasticBeatsCard.description": "使用 Beats 将各种系统的数据添加到 Elasticsearch。",
-    "kibana-react.noDataPage.elasticBeatsCard.title": "添加数据",
     "kibana-react.noDataPage.intro": "添加您的数据以开始，或{link}{solution}。",
     "kibana-react.noDataPage.intro.link": "了解详情",
     "kibana-react.noDataPage.noDataPage.recommended": "推荐",
@@ -11321,12 +11315,7 @@
     "xpack.fleet.fleetServerUpgradeModal.modalTitle": "将代理注册到 Fleet 服务器",
     "xpack.fleet.fleetServerUpgradeModal.onPremDescriptionMessage": "Fleet 服务器现在可用且提供改善的可扩展性和安全性。{existingAgentsMessage}要继续使用 Fleet，必须在各个主机上安装 Fleet 服务器和新版 Elastic 代理。详细了解我们的 {link}。",
     "xpack.fleet.genericActionsMenuText": "打开",
-    "xpack.fleet.homeIntegration.tutorialDirectory.dismissNoticeButtonText": "关闭消息",
     "xpack.fleet.homeIntegration.tutorialDirectory.fleetAppButtonText": "试用集成",
-    "xpack.fleet.homeIntegration.tutorialDirectory.noticeText": "通过 Elastic 代理集成，可以简单统一的方式将日志、指标和其他类型数据的监测添加到主机。不再需要安装多个 Beats，这样将策略部署到整个基础架构更容易也更快速。有关更多信息，请阅读我们的{blogPostLink}。",
-    "xpack.fleet.homeIntegration.tutorialDirectory.noticeText.blogPostLink": "公告博客",
-    "xpack.fleet.homeIntegration.tutorialDirectory.noticeTitle": "{newPrefix}Elastic 代理集成",
-    "xpack.fleet.homeIntegration.tutorialDirectory.noticeTitle.newPrefix": "已正式发布：",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText": "{notePrefix}此模块的较新版本{availableAsIntegrationLink}。要详细了解集成和新 Elastic 代理，请阅读我们的{blogPostLink}。",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText.blogPostLink": "公告博客",
     "xpack.fleet.homeIntegration.tutorialModule.noticeText.integrationLink": "将作为 Elastic 代理集成来提供",
diff --git a/x-pack/test/accessibility/apps/home.ts b/x-pack/test/accessibility/apps/home.ts
index a7158d9579b60..61297859c29f8 100644
--- a/x-pack/test/accessibility/apps/home.ts
+++ b/x-pack/test/accessibility/apps/home.ts
@@ -64,33 +64,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await a11y.testAppSnapshot();
     });
 
-    it('Add data page meets a11y requirements ', async () => {
-      await home.clickGoHome();
-      await testSubjects.click('homeAddData');
-      await a11y.testAppSnapshot();
-    });
-
-    it('Sample data page meets a11y requirements ', async () => {
-      await testSubjects.click('homeTab-sampleData');
-      await a11y.testAppSnapshot();
-    });
-
-    it('click on Add logs panel to open all log examples page meets a11y requirements ', async () => {
-      await testSubjects.click('sampleDataSetCardlogs');
-      await a11y.testAppSnapshot();
-    });
-
-    it('click on ActiveMQ logs panel to open tutorial meets a11y requirements', async () => {
-      await testSubjects.click('homeTab-all');
-      await testSubjects.click('homeSynopsisLinkactivemqlogs');
-      await a11y.testAppSnapshot();
-    });
-
-    it('click on cloud tutorial meets a11y requirements', async () => {
-      await testSubjects.click('onCloudTutorial');
-      await a11y.testAppSnapshot();
-    });
-
     it('passes with searchbox open', async () => {
       await testSubjects.click('nav-search-popover');
       await a11y.testAppSnapshot();

From 828437621762ec327a5bf8f2b53927204d21776b Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 07:43:48 -0400
Subject: [PATCH 08/36] [RAC] [Metrics UI] Include group name in the reason
 message (#115171) (#115523)

* [RAC] [Metrics UI] Include group name in the reason message

* remove console log

* fix i18n errors

* fix more i18n errors

* fix i18n & check errors and move group to the end of the reason text

* add empty lines at the end of translation files

* fix more i18n tests

* try to remove manually added translations

* Revert "try to remove manually added translations"

This reverts commit 6949af2f70aff46b088bab5c942497ad46081d90.

* apply i18n_check fix and reorder values in the formatted reason

* log threshold reformat reason message and move group info at the end

Co-authored-by: mgiota <giota85@gmail.com>
---
 .../server/lib/alerting/common/messages.ts    | 18 ++++++----
 .../inventory_metric_threshold_executor.ts    | 35 +++++++++++--------
 .../log_threshold/reason_formatters.ts        |  4 +--
 .../metric_threshold_executor.ts              |  9 ++---
 .../translations/translations/ja-JP.json      |  3 --
 .../translations/translations/zh-CN.json      |  3 --
 6 files changed, 40 insertions(+), 32 deletions(-)

diff --git a/x-pack/plugins/infra/server/lib/alerting/common/messages.ts b/x-pack/plugins/infra/server/lib/alerting/common/messages.ts
index 084043f357bb1..23c89abf4a7aa 100644
--- a/x-pack/plugins/infra/server/lib/alerting/common/messages.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/common/messages.ts
@@ -109,15 +109,17 @@ const thresholdToI18n = ([a, b]: Array<number | string>) => {
 };
 
 export const buildFiredAlertReason: (alertResult: {
+  group: string;
   metric: string;
   comparator: Comparator;
   threshold: Array<number | string>;
   currentValue: number | string;
-}) => string = ({ metric, comparator, threshold, currentValue }) =>
+}) => string = ({ group, metric, comparator, threshold, currentValue }) =>
   i18n.translate('xpack.infra.metrics.alerting.threshold.firedAlertReason', {
     defaultMessage:
-      '{metric} is {comparator} a threshold of {threshold} (current value is {currentValue})',
+      '{metric} is {comparator} a threshold of {threshold} (current value is {currentValue}) for {group}',
     values: {
+      group,
       metric,
       comparator: comparatorToI18n(comparator, threshold.map(toNumber), toNumber(currentValue)),
       threshold: thresholdToI18n(threshold),
@@ -126,14 +128,15 @@ export const buildFiredAlertReason: (alertResult: {
   });
 
 export const buildRecoveredAlertReason: (alertResult: {
+  group: string;
   metric: string;
   comparator: Comparator;
   threshold: Array<number | string>;
   currentValue: number | string;
-}) => string = ({ metric, comparator, threshold, currentValue }) =>
+}) => string = ({ group, metric, comparator, threshold, currentValue }) =>
   i18n.translate('xpack.infra.metrics.alerting.threshold.recoveredAlertReason', {
     defaultMessage:
-      '{metric} is now {comparator} a threshold of {threshold} (current value is {currentValue})',
+      '{metric} is now {comparator} a threshold of {threshold} (current value is {currentValue}) for {group}',
     values: {
       metric,
       comparator: recoveredComparatorToI18n(
@@ -143,19 +146,22 @@ export const buildRecoveredAlertReason: (alertResult: {
       ),
       threshold: thresholdToI18n(threshold),
       currentValue,
+      group,
     },
   });
 
 export const buildNoDataAlertReason: (alertResult: {
+  group: string;
   metric: string;
   timeSize: number;
   timeUnit: string;
-}) => string = ({ metric, timeSize, timeUnit }) =>
+}) => string = ({ group, metric, timeSize, timeUnit }) =>
   i18n.translate('xpack.infra.metrics.alerting.threshold.noDataAlertReason', {
-    defaultMessage: '{metric} has reported no data over the past {interval}',
+    defaultMessage: '{metric} has reported no data over the past {interval} for {group}',
     values: {
       metric,
       interval: `${timeSize}${timeUnit}`,
+      group,
     },
   });
 
diff --git a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
index 72d9ea9e39def..d8b66b35c703b 100644
--- a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
@@ -111,18 +111,18 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
       )
     );
     const inventoryItems = Object.keys(first(results)!);
-    for (const item of inventoryItems) {
+    for (const group of inventoryItems) {
       // AND logic; all criteria must be across the threshold
       const shouldAlertFire = results.every((result) => {
         // Grab the result of the most recent bucket
-        return last(result[item].shouldFire);
+        return last(result[group].shouldFire);
       });
-      const shouldAlertWarn = results.every((result) => last(result[item].shouldWarn));
+      const shouldAlertWarn = results.every((result) => last(result[group].shouldWarn));
 
       // AND logic; because we need to evaluate all criteria, if one of them reports no data then the
       // whole alert is in a No Data/Error state
-      const isNoData = results.some((result) => last(result[item].isNoData));
-      const isError = results.some((result) => result[item].isError);
+      const isNoData = results.some((result) => last(result[group].isNoData));
+      const isError = results.some((result) => result[group].isError);
 
       const nextState = isError
         ? AlertStates.ERROR
@@ -138,7 +138,8 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
         reason = results
           .map((result) =>
             buildReasonWithVerboseMetricName(
-              result[item],
+              group,
+              result[group],
               buildFiredAlertReason,
               nextState === AlertStates.WARNING
             )
@@ -151,19 +152,23 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
          */
         // } else if (nextState === AlertStates.OK && prevState?.alertState === AlertStates.ALERT) {
         // reason = results
-        //   .map((result) => buildReasonWithVerboseMetricName(result[item], buildRecoveredAlertReason))
+        //   .map((result) => buildReasonWithVerboseMetricName(group, result[group], buildRecoveredAlertReason))
         //   .join('\n');
       }
       if (alertOnNoData) {
         if (nextState === AlertStates.NO_DATA) {
           reason = results
-            .filter((result) => result[item].isNoData)
-            .map((result) => buildReasonWithVerboseMetricName(result[item], buildNoDataAlertReason))
+            .filter((result) => result[group].isNoData)
+            .map((result) =>
+              buildReasonWithVerboseMetricName(group, result[group], buildNoDataAlertReason)
+            )
             .join('\n');
         } else if (nextState === AlertStates.ERROR) {
           reason = results
-            .filter((result) => result[item].isError)
-            .map((result) => buildReasonWithVerboseMetricName(result[item], buildErrorAlertReason))
+            .filter((result) => result[group].isError)
+            .map((result) =>
+              buildReasonWithVerboseMetricName(group, result[group], buildErrorAlertReason)
+            )
             .join('\n');
         }
       }
@@ -175,7 +180,7 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
             ? WARNING_ACTIONS.id
             : FIRED_ACTIONS.id;
 
-        const alertInstance = alertInstanceFactory(`${item}`, reason);
+        const alertInstance = alertInstanceFactory(`${group}`, reason);
         alertInstance.scheduleActions(
           /**
            * TODO: We're lying to the compiler here as explicitly  calling `scheduleActions` on
@@ -183,12 +188,12 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
            */
           actionGroupId as unknown as InventoryMetricThresholdAllowedActionGroups,
           {
-            group: item,
+            group,
             alertState: stateToAlertMessage[nextState],
             reason,
             timestamp: moment().toISOString(),
             value: mapToConditionsLookup(results, (result) =>
-              formatMetric(result[item].metric, result[item].currentValue)
+              formatMetric(result[group].metric, result[group].currentValue)
             ),
             threshold: mapToConditionsLookup(criteria, (c) => c.threshold),
             metric: mapToConditionsLookup(criteria, (c) => c.metric),
@@ -199,6 +204,7 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
   });
 
 const buildReasonWithVerboseMetricName = (
+  group: string,
   resultItem: any,
   buildReason: (r: any) => string,
   useWarningThreshold?: boolean
@@ -206,6 +212,7 @@ const buildReasonWithVerboseMetricName = (
   if (!resultItem) return '';
   const resultWithVerboseMetricName = {
     ...resultItem,
+    group,
     metric:
       toMetricOpt(resultItem.metric)?.text ||
       (resultItem.metric === 'custom'
diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/reason_formatters.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/reason_formatters.ts
index cd579b9965b66..f70e0a0140ce8 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/reason_formatters.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/reason_formatters.ts
@@ -34,7 +34,7 @@ export const getReasonMessageForGroupedCountAlert = (
 ) =>
   i18n.translate('xpack.infra.logs.alerting.threshold.groupedCountAlertReasonDescription', {
     defaultMessage:
-      '{groupName}: {actualCount, plural, one {{actualCount} log entry} other {{actualCount} log entries} } ({translatedComparator} {expectedCount}) match the conditions.',
+      '{actualCount, plural, one {{actualCount} log entry} other {{actualCount} log entries} } ({translatedComparator} {expectedCount}) match the conditions for {groupName}.',
     values: {
       actualCount,
       expectedCount,
@@ -66,7 +66,7 @@ export const getReasonMessageForGroupedRatioAlert = (
 ) =>
   i18n.translate('xpack.infra.logs.alerting.threshold.groupedRatioAlertReasonDescription', {
     defaultMessage:
-      '{groupName}: The log entries ratio is {actualRatio} ({translatedComparator} {expectedRatio}).',
+      'The log entries ratio is {actualRatio} ({translatedComparator} {expectedRatio}) for {groupName}.',
     values: {
       actualRatio,
       expectedRatio,
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index af5f945eeb4bb..e4887e922bb66 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -143,9 +143,10 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
       if (nextState === AlertStates.ALERT || nextState === AlertStates.WARNING) {
         reason = alertResults
           .map((result) =>
-            buildFiredAlertReason(
-              formatAlertResult(result[group], nextState === AlertStates.WARNING)
-            )
+            buildFiredAlertReason({
+              ...formatAlertResult(result[group], nextState === AlertStates.WARNING),
+              group,
+            })
           )
           .join('\n');
         /*
@@ -181,7 +182,7 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
         if (nextState === AlertStates.NO_DATA) {
           reason = alertResults
             .filter((result) => result[group].isNoData)
-            .map((result) => buildNoDataAlertReason(result[group]))
+            .map((result) => buildNoDataAlertReason({ ...result[group], group }))
             .join('\n');
         } else if (nextState === AlertStates.ERROR) {
           reason = alertResults
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 95f6909b12f6c..f86167046c4c2 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -13580,15 +13580,12 @@
     "xpack.infra.metrics.alerting.threshold.errorAlertReason": "{metric}のデータのクエリを試行しているときに、Elasticsearchが失敗しました",
     "xpack.infra.metrics.alerting.threshold.errorState": "エラー",
     "xpack.infra.metrics.alerting.threshold.fired": "アラート",
-    "xpack.infra.metrics.alerting.threshold.firedAlertReason": "{metric}は{comparator} {threshold}のしきい値です（現在の値は{currentValue}）",
     "xpack.infra.metrics.alerting.threshold.gtComparator": "より大きい",
     "xpack.infra.metrics.alerting.threshold.ltComparator": "より小さい",
-    "xpack.infra.metrics.alerting.threshold.noDataAlertReason": "{metric}は過去{interval}にデータを報告していません",
     "xpack.infra.metrics.alerting.threshold.noDataFormattedValue": "[データなし]",
     "xpack.infra.metrics.alerting.threshold.noDataState": "データなし",
     "xpack.infra.metrics.alerting.threshold.okState": "OK [回復済み]",
     "xpack.infra.metrics.alerting.threshold.outsideRangeComparator": "の間にない",
-    "xpack.infra.metrics.alerting.threshold.recoveredAlertReason": "{metric}は{comparator} {threshold}のしきい値です（現在の値は{currentValue}）",
     "xpack.infra.metrics.alerting.threshold.thresholdRange": "{a}と{b}",
     "xpack.infra.metrics.alerting.threshold.warning": "警告",
     "xpack.infra.metrics.alerting.threshold.warningState": "警告",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 80dad5a2c0c8b..6cfdc69c9e897 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -13769,15 +13769,12 @@
     "xpack.infra.metrics.alerting.threshold.errorAlertReason": "Elasticsearch 尝试查询 {metric} 的数据时出现故障",
     "xpack.infra.metrics.alerting.threshold.errorState": "错误",
     "xpack.infra.metrics.alerting.threshold.fired": "告警",
-    "xpack.infra.metrics.alerting.threshold.firedAlertReason": "{metric} {comparator}阈值 {threshold}（当前值为 {currentValue}）",
     "xpack.infra.metrics.alerting.threshold.gtComparator": "大于",
     "xpack.infra.metrics.alerting.threshold.ltComparator": "小于",
-    "xpack.infra.metrics.alerting.threshold.noDataAlertReason": "{metric} 在过去 {interval}中未报告数据",
     "xpack.infra.metrics.alerting.threshold.noDataFormattedValue": "[无数据]",
     "xpack.infra.metrics.alerting.threshold.noDataState": "无数据",
     "xpack.infra.metrics.alerting.threshold.okState": "正常 [已恢复]",
     "xpack.infra.metrics.alerting.threshold.outsideRangeComparator": "不介于",
-    "xpack.infra.metrics.alerting.threshold.recoveredAlertReason": "{metric} 现在{comparator}阈值 {threshold}（当前值为 {currentValue}）",
     "xpack.infra.metrics.alerting.threshold.thresholdRange": "{a} 和 {b}",
     "xpack.infra.metrics.alerting.threshold.warning": "警告",
     "xpack.infra.metrics.alerting.threshold.warningState": "警告",

From fe17761ae8f644df5f10af1275fe0640eff7e4a2 Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Tue, 19 Oct 2021 15:38:12 +0300
Subject: [PATCH 09/36] [VisEditors] Sets level for all registered deprecations
 (#115505)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 src/plugins/kibana_legacy/server/index.ts        |  5 ++++-
 src/plugins/vis_types/metric/server/index.ts     |  2 +-
 src/plugins/vis_types/table/server/index.ts      |  4 ++--
 src/plugins/vis_types/tagcloud/server/index.ts   |  2 +-
 src/plugins/vis_types/timelion/server/index.ts   | 15 ++++++++++-----
 src/plugins/vis_types/timeseries/server/index.ts |  8 +++++---
 src/plugins/vis_types/vega/server/index.ts       |  6 ++++--
 7 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/src/plugins/kibana_legacy/server/index.ts b/src/plugins/kibana_legacy/server/index.ts
index 15ae8547c73e1..3f731efbfe857 100644
--- a/src/plugins/kibana_legacy/server/index.ts
+++ b/src/plugins/kibana_legacy/server/index.ts
@@ -18,7 +18,10 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
   deprecations: ({ renameFromRoot }) => [
     // TODO: Remove deprecation once defaultAppId is deleted
-    renameFromRoot('kibana.defaultAppId', 'kibana_legacy.defaultAppId', { silent: true }),
+    renameFromRoot('kibana.defaultAppId', 'kibana_legacy.defaultAppId', {
+      silent: true,
+      level: 'critical',
+    }),
     (completeConfig, rootPath, addDeprecation) => {
       if (
         get(completeConfig, 'kibana.defaultAppId') === undefined &&
diff --git a/src/plugins/vis_types/metric/server/index.ts b/src/plugins/vis_types/metric/server/index.ts
index 740fe3426dd84..0b6768074d6cb 100644
--- a/src/plugins/vis_types/metric/server/index.ts
+++ b/src/plugins/vis_types/metric/server/index.ts
@@ -13,7 +13,7 @@ import { configSchema, ConfigSchema } from '../config';
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
   deprecations: ({ renameFromRoot }) => [
-    renameFromRoot('metric_vis.enabled', 'vis_type_metric.enabled'),
+    renameFromRoot('metric_vis.enabled', 'vis_type_metric.enabled', { level: 'critical' }),
   ],
 };
 
diff --git a/src/plugins/vis_types/table/server/index.ts b/src/plugins/vis_types/table/server/index.ts
index eed1134f3ff48..103586305139c 100644
--- a/src/plugins/vis_types/table/server/index.ts
+++ b/src/plugins/vis_types/table/server/index.ts
@@ -15,9 +15,9 @@ import { registerVisTypeTableUsageCollector } from './usage_collector';
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
   deprecations: ({ renameFromRoot, unused }) => [
-    renameFromRoot('table_vis.enabled', 'vis_type_table.enabled'),
+    renameFromRoot('table_vis.enabled', 'vis_type_table.enabled', { level: 'critical' }),
     // Unused property which should be removed after releasing Kibana v8.0:
-    unused('legacyVisEnabled'),
+    unused('legacyVisEnabled', { level: 'critical' }),
   ],
 };
 
diff --git a/src/plugins/vis_types/tagcloud/server/index.ts b/src/plugins/vis_types/tagcloud/server/index.ts
index 6899a333a8812..35c0a127c873f 100644
--- a/src/plugins/vis_types/tagcloud/server/index.ts
+++ b/src/plugins/vis_types/tagcloud/server/index.ts
@@ -13,7 +13,7 @@ import { configSchema, ConfigSchema } from '../config';
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
   deprecations: ({ renameFromRoot }) => [
-    renameFromRoot('tagcloud.enabled', 'vis_type_tagcloud.enabled'),
+    renameFromRoot('tagcloud.enabled', 'vis_type_tagcloud.enabled', { level: 'critical' }),
   ],
 };
 
diff --git a/src/plugins/vis_types/timelion/server/index.ts b/src/plugins/vis_types/timelion/server/index.ts
index ef7baf981de1a..b5985932188fb 100644
--- a/src/plugins/vis_types/timelion/server/index.ts
+++ b/src/plugins/vis_types/timelion/server/index.ts
@@ -13,12 +13,17 @@ import { TimelionPlugin } from './plugin';
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
   deprecations: ({ renameFromRoot, unused }) => [
-    renameFromRoot('timelion_vis.enabled', 'vis_type_timelion.enabled'),
-    renameFromRoot('timelion.enabled', 'vis_type_timelion.enabled'),
-    renameFromRoot('timelion.graphiteUrls', 'vis_type_timelion.graphiteUrls'),
+    renameFromRoot('timelion_vis.enabled', 'vis_type_timelion.enabled', { level: 'critical' }),
+    renameFromRoot('timelion.enabled', 'vis_type_timelion.enabled', { level: 'critical' }),
+    renameFromRoot('timelion.graphiteUrls', 'vis_type_timelion.graphiteUrls', {
+      level: 'critical',
+    }),
     // Unused properties which should be removed after releasing Kibana v8.0:
-    renameFromRoot('timelion.ui.enabled', 'vis_type_timelion.ui.enabled', { silent: true }),
-    unused('ui.enabled'),
+    renameFromRoot('timelion.ui.enabled', 'vis_type_timelion.ui.enabled', {
+      silent: true,
+      level: 'critical',
+    }),
+    unused('ui.enabled', { level: 'critical' }),
   ],
 };
 
diff --git a/src/plugins/vis_types/timeseries/server/index.ts b/src/plugins/vis_types/timeseries/server/index.ts
index 0890b37e77926..ff2e54b31084b 100644
--- a/src/plugins/vis_types/timeseries/server/index.ts
+++ b/src/plugins/vis_types/timeseries/server/index.ts
@@ -15,17 +15,19 @@ export { VisTypeTimeseriesSetup } from './plugin';
 export const config: PluginConfigDescriptor<VisTypeTimeseriesConfig> = {
   deprecations: ({ unused, renameFromRoot }) => [
     // In Kibana v7.8 plugin id was renamed from 'metrics' to 'vis_type_timeseries':
-    renameFromRoot('metrics.enabled', 'vis_type_timeseries.enabled'),
+    renameFromRoot('metrics.enabled', 'vis_type_timeseries.enabled', { level: 'critical' }),
     renameFromRoot('metrics.chartResolution', 'vis_type_timeseries.chartResolution', {
       silent: true,
+      level: 'critical',
     }),
     renameFromRoot('metrics.minimumBucketSize', 'vis_type_timeseries.minimumBucketSize', {
       silent: true,
+      level: 'critical',
     }),
 
     // Unused properties which should be removed after releasing Kibana v8.0:
-    unused('chartResolution'),
-    unused('minimumBucketSize'),
+    unused('chartResolution', { level: 'critical' }),
+    unused('minimumBucketSize', { level: 'critical' }),
   ],
   schema: configSchema,
 };
diff --git a/src/plugins/vis_types/vega/server/index.ts b/src/plugins/vis_types/vega/server/index.ts
index 156dec027372a..220d049c739ea 100644
--- a/src/plugins/vis_types/vega/server/index.ts
+++ b/src/plugins/vis_types/vega/server/index.ts
@@ -17,8 +17,10 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   },
   schema: configSchema,
   deprecations: ({ renameFromRoot }) => [
-    renameFromRoot('vega.enableExternalUrls', 'vis_type_vega.enableExternalUrls'),
-    renameFromRoot('vega.enabled', 'vis_type_vega.enabled'),
+    renameFromRoot('vega.enableExternalUrls', 'vis_type_vega.enableExternalUrls', {
+      level: 'critical',
+    }),
+    renameFromRoot('vega.enabled', 'vis_type_vega.enabled', { level: 'critical' }),
   ],
 };
 

From c2aae3be130cab8af34e088a07012f9861a5bfcb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20S=C3=A1nchez?= <davidsansol92@gmail.com>
Date: Tue, 19 Oct 2021 14:57:24 +0200
Subject: [PATCH 10/36] [7.x] [Security Solution][Endpoint] Adds additional
 endpoint privileges to the `useUserPrivileges()` hook (#115051) (#115511)

* [Security Solution][Endpoint] Adds additional endpoint privileges to the `useUserPrivileges()` hook (#115051)

* Adds new `canIsolateHost` and `canCreateArtifactsByPolicy` privileges for endpoint
* Refactor `useEndpointPrivileges` mocks to also provide a test function to return the full set of default privileges
* refactor useEndpointPrivileges tests to be more resilient to future changes
---
 .../__mocks__/use_endpoint_privileges.ts      | 18 ----
 .../__mocks__/use_endpoint_privileges.ts      | 12 +++
 .../user_privileges/endpoint/index.ts         |  9 ++
 .../user_privileges/endpoint/mocks.ts         | 29 ++++++
 .../use_endpoint_privileges.test.ts           | 89 ++++++++++---------
 .../{ => endpoint}/use_endpoint_privileges.ts | 25 ++++--
 .../user_privileges/endpoint/utils.ts         | 19 ++++
 .../components/user_privileges/index.tsx      | 10 +--
 .../components/user_info/index.test.tsx       |  2 +-
 .../alerts/use_alerts_privileges.test.tsx     |  6 +-
 .../alerts/use_signal_index.test.tsx          |  2 +-
 .../search_exceptions.test.tsx                | 17 ++--
 .../search_exceptions/search_exceptions.tsx   |  2 +-
 .../view/event_filters_list_page.test.tsx     |  2 +-
 .../host_isolation_exceptions_list.test.tsx   |  3 +-
 .../policy_trusted_apps_empty_unassigned.tsx  |  2 +-
 .../policy_trusted_apps_flyout.test.tsx       |  2 +-
 .../policy_trusted_apps_layout.test.tsx       | 22 ++---
 .../layout/policy_trusted_apps_layout.tsx     |  2 +-
 .../list/policy_trusted_apps_list.test.tsx    | 10 +--
 .../list/policy_trusted_apps_list.tsx         |  2 +-
 .../view/trusted_apps_page.test.tsx           |  2 +-
 .../public/overview/pages/overview.test.tsx   |  2 +-
 23 files changed, 170 insertions(+), 119 deletions(-)
 delete mode 100644 x-pack/plugins/security_solution/public/common/components/user_privileges/__mocks__/use_endpoint_privileges.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/__mocks__/use_endpoint_privileges.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/index.ts
 create mode 100644 x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/mocks.ts
 rename x-pack/plugins/security_solution/public/common/components/user_privileges/{ => endpoint}/use_endpoint_privileges.test.ts (63%)
 rename x-pack/plugins/security_solution/public/common/components/user_privileges/{ => endpoint}/use_endpoint_privileges.ts (71%)
 create mode 100644 x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/utils.ts

diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/__mocks__/use_endpoint_privileges.ts b/x-pack/plugins/security_solution/public/common/components/user_privileges/__mocks__/use_endpoint_privileges.ts
deleted file mode 100644
index 80ca534534187..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/user_privileges/__mocks__/use_endpoint_privileges.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EndpointPrivileges } from '../use_endpoint_privileges';
-
-export const useEndpointPrivileges = jest.fn(() => {
-  const endpointPrivilegesMock: EndpointPrivileges = {
-    loading: false,
-    canAccessFleet: true,
-    canAccessEndpointManagement: true,
-    isPlatinumPlus: true,
-  };
-  return endpointPrivilegesMock;
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/__mocks__/use_endpoint_privileges.ts b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/__mocks__/use_endpoint_privileges.ts
new file mode 100644
index 0000000000000..ae9aacaf3d55b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/__mocks__/use_endpoint_privileges.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getEndpointPrivilegesInitialStateMock } from '../mocks';
+
+export { getEndpointPrivilegesInitialState } from '../utils';
+
+export const useEndpointPrivileges = jest.fn(getEndpointPrivilegesInitialStateMock);
diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/index.ts b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/index.ts
new file mode 100644
index 0000000000000..adea89ce1a051
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './use_endpoint_privileges';
+export { getEndpointPrivilegesInitialState } from './utils';
diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/mocks.ts b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/mocks.ts
new file mode 100644
index 0000000000000..2851c92816cea
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/mocks.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EndpointPrivileges } from './use_endpoint_privileges';
+import { getEndpointPrivilegesInitialState } from './utils';
+
+export const getEndpointPrivilegesInitialStateMock = (
+  overrides: Partial<EndpointPrivileges> = {}
+): EndpointPrivileges => {
+  // Get the initial state and set all permissions to `true` (enabled) for testing
+  const endpointPrivilegesMock: EndpointPrivileges = {
+    ...(
+      Object.entries(getEndpointPrivilegesInitialState()) as Array<
+        [keyof EndpointPrivileges, boolean]
+      >
+    ).reduce((mockPrivileges, [key, value]) => {
+      mockPrivileges[key] = !value;
+
+      return mockPrivileges;
+    }, {} as EndpointPrivileges),
+    ...overrides,
+  };
+
+  return endpointPrivilegesMock;
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/use_endpoint_privileges.test.ts b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.test.ts
similarity index 63%
rename from x-pack/plugins/security_solution/public/common/components/user_privileges/use_endpoint_privileges.test.ts
rename to x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.test.ts
index 82443e913499b..d4ba29a4ef950 100644
--- a/x-pack/plugins/security_solution/public/common/components/user_privileges/use_endpoint_privileges.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.test.ts
@@ -6,16 +6,17 @@
  */
 
 import { act, renderHook, RenderHookResult, RenderResult } from '@testing-library/react-hooks';
-import { useHttp, useCurrentUser } from '../../lib/kibana';
+import { useHttp, useCurrentUser } from '../../../lib/kibana';
 import { EndpointPrivileges, useEndpointPrivileges } from './use_endpoint_privileges';
-import { securityMock } from '../../../../../security/public/mocks';
-import { appRoutesService } from '../../../../../fleet/common';
-import { AuthenticatedUser } from '../../../../../security/common';
-import { licenseService } from '../../hooks/use_license';
-import { fleetGetCheckPermissionsHttpMock } from '../../../management/pages/mocks';
-
-jest.mock('../../lib/kibana');
-jest.mock('../../hooks/use_license', () => {
+import { securityMock } from '../../../../../../security/public/mocks';
+import { appRoutesService } from '../../../../../../fleet/common';
+import { AuthenticatedUser } from '../../../../../../security/common';
+import { licenseService } from '../../../hooks/use_license';
+import { fleetGetCheckPermissionsHttpMock } from '../../../../management/pages/mocks';
+import { getEndpointPrivilegesInitialStateMock } from './mocks';
+
+jest.mock('../../../lib/kibana');
+jest.mock('../../../hooks/use_license', () => {
   const licenseServiceInstance = {
     isPlatinumPlus: jest.fn(),
   };
@@ -27,6 +28,8 @@ jest.mock('../../hooks/use_license', () => {
   };
 });
 
+const licenseServiceMock = licenseService as jest.Mocked<typeof licenseService>;
+
 describe('When using useEndpointPrivileges hook', () => {
   let authenticatedUser: AuthenticatedUser;
   let fleetApiMock: ReturnType<typeof fleetGetCheckPermissionsHttpMock>;
@@ -45,7 +48,7 @@ describe('When using useEndpointPrivileges hook', () => {
     fleetApiMock = fleetGetCheckPermissionsHttpMock(
       useHttp() as Parameters<typeof fleetGetCheckPermissionsHttpMock>[0]
     );
-    (licenseService.isPlatinumPlus as jest.Mock).mockReturnValue(true);
+    licenseServiceMock.isPlatinumPlus.mockReturnValue(true);
 
     render = () => {
       const hookRenderResponse = renderHook(() => useEndpointPrivileges());
@@ -69,34 +72,31 @@ describe('When using useEndpointPrivileges hook', () => {
     (useCurrentUser as jest.Mock).mockReturnValue(null);
 
     const { rerender } = render();
-    expect(result.current).toEqual({
-      canAccessEndpointManagement: false,
-      canAccessFleet: false,
-      loading: true,
-      isPlatinumPlus: true,
-    });
+    expect(result.current).toEqual(
+      getEndpointPrivilegesInitialStateMock({
+        canAccessEndpointManagement: false,
+        canAccessFleet: false,
+        loading: true,
+      })
+    );
 
     // Make user service available
     (useCurrentUser as jest.Mock).mockReturnValue(authenticatedUser);
     rerender();
-    expect(result.current).toEqual({
-      canAccessEndpointManagement: false,
-      canAccessFleet: false,
-      loading: true,
-      isPlatinumPlus: true,
-    });
+    expect(result.current).toEqual(
+      getEndpointPrivilegesInitialStateMock({
+        canAccessEndpointManagement: false,
+        canAccessFleet: false,
+        loading: true,
+      })
+    );
 
     // Release the API response
     await act(async () => {
       fleetApiMock.waitForApi();
       releaseApiResponse!();
     });
-    expect(result.current).toEqual({
-      canAccessEndpointManagement: true,
-      canAccessFleet: true,
-      loading: false,
-      isPlatinumPlus: true,
-    });
+    expect(result.current).toEqual(getEndpointPrivilegesInitialStateMock());
   });
 
   it('should call Fleet permissions api to determine user privilege to fleet', async () => {
@@ -113,12 +113,11 @@ describe('When using useEndpointPrivileges hook', () => {
     render();
     await waitForNextUpdate();
     await fleetApiMock.waitForApi();
-    expect(result.current).toEqual({
-      canAccessEndpointManagement: false,
-      canAccessFleet: true, // this is only true here because I did not adjust the API mock
-      loading: false,
-      isPlatinumPlus: true,
-    });
+    expect(result.current).toEqual(
+      getEndpointPrivilegesInitialStateMock({
+        canAccessEndpointManagement: false,
+      })
+    );
   });
 
   it('should set privileges to false if fleet api check returns failure', async () => {
@@ -130,11 +129,21 @@ describe('When using useEndpointPrivileges hook', () => {
     render();
     await waitForNextUpdate();
     await fleetApiMock.waitForApi();
-    expect(result.current).toEqual({
-      canAccessEndpointManagement: false,
-      canAccessFleet: false,
-      loading: false,
-      isPlatinumPlus: true,
-    });
+    expect(result.current).toEqual(
+      getEndpointPrivilegesInitialStateMock({
+        canAccessEndpointManagement: false,
+        canAccessFleet: false,
+      })
+    );
   });
+
+  it.each([['canIsolateHost'], ['canCreateArtifactsByPolicy']])(
+    'should set %s to false if license is not PlatinumPlus',
+    async (privilege) => {
+      licenseServiceMock.isPlatinumPlus.mockReturnValue(false);
+      render();
+      await waitForNextUpdate();
+      expect(result.current).toEqual(expect.objectContaining({ [privilege]: false }));
+    }
+  );
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/use_endpoint_privileges.ts b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts
similarity index 71%
rename from x-pack/plugins/security_solution/public/common/components/user_privileges/use_endpoint_privileges.ts
rename to x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts
index 315935104d107..36f02d22487fc 100644
--- a/x-pack/plugins/security_solution/public/common/components/user_privileges/use_endpoint_privileges.ts
+++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.ts
@@ -6,9 +6,9 @@
  */
 
 import { useEffect, useMemo, useRef, useState } from 'react';
-import { useCurrentUser, useHttp } from '../../lib/kibana';
-import { appRoutesService, CheckPermissionsResponse } from '../../../../../fleet/common';
-import { useLicense } from '../../hooks/use_license';
+import { useCurrentUser, useHttp } from '../../../lib/kibana';
+import { appRoutesService, CheckPermissionsResponse } from '../../../../../../fleet/common';
+import { useLicense } from '../../../hooks/use_license';
 
 export interface EndpointPrivileges {
   loading: boolean;
@@ -16,6 +16,11 @@ export interface EndpointPrivileges {
   canAccessFleet: boolean;
   /** If user has permissions to access Endpoint management (includes check to ensure they also have access to fleet) */
   canAccessEndpointManagement: boolean;
+  /** if user has permissions to create Artifacts by Policy */
+  canCreateArtifactsByPolicy: boolean;
+  /** If user has permissions to use the Host isolation feature */
+  canIsolateHost: boolean;
+  /** @deprecated do not use. instead, use one of the other privileges defined */
   isPlatinumPlus: boolean;
 }
 
@@ -29,7 +34,7 @@ export const useEndpointPrivileges = (): EndpointPrivileges => {
   const http = useHttp();
   const user = useCurrentUser();
   const isMounted = useRef<boolean>(true);
-  const license = useLicense();
+  const isPlatinumPlusLicense = useLicense().isPlatinumPlus();
   const [canAccessFleet, setCanAccessFleet] = useState<boolean>(false);
   const [fleetCheckDone, setFleetCheckDone] = useState<boolean>(false);
 
@@ -61,13 +66,19 @@ export const useEndpointPrivileges = (): EndpointPrivileges => {
   }, [user?.roles]);
 
   const privileges = useMemo(() => {
-    return {
+    const privilegeList: EndpointPrivileges = {
       loading: !fleetCheckDone || !user,
       canAccessFleet,
       canAccessEndpointManagement: canAccessFleet && isSuperUser,
-      isPlatinumPlus: license.isPlatinumPlus(),
+      canCreateArtifactsByPolicy: isPlatinumPlusLicense,
+      canIsolateHost: isPlatinumPlusLicense,
+      // FIXME: Remove usages of the property below
+      /** @deprecated */
+      isPlatinumPlus: isPlatinumPlusLicense,
     };
-  }, [canAccessFleet, fleetCheckDone, isSuperUser, user, license]);
+
+    return privilegeList;
+  }, [canAccessFleet, fleetCheckDone, isSuperUser, user, isPlatinumPlusLicense]);
 
   // Capture if component is unmounted
   useEffect(
diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/utils.ts b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/utils.ts
new file mode 100644
index 0000000000000..df91314479f18
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/utils.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EndpointPrivileges } from './use_endpoint_privileges';
+
+export const getEndpointPrivilegesInitialState = (): EndpointPrivileges => {
+  return {
+    loading: true,
+    canAccessFleet: false,
+    canAccessEndpointManagement: false,
+    canIsolateHost: false,
+    canCreateArtifactsByPolicy: false,
+    isPlatinumPlus: false,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/user_privileges/index.tsx b/x-pack/plugins/security_solution/public/common/components/user_privileges/index.tsx
index 437d27278102b..bc0640296b33d 100644
--- a/x-pack/plugins/security_solution/public/common/components/user_privileges/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/user_privileges/index.tsx
@@ -11,9 +11,10 @@ import { DeepReadonly } from 'utility-types';
 import { Capabilities } from '../../../../../../../src/core/public';
 import { useFetchDetectionEnginePrivileges } from '../../../detections/components/user_privileges/use_fetch_detection_engine_privileges';
 import { useFetchListPrivileges } from '../../../detections/components/user_privileges/use_fetch_list_privileges';
-import { EndpointPrivileges, useEndpointPrivileges } from './use_endpoint_privileges';
+import { EndpointPrivileges, useEndpointPrivileges } from './endpoint';
 
 import { SERVER_APP_ID } from '../../../../common/constants';
+import { getEndpointPrivilegesInitialState } from './endpoint/utils';
 export interface UserPrivilegesState {
   listPrivileges: ReturnType<typeof useFetchListPrivileges>;
   detectionEnginePrivileges: ReturnType<typeof useFetchDetectionEnginePrivileges>;
@@ -24,12 +25,7 @@ export interface UserPrivilegesState {
 export const initialUserPrivilegesState = (): UserPrivilegesState => ({
   listPrivileges: { loading: false, error: undefined, result: undefined },
   detectionEnginePrivileges: { loading: false, error: undefined, result: undefined },
-  endpointPrivileges: {
-    loading: true,
-    canAccessEndpointManagement: false,
-    canAccessFleet: false,
-    isPlatinumPlus: false,
-  },
+  endpointPrivileges: getEndpointPrivilegesInitialState(),
   kibanaSecuritySolutionsPrivileges: { crud: false, read: false },
 });
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/user_info/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/user_info/index.test.tsx
index 3d95dca81165e..1a8588017e4d6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/user_info/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/user_info/index.test.tsx
@@ -17,7 +17,7 @@ import { UserPrivilegesProvider } from '../../../common/components/user_privileg
 
 jest.mock('../../../common/lib/kibana');
 jest.mock('../../containers/detection_engine/alerts/api');
-jest.mock('../../../common/components/user_privileges/use_endpoint_privileges');
+jest.mock('../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 
 describe('useUserInfo', () => {
   beforeAll(() => {
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_alerts_privileges.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_alerts_privileges.test.tsx
index 40894c1d01929..1dc1423606097 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_alerts_privileges.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_alerts_privileges.test.tsx
@@ -12,6 +12,7 @@ import { useAppToastsMock } from '../../../../common/hooks/use_app_toasts.mock';
 import { useUserPrivileges } from '../../../../common/components/user_privileges';
 import { Privilege } from './types';
 import { UseAlertsPrivelegesReturn, useAlertsPrivileges } from './use_alerts_privileges';
+import { getEndpointPrivilegesInitialStateMock } from '../../../../common/components/user_privileges/endpoint/mocks';
 
 jest.mock('./api');
 jest.mock('../../../../common/hooks/use_app_toasts');
@@ -86,12 +87,11 @@ const userPrivilegesInitial: ReturnType<typeof useUserPrivileges> = {
     result: undefined,
     error: undefined,
   },
-  endpointPrivileges: {
+  endpointPrivileges: getEndpointPrivilegesInitialStateMock({
     loading: true,
     canAccessEndpointManagement: false,
     canAccessFleet: false,
-    isPlatinumPlus: true,
-  },
+  }),
   kibanaSecuritySolutionsPrivileges: { crud: true, read: true },
 };
 
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
index ade83fed4fd6b..ad4ad5062c9d5 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_signal_index.test.tsx
@@ -13,7 +13,7 @@ import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
 
 jest.mock('./api');
 jest.mock('../../../../common/hooks/use_app_toasts');
-jest.mock('../../../../common/components/user_privileges/use_endpoint_privileges');
+jest.mock('../../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 
 describe('useSignalIndex', () => {
   let appToastsMock: jest.Mocked<ReturnType<typeof useAppToastsMock.create>>;
diff --git a/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
index 084978d35d03a..3b987a7211411 100644
--- a/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
@@ -11,11 +11,12 @@ import { AppContextTestRender, createAppRootMockRenderer } from '../../../common
 import {
   EndpointPrivileges,
   useEndpointPrivileges,
-} from '../../../common/components/user_privileges/use_endpoint_privileges';
+} from '../../../common/components/user_privileges/endpoint/use_endpoint_privileges';
 import { EndpointDocGenerator } from '../../../../common/endpoint/generate_data';
 
 import { SearchExceptions, SearchExceptionsProps } from '.';
-jest.mock('../../../common/components/user_privileges/use_endpoint_privileges');
+import { getEndpointPrivilegesInitialStateMock } from '../../../common/components/user_privileges/endpoint/mocks';
+jest.mock('../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 
 let onSearchMock: jest.Mock;
 const mockUseEndpointPrivileges = useEndpointPrivileges as jest.Mock;
@@ -29,13 +30,11 @@ describe('Search exceptions', () => {
 
   const loadedUserEndpointPrivilegesState = (
     endpointOverrides: Partial<EndpointPrivileges> = {}
-  ): EndpointPrivileges => ({
-    loading: false,
-    canAccessFleet: true,
-    canAccessEndpointManagement: true,
-    isPlatinumPlus: false,
-    ...endpointOverrides,
-  });
+  ): EndpointPrivileges =>
+    getEndpointPrivilegesInitialStateMock({
+      isPlatinumPlus: false,
+      ...endpointOverrides,
+    });
 
   beforeEach(() => {
     onSearchMock = jest.fn();
diff --git a/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.tsx b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.tsx
index 1f3eab5db2947..569916ac20315 100644
--- a/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.tsx
@@ -10,7 +10,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiFieldSearch, EuiButton } from '@elastic/e
 import { i18n } from '@kbn/i18n';
 import { PolicySelectionItem, PoliciesSelector } from '../policies_selector';
 import { ImmutableArray, PolicyData } from '../../../../common/endpoint/types';
-import { useEndpointPrivileges } from '../../../common/components/user_privileges/use_endpoint_privileges';
+import { useEndpointPrivileges } from '../../../common/components/user_privileges/endpoint/use_endpoint_privileges';
 
 export interface SearchExceptionsProps {
   defaultValue?: string;
diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx
index 0729f95bb44a9..02efce1ab59e8 100644
--- a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx
@@ -14,7 +14,7 @@ import { isFailedResourceState, isLoadedResourceState } from '../../../state';
 
 // Needed to mock the data services used by the ExceptionItem component
 jest.mock('../../../../common/lib/kibana');
-jest.mock('../../../../common/components/user_privileges/use_endpoint_privileges');
+jest.mock('../../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 
 describe('When on the Event Filters List Page', () => {
   let render: () => ReturnType<AppContextTestRender['render']>;
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx
index 5113457e5bccc..625da11a3644e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx
@@ -16,8 +16,7 @@ import { getHostIsolationExceptionItems } from '../service';
 import { HostIsolationExceptionsList } from './host_isolation_exceptions_list';
 import { useLicense } from '../../../../common/hooks/use_license';
 
-jest.mock('../../../../common/components/user_privileges/use_endpoint_privileges');
-
+jest.mock('../../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 jest.mock('../service');
 jest.mock('../../../../common/hooks/use_license');
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/empty/policy_trusted_apps_empty_unassigned.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/empty/policy_trusted_apps_empty_unassigned.tsx
index ee52e1210a481..c12bec03ada04 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/empty/policy_trusted_apps_empty_unassigned.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/empty/policy_trusted_apps_empty_unassigned.tsx
@@ -10,7 +10,7 @@ import { EuiEmptyPrompt, EuiButton, EuiPageTemplate, EuiLink } from '@elastic/eu
 import { FormattedMessage } from '@kbn/i18n/react';
 import { usePolicyDetailsNavigateCallback } from '../../policy_hooks';
 import { useGetLinkTo } from './use_policy_trusted_apps_empty_hooks';
-import { useEndpointPrivileges } from '../../../../../../common/components/user_privileges/use_endpoint_privileges';
+import { useEndpointPrivileges } from '../../../../../../common/components/user_privileges/endpoint/use_endpoint_privileges';
 
 interface CommonProps {
   policyId: string;
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx
index c1d00f7a3f99b..8e412d2020b72 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/flyout/policy_trusted_apps_flyout.test.tsx
@@ -21,7 +21,7 @@ import { createLoadedResourceState, isLoadedResourceState } from '../../../../..
 import { getPolicyDetailsArtifactsListPath } from '../../../../../common/routing';
 
 jest.mock('../../../../trusted_apps/service');
-jest.mock('../../../../../../common/components/user_privileges/use_endpoint_privileges');
+jest.mock('../../../../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 
 let mockedContext: AppContextTestRender;
 let waitForAction: MiddlewareActionSpyHelper['waitForAction'];
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.test.tsx
index 43e19c00bcc8e..dbb18a1b0f2ef 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.test.tsx
@@ -19,13 +19,11 @@ import { createLoadedResourceState, isLoadedResourceState } from '../../../../..
 import { getPolicyDetailsArtifactsListPath } from '../../../../../common/routing';
 import { EndpointDocGenerator } from '../../../../../../../common/endpoint/generate_data';
 import { policyListApiPathHandlers } from '../../../store/test_mock_utils';
-import {
-  EndpointPrivileges,
-  useEndpointPrivileges,
-} from '../../../../../../common/components/user_privileges/use_endpoint_privileges';
+import { useEndpointPrivileges } from '../../../../../../common/components/user_privileges/endpoint/use_endpoint_privileges';
+import { getEndpointPrivilegesInitialStateMock } from '../../../../../../common/components/user_privileges/endpoint/mocks';
 
 jest.mock('../../../../trusted_apps/service');
-jest.mock('../../../../../../common/components/user_privileges/use_endpoint_privileges');
+jest.mock('../../../../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 const mockUseEndpointPrivileges = useEndpointPrivileges as jest.Mock;
 
 let mockedContext: AppContextTestRender;
@@ -37,16 +35,6 @@ let http: typeof coreStart.http;
 const generator = new EndpointDocGenerator();
 
 describe('Policy trusted apps layout', () => {
-  const loadedUserEndpointPrivilegesState = (
-    endpointOverrides: Partial<EndpointPrivileges> = {}
-  ): EndpointPrivileges => ({
-    loading: false,
-    canAccessFleet: true,
-    canAccessEndpointManagement: true,
-    isPlatinumPlus: true,
-    ...endpointOverrides,
-  });
-
   beforeEach(() => {
     mockedContext = createAppRootMockRenderer();
     http = mockedContext.coreStart.http;
@@ -137,7 +125,7 @@ describe('Policy trusted apps layout', () => {
 
   it('should hide assign button on empty state with unassigned policies when downgraded to a gold or below license', async () => {
     mockUseEndpointPrivileges.mockReturnValue(
-      loadedUserEndpointPrivilegesState({
+      getEndpointPrivilegesInitialStateMock({
         isPlatinumPlus: false,
       })
     );
@@ -155,7 +143,7 @@ describe('Policy trusted apps layout', () => {
 
   it('should hide the `Assign trusted applications` button when there is data and the license is downgraded to gold or below', async () => {
     mockUseEndpointPrivileges.mockReturnValue(
-      loadedUserEndpointPrivilegesState({
+      getEndpointPrivilegesInitialStateMock({
         isPlatinumPlus: false,
       })
     );
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.tsx
index a3f1ed215286a..49f76ad2e02c6 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/layout/policy_trusted_apps_layout.tsx
@@ -30,7 +30,7 @@ import {
 import { usePolicyDetailsNavigateCallback, usePolicyDetailsSelector } from '../../policy_hooks';
 import { PolicyTrustedAppsFlyout } from '../flyout';
 import { PolicyTrustedAppsList } from '../list/policy_trusted_apps_list';
-import { useEndpointPrivileges } from '../../../../../../common/components/user_privileges/use_endpoint_privileges';
+import { useEndpointPrivileges } from '../../../../../../common/components/user_privileges/endpoint/use_endpoint_privileges';
 import { useAppUrl } from '../../../../../../common/lib/kibana';
 import { APP_ID } from '../../../../../../../common/constants';
 import { getTrustedAppsListPath } from '../../../../../common/routing';
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
index b5bfc16db2899..9165aec3bef8d 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.test.tsx
@@ -24,9 +24,10 @@ import { APP_ID } from '../../../../../../../common/constants';
 import {
   EndpointPrivileges,
   useEndpointPrivileges,
-} from '../../../../../../common/components/user_privileges/use_endpoint_privileges';
+} from '../../../../../../common/components/user_privileges/endpoint/use_endpoint_privileges';
+import { getEndpointPrivilegesInitialStateMock } from '../../../../../../common/components/user_privileges/endpoint/mocks';
 
-jest.mock('../../../../../../common/components/user_privileges/use_endpoint_privileges');
+jest.mock('../../../../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 const mockUseEndpointPrivileges = useEndpointPrivileges as jest.Mock;
 
 describe('when rendering the PolicyTrustedAppsList', () => {
@@ -43,10 +44,7 @@ describe('when rendering the PolicyTrustedAppsList', () => {
   const loadedUserEndpointPrivilegesState = (
     endpointOverrides: Partial<EndpointPrivileges> = {}
   ): EndpointPrivileges => ({
-    loading: false,
-    canAccessFleet: true,
-    canAccessEndpointManagement: true,
-    isPlatinumPlus: true,
+    ...getEndpointPrivilegesInitialStateMock(),
     ...endpointOverrides,
   });
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
index 7b1f8753831c8..89ff6bd099be4 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/trusted_apps/list/policy_trusted_apps_list.tsx
@@ -38,7 +38,7 @@ import { ContextMenuItemNavByRouterProps } from '../../../../../components/conte
 import { ArtifactEntryCollapsibleCardProps } from '../../../../../components/artifact_entry_card';
 import { useTestIdGenerator } from '../../../../../components/hooks/use_test_id_generator';
 import { RemoveTrustedAppFromPolicyModal } from './remove_trusted_app_from_policy_modal';
-import { useEndpointPrivileges } from '../../../../../../common/components/user_privileges/use_endpoint_privileges';
+import { useEndpointPrivileges } from '../../../../../../common/components/user_privileges/endpoint/use_endpoint_privileges';
 
 const DATA_TEST_SUBJ = 'policyTrustedAppsGrid';
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
index f39fd47c78771..b4366a8922927 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
@@ -52,7 +52,7 @@ jest.mock('../../../../common/hooks/use_license', () => {
   };
 });
 
-jest.mock('../../../../common/components/user_privileges/use_endpoint_privileges');
+jest.mock('../../../../common/components/user_privileges/endpoint/use_endpoint_privileges');
 
 describe('When on the Trusted Apps Page', () => {
   const expectedAboutInfo =
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
index cab02450f8886..ab5ae4f613e38 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
@@ -30,7 +30,7 @@ import {
   mockCtiLinksResponse,
 } from '../components/overview_cti_links/mock';
 import { useCtiDashboardLinks } from '../containers/overview_cti_links';
-import { EndpointPrivileges } from '../../common/components/user_privileges/use_endpoint_privileges';
+import { EndpointPrivileges } from '../../common/components/user_privileges/endpoint/use_endpoint_privileges';
 import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features';
 import { useHostsRiskScore } from '../containers/overview_risky_host_links/use_hosts_risk_score';
 

From bd42367bdbfb028c805cc0a22b967e32367e2a86 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 09:27:09 -0400
Subject: [PATCH 11/36] [ML] Delete annotation directly from the index it is
 stored in (#115328) (#115539)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Pete Harverson <peteharverson@users.noreply.github.com>
---
 .../ml/common/constants/index_patterns.ts     |  1 -
 .../ml/server/lib/check_annotations/index.ts  | 11 ++-----
 .../annotation_service/annotation.test.ts     |  3 +-
 .../models/annotation_service/annotation.ts   | 33 ++++++++++++++++---
 4 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/x-pack/plugins/ml/common/constants/index_patterns.ts b/x-pack/plugins/ml/common/constants/index_patterns.ts
index d7d6c343e282b..9a8e5c1b8ae78 100644
--- a/x-pack/plugins/ml/common/constants/index_patterns.ts
+++ b/x-pack/plugins/ml/common/constants/index_patterns.ts
@@ -7,7 +7,6 @@
 
 export const ML_ANNOTATIONS_INDEX_ALIAS_READ = '.ml-annotations-read';
 export const ML_ANNOTATIONS_INDEX_ALIAS_WRITE = '.ml-annotations-write';
-export const ML_ANNOTATIONS_INDEX_PATTERN = '.ml-annotations-6';
 
 export const ML_RESULTS_INDEX_PATTERN = '.ml-anomalies-*';
 export const ML_NOTIFICATION_INDEX_PATTERN = '.ml-notifications*';
diff --git a/x-pack/plugins/ml/server/lib/check_annotations/index.ts b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
index a388a24d082a6..e64b4658588cb 100644
--- a/x-pack/plugins/ml/server/lib/check_annotations/index.ts
+++ b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
@@ -11,22 +11,15 @@ import { mlLog } from '../../lib/log';
 import {
   ML_ANNOTATIONS_INDEX_ALIAS_READ,
   ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
-  ML_ANNOTATIONS_INDEX_PATTERN,
 } from '../../../common/constants/index_patterns';
 
 // Annotations Feature is available if:
-// - ML_ANNOTATIONS_INDEX_PATTERN index is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_READ alias is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_WRITE alias is present
+// Note there is no need to check for the existence of the indices themselves as aliases are stored
+// in the metadata of the indices they point to, so it's impossible to have an alias that doesn't point to any index.
 export async function isAnnotationsFeatureAvailable({ asInternalUser }: IScopedClusterClient) {
   try {
-    const indexParams = { index: ML_ANNOTATIONS_INDEX_PATTERN };
-
-    const { body: annotationsIndexExists } = await asInternalUser.indices.exists(indexParams);
-    if (!annotationsIndexExists) {
-      return false;
-    }
-
     const { body: annotationsReadAliasExists } = await asInternalUser.indices.existsAlias({
       index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
       name: ML_ANNOTATIONS_INDEX_ALIAS_READ,
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
index 725e0ac494944..975070e92a7ec 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
@@ -9,7 +9,6 @@ import getAnnotationsRequestMock from './__mocks__/get_annotations_request.json'
 import getAnnotationsResponseMock from './__mocks__/get_annotations_response.json';
 
 import { ANNOTATION_TYPE } from '../../../common/constants/annotations';
-import { ML_ANNOTATIONS_INDEX_ALIAS_WRITE } from '../../../common/constants/index_patterns';
 import { Annotation, isAnnotations } from '../../../common/types/annotations';
 
 import { DeleteParams, GetResponse, IndexAnnotationArgs } from './annotation';
@@ -42,7 +41,7 @@ describe('annotation_service', () => {
 
       const annotationMockId = 'mockId';
       const deleteParamsMock: DeleteParams = {
-        index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
+        index: '.ml-annotations-6',
         id: annotationMockId,
         refresh: 'wait_for',
       };
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
index c6ed72de18d05..5807d181cc566 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
@@ -71,6 +71,7 @@ export interface IndexParams {
   index: string;
   body: Annotation;
   refresh: boolean | 'wait_for' | undefined;
+  require_alias?: boolean;
   id?: string;
 }
 
@@ -99,6 +100,7 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
       index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
       body: annotation,
       refresh: 'wait_for',
+      require_alias: true,
     };
 
     if (typeof annotation._id !== 'undefined') {
@@ -407,14 +409,37 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
   }
 
   async function deleteAnnotation(id: string) {
-    const params: DeleteParams = {
-      index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
+    // Find the index the annotation is stored in.
+    const searchParams: estypes.SearchRequest = {
+      index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
+      size: 1,
+      body: {
+        query: {
+          ids: {
+            values: [id],
+          },
+        },
+      },
+    };
+
+    const { body } = await asInternalUser.search(searchParams);
+    const totalCount =
+      typeof body.hits.total === 'number' ? body.hits.total : body.hits.total.value;
+
+    if (totalCount === 0) {
+      throw Boom.notFound(`Cannot find annotation with ID ${id}`);
+    }
+
+    const index = body.hits.hits[0]._index;
+
+    const deleteParams: DeleteParams = {
+      index,
       id,
       refresh: 'wait_for',
     };
 
-    const { body } = await asInternalUser.delete(params);
-    return body;
+    const { body: deleteResponse } = await asInternalUser.delete(deleteParams);
+    return deleteResponse;
   }
 
   return {

From 4317d066ffb0432c045d826ef6eb119e376d45a8 Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@gmail.com>
Date: Tue, 19 Oct 2021 15:52:00 +0200
Subject: [PATCH 12/36] [7.x] Explicitly set `level` for core deprecations
 (#115501)

* Explicitly set `level` for core deprecations

* Set for internal deprecations

* fix unit tests
---
 .../config/deprecation/core_deprecations.ts   | 93 ++++++++++++-------
 src/core/server/kibana_config.ts              |  1 +
 src/plugins/home/server/index.ts              |  4 +-
 src/plugins/newsfeed/server/index.ts          |  2 +-
 .../server/config/deprecations.test.ts        |  2 +
 .../telemetry/server/config/deprecations.ts   |  1 +
 src/plugins/usage_collection/server/config.ts | 14 ++-
 .../licensing/server/licensing_config.ts      |  3 +-
 8 files changed, 78 insertions(+), 42 deletions(-)

diff --git a/src/core/server/config/deprecation/core_deprecations.ts b/src/core/server/config/deprecation/core_deprecations.ts
index 1cf67f479f9b3..b115ea25fc363 100644
--- a/src/core/server/config/deprecation/core_deprecations.ts
+++ b/src/core/server/config/deprecation/core_deprecations.ts
@@ -13,6 +13,7 @@ const kibanaPathConf: ConfigDeprecation = (settings, fromPath, addDeprecation) =
   if (process.env?.KIBANA_PATH_CONF) {
     addDeprecation({
       configPath: 'env.KIBANA_PATH_CONF',
+      level: 'critical',
       message: `Environment variable "KIBANA_PATH_CONF" is deprecated. It has been replaced with "KBN_PATH_CONF" pointing to a config folder`,
       correctiveActions: {
         manualSteps: [
@@ -27,6 +28,7 @@ const configPathDeprecation: ConfigDeprecation = (settings, fromPath, addDepreca
   if (process.env?.CONFIG_PATH) {
     addDeprecation({
       configPath: 'env.CONFIG_PATH',
+      level: 'critical',
       message: `Environment variable "CONFIG_PATH" is deprecated. It has been replaced with "KBN_PATH_CONF" pointing to a config folder`,
       correctiveActions: {
         manualSteps: ['Use "KBN_PATH_CONF" instead of "CONFIG_PATH" to point to a config folder.'],
@@ -39,6 +41,7 @@ const dataPathDeprecation: ConfigDeprecation = (settings, fromPath, addDeprecati
   if (process.env?.DATA_PATH) {
     addDeprecation({
       configPath: 'env.DATA_PATH',
+      level: 'critical',
       message: `Environment variable "DATA_PATH" will be removed.  It has been replaced with kibana.yml setting "path.data"`,
       correctiveActions: {
         manualSteps: [
@@ -53,13 +56,13 @@ const rewriteBasePathDeprecation: ConfigDeprecation = (settings, fromPath, addDe
   if (settings.server?.basePath && !settings.server?.rewriteBasePath) {
     addDeprecation({
       configPath: 'server.basePath',
+      level: 'warning',
       title: 'Setting "server.rewriteBasePath" should be set when using "server.basePath"',
       message:
         'You should set server.basePath along with server.rewriteBasePath. Starting in 7.0, Kibana ' +
         'will expect that all requests start with server.basePath rather than expecting you to rewrite ' +
         'the requests in your reverse proxy. Set server.rewriteBasePath to false to preserve the ' +
         'current behavior and silence this warning.',
-      level: 'warning',
       correctiveActions: {
         manualSteps: [
           `Set 'server.rewriteBasePath' in the config file, CLI flag, or environment variable (in Docker only).`,
@@ -75,6 +78,7 @@ const rewriteCorsSettings: ConfigDeprecation = (settings, fromPath, addDeprecati
   if (typeof corsSettings === 'boolean') {
     addDeprecation({
       configPath: 'server.cors',
+      level: 'warning',
       title: 'Setting "server.cors" is deprecated',
       message: '"server.cors" is deprecated and has been replaced by "server.cors.enabled"',
       correctiveActions: {
@@ -113,6 +117,7 @@ const cspRulesDeprecation: ConfigDeprecation = (settings, fromPath, addDeprecati
             if (sourceList.find((source) => source.includes(NONCE_STRING))) {
               addDeprecation({
                 configPath: 'csp.rules',
+                level: 'critical',
                 message: `csp.rules no longer supports the {nonce} syntax. Replacing with 'self' in ${policy}`,
                 correctiveActions: {
                   manualSteps: [`Replace {nonce} syntax with 'self' in ${policy}`],
@@ -132,6 +137,7 @@ const cspRulesDeprecation: ConfigDeprecation = (settings, fromPath, addDeprecati
             ) {
               addDeprecation({
                 configPath: 'csp.rules',
+                level: 'critical',
                 message: `csp.rules must contain the 'self' source. Automatically adding to ${policy}.`,
                 correctiveActions: {
                   manualSteps: [`Add 'self' source to ${policy}.`],
@@ -156,6 +162,7 @@ const mapManifestServiceUrlDeprecation: ConfigDeprecation = (
   if (settings.map?.manifestServiceUrl) {
     addDeprecation({
       configPath: 'map.manifestServiceUrl',
+      level: 'critical',
       message:
         'You should no longer use the map.manifestServiceUrl setting in kibana.yml to configure the location ' +
         'of the Elastic Maps Service settings. These settings have moved to the "map.emsTileApiUrl" and ' +
@@ -175,6 +182,7 @@ const serverHostZeroDeprecation: ConfigDeprecation = (settings, fromPath, addDep
   if (settings.server?.host === '0') {
     addDeprecation({
       configPath: 'server.host',
+      level: 'critical',
       message:
         'Support for setting server.host to "0" in kibana.yml is deprecated and will be removed in Kibana version 8.0.0. ' +
         'Instead use "0.0.0.0" to bind to all interfaces.',
@@ -206,6 +214,7 @@ const opsLoggingEventDeprecation: ConfigDeprecation = (
   if (settings.logging?.events?.ops) {
     addDeprecation({
       configPath: 'logging.events.ops',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingevents`,
       title: i18n.translate('core.deprecations.loggingEventsOps.deprecationTitle', {
         defaultMessage: `Setting "logging.events.ops" is deprecated`,
@@ -237,6 +246,7 @@ const requestLoggingEventDeprecation: ConfigDeprecation = (
   if (settings.logging?.events?.request) {
     addDeprecation({
       configPath: 'logging.events.request',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingevents`,
       title: i18n.translate('core.deprecations.loggingEventsRequest.deprecationTitle', {
         defaultMessage: `Setting "logging.events.request" is deprecated`,
@@ -268,6 +278,7 @@ const responseLoggingEventDeprecation: ConfigDeprecation = (
   if (settings.logging?.events?.response) {
     addDeprecation({
       configPath: 'logging.events.response',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingevents`,
       title: i18n.translate('core.deprecations.loggingEventsResponse.deprecationTitle', {
         defaultMessage: `Setting "logging.events.response" is deprecated`,
@@ -299,6 +310,7 @@ const timezoneLoggingDeprecation: ConfigDeprecation = (
   if (settings.logging?.timezone) {
     addDeprecation({
       configPath: 'logging.timezone',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingtimezone`,
       title: i18n.translate('core.deprecations.loggingTimezone.deprecationTitle', {
         defaultMessage: `Setting "logging.timezone" is deprecated`,
@@ -330,6 +342,7 @@ const destLoggingDeprecation: ConfigDeprecation = (
   if (settings.logging?.dest) {
     addDeprecation({
       configPath: 'logging.dest',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingdest`,
       title: i18n.translate('core.deprecations.loggingDest.deprecationTitle', {
         defaultMessage: `Setting "logging.dest" is deprecated`,
@@ -361,6 +374,7 @@ const quietLoggingDeprecation: ConfigDeprecation = (
   if (settings.logging?.quiet) {
     addDeprecation({
       configPath: 'logging.quiet',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingquiet`,
       title: i18n.translate('core.deprecations.loggingQuiet.deprecationTitle', {
         defaultMessage: `Setting "logging.quiet" is deprecated`,
@@ -391,6 +405,7 @@ const silentLoggingDeprecation: ConfigDeprecation = (
   if (settings.logging?.silent) {
     addDeprecation({
       configPath: 'logging.silent',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingsilent`,
       title: i18n.translate('core.deprecations.loggingSilent.deprecationTitle', {
         defaultMessage: `Setting "logging.silent" is deprecated`,
@@ -421,6 +436,7 @@ const verboseLoggingDeprecation: ConfigDeprecation = (
   if (settings.logging?.verbose) {
     addDeprecation({
       configPath: 'logging.verbose',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingverbose`,
       title: i18n.translate('core.deprecations.loggingVerbose.deprecationTitle', {
         defaultMessage: `Setting "logging.verbose" is deprecated`,
@@ -455,6 +471,7 @@ const jsonLoggingDeprecation: ConfigDeprecation = (
   if (settings.logging?.json && settings.env !== 'development') {
     addDeprecation({
       configPath: 'logging.json',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx`,
       title: i18n.translate('core.deprecations.loggingJson.deprecationTitle', {
         defaultMessage: `Setting "logging.json" is deprecated`,
@@ -487,6 +504,7 @@ const logRotateDeprecation: ConfigDeprecation = (
   if (settings.logging?.rotate) {
     addDeprecation({
       configPath: 'logging.rotate',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#rolling-file-appender`,
       title: i18n.translate('core.deprecations.loggingRotate.deprecationTitle', {
         defaultMessage: `Setting "logging.rotate" is deprecated`,
@@ -518,6 +536,7 @@ const logEventsLogDeprecation: ConfigDeprecation = (
   if (settings.logging?.events?.log) {
     addDeprecation({
       configPath: 'logging.events.log',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingevents`,
       title: i18n.translate('core.deprecations.loggingEventsLog.deprecationTitle', {
         defaultMessage: `Setting "logging.events.log" is deprecated`,
@@ -548,6 +567,7 @@ const logEventsErrorDeprecation: ConfigDeprecation = (
   if (settings.logging?.events?.error) {
     addDeprecation({
       configPath: 'logging.events.error',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingevents`,
       title: i18n.translate('core.deprecations.loggingEventsError.deprecationTitle', {
         defaultMessage: `Setting "logging.events.error" is deprecated`,
@@ -578,6 +598,7 @@ const logFilterDeprecation: ConfigDeprecation = (
   if (settings.logging?.filter) {
     addDeprecation({
       configPath: 'logging.filter',
+      level: 'critical',
       documentationUrl: `https://github.com/elastic/kibana/blob/${branch}/src/core/server/logging/README.mdx#loggingfilter`,
       title: i18n.translate('core.deprecations.loggingFilter.deprecationTitle', {
         defaultMessage: `Setting "logging.filter" is deprecated`,
@@ -596,40 +617,42 @@ export const coreDeprecationProvider: ConfigDeprecationProvider = ({
   unusedFromRoot,
   renameFromRoot,
 }) => [
-  unusedFromRoot('savedObjects.indexCheckTimeout'),
-  unusedFromRoot('server.xsrf.token'),
-  unusedFromRoot('maps.manifestServiceUrl'),
-  unusedFromRoot('optimize.lazy'),
-  unusedFromRoot('optimize.lazyPort'),
-  unusedFromRoot('optimize.lazyHost'),
-  unusedFromRoot('optimize.lazyPrebuild'),
-  unusedFromRoot('optimize.lazyProxyTimeout'),
-  unusedFromRoot('optimize.enabled'),
-  unusedFromRoot('optimize.bundleFilter'),
-  unusedFromRoot('optimize.bundleDir'),
-  unusedFromRoot('optimize.viewCaching'),
-  unusedFromRoot('optimize.watch'),
-  unusedFromRoot('optimize.watchPort'),
-  unusedFromRoot('optimize.watchHost'),
-  unusedFromRoot('optimize.watchPrebuild'),
-  unusedFromRoot('optimize.watchProxyTimeout'),
-  unusedFromRoot('optimize.useBundleCache'),
-  unusedFromRoot('optimize.sourceMaps'),
-  unusedFromRoot('optimize.workers'),
-  unusedFromRoot('optimize.profile'),
-  unusedFromRoot('optimize.validateSyntaxOfNodeModules'),
-  renameFromRoot('xpack.xpack_main.telemetry.config', 'telemetry.config'),
-  renameFromRoot('xpack.xpack_main.telemetry.url', 'telemetry.url'),
-  renameFromRoot('xpack.xpack_main.telemetry.enabled', 'telemetry.enabled'),
-  renameFromRoot('xpack.telemetry.enabled', 'telemetry.enabled'),
-  renameFromRoot('xpack.telemetry.config', 'telemetry.config'),
-  renameFromRoot('xpack.telemetry.banner', 'telemetry.banner'),
-  renameFromRoot('xpack.telemetry.url', 'telemetry.url'),
-  renameFromRoot('cpu.cgroup.path.override', 'ops.cGroupOverrides.cpuPath'),
-  renameFromRoot('cpuacct.cgroup.path.override', 'ops.cGroupOverrides.cpuAcctPath'),
-  renameFromRoot('server.xsrf.whitelist', 'server.xsrf.allowlist'),
-  unusedFromRoot('elasticsearch.preserveHost'),
-  unusedFromRoot('elasticsearch.startupTimeout'),
+  unusedFromRoot('savedObjects.indexCheckTimeout', { level: 'critical' }),
+  unusedFromRoot('server.xsrf.token', { level: 'critical' }),
+  unusedFromRoot('maps.manifestServiceUrl', { level: 'critical' }),
+  unusedFromRoot('optimize.lazy', { level: 'critical' }),
+  unusedFromRoot('optimize.lazyPort', { level: 'critical' }),
+  unusedFromRoot('optimize.lazyHost', { level: 'critical' }),
+  unusedFromRoot('optimize.lazyPrebuild', { level: 'critical' }),
+  unusedFromRoot('optimize.lazyProxyTimeout', { level: 'critical' }),
+  unusedFromRoot('optimize.enabled', { level: 'critical' }),
+  unusedFromRoot('optimize.bundleFilter', { level: 'critical' }),
+  unusedFromRoot('optimize.bundleDir', { level: 'critical' }),
+  unusedFromRoot('optimize.viewCaching', { level: 'critical' }),
+  unusedFromRoot('optimize.watch', { level: 'critical' }),
+  unusedFromRoot('optimize.watchPort', { level: 'critical' }),
+  unusedFromRoot('optimize.watchHost', { level: 'critical' }),
+  unusedFromRoot('optimize.watchPrebuild', { level: 'critical' }),
+  unusedFromRoot('optimize.watchProxyTimeout', { level: 'critical' }),
+  unusedFromRoot('optimize.useBundleCache', { level: 'critical' }),
+  unusedFromRoot('optimize.sourceMaps', { level: 'critical' }),
+  unusedFromRoot('optimize.workers', { level: 'critical' }),
+  unusedFromRoot('optimize.profile', { level: 'critical' }),
+  unusedFromRoot('optimize.validateSyntaxOfNodeModules', { level: 'critical' }),
+  renameFromRoot('xpack.xpack_main.telemetry.config', 'telemetry.config', { level: 'critical' }),
+  renameFromRoot('xpack.xpack_main.telemetry.url', 'telemetry.url', { level: 'critical' }),
+  renameFromRoot('xpack.xpack_main.telemetry.enabled', 'telemetry.enabled', { level: 'critical' }),
+  renameFromRoot('xpack.telemetry.enabled', 'telemetry.enabled', { level: 'critical' }),
+  renameFromRoot('xpack.telemetry.config', 'telemetry.config', { level: 'critical' }),
+  renameFromRoot('xpack.telemetry.banner', 'telemetry.banner', { level: 'critical' }),
+  renameFromRoot('xpack.telemetry.url', 'telemetry.url', { level: 'critical' }),
+  renameFromRoot('cpu.cgroup.path.override', 'ops.cGroupOverrides.cpuPath', { level: 'critical' }),
+  renameFromRoot('cpuacct.cgroup.path.override', 'ops.cGroupOverrides.cpuAcctPath', {
+    level: 'critical',
+  }),
+  renameFromRoot('server.xsrf.whitelist', 'server.xsrf.allowlist', { level: 'critical' }),
+  unusedFromRoot('elasticsearch.preserveHost', { level: 'critical' }),
+  unusedFromRoot('elasticsearch.startupTimeout', { level: 'critical' }),
   rewriteCorsSettings,
   configPathDeprecation,
   kibanaPathConf,
diff --git a/src/core/server/kibana_config.ts b/src/core/server/kibana_config.ts
index 859f25d7082f1..a0476a54ae744 100644
--- a/src/core/server/kibana_config.ts
+++ b/src/core/server/kibana_config.ts
@@ -18,6 +18,7 @@ const deprecations: ConfigDeprecationProvider = () => [
     if (kibana?.index) {
       addDeprecation({
         configPath: 'kibana.index',
+        level: 'critical',
         title: i18n.translate('core.kibana.index.deprecationTitle', {
           defaultMessage: `Setting "kibana.index" is deprecated`,
         }),
diff --git a/src/plugins/home/server/index.ts b/src/plugins/home/server/index.ts
index 9523766596fed..db72af9d78a39 100644
--- a/src/plugins/home/server/index.ts
+++ b/src/plugins/home/server/index.ts
@@ -19,7 +19,9 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   },
   schema: configSchema,
   deprecations: ({ renameFromRoot }) => [
-    renameFromRoot('kibana.disableWelcomeScreen', 'home.disableWelcomeScreen'),
+    renameFromRoot('kibana.disableWelcomeScreen', 'home.disableWelcomeScreen', {
+      level: 'critical',
+    }),
   ],
 };
 
diff --git a/src/plugins/newsfeed/server/index.ts b/src/plugins/newsfeed/server/index.ts
index 460d48622af69..30bd27f027ccd 100644
--- a/src/plugins/newsfeed/server/index.ts
+++ b/src/plugins/newsfeed/server/index.ts
@@ -17,7 +17,7 @@ export const config: PluginConfigDescriptor<NewsfeedConfigType> = {
     mainInterval: true,
     fetchInterval: true,
   },
-  deprecations: ({ unused }) => [unused('defaultLanguage')],
+  deprecations: ({ unused }) => [unused('defaultLanguage', { level: 'critical' })],
 };
 
 export function plugin() {
diff --git a/src/plugins/telemetry/server/config/deprecations.test.ts b/src/plugins/telemetry/server/config/deprecations.test.ts
index 567ef69e8991c..1243ae6712057 100644
--- a/src/plugins/telemetry/server/config/deprecations.test.ts
+++ b/src/plugins/telemetry/server/config/deprecations.test.ts
@@ -165,6 +165,7 @@ describe('deprecateEndpointConfigs', () => {
               "To send usage to the staging endpoint add \\"telemetry.sendUsageTo: staging\\" to the Kibana configuration.",
             ],
           },
+          "level": "critical",
           "message": "\\"telemetry.url\\" has been deprecated. Set \\"telemetry.sendUsageTo: staging\\" to the Kibana configurations to send usage to the staging endpoint.",
           "title": "Setting \\"telemetry.url\\" is deprecated",
         },
@@ -188,6 +189,7 @@ describe('deprecateEndpointConfigs', () => {
               "To send usage to the staging endpoint add \\"telemetry.sendUsageTo: staging\\" to the Kibana configuration.",
             ],
           },
+          "level": "critical",
           "message": "\\"telemetry.optInStatusUrl\\" has been deprecated. Set \\"telemetry.sendUsageTo: staging\\" to the Kibana configurations to send usage to the staging endpoint.",
           "title": "Setting \\"telemetry.optInStatusUrl\\" is deprecated",
         },
diff --git a/src/plugins/telemetry/server/config/deprecations.ts b/src/plugins/telemetry/server/config/deprecations.ts
index 38553be7d5774..fa939482a5f57 100644
--- a/src/plugins/telemetry/server/config/deprecations.ts
+++ b/src/plugins/telemetry/server/config/deprecations.ts
@@ -36,6 +36,7 @@ export const deprecateEndpointConfigs: ConfigDeprecation = (
 
       addDeprecation({
         configPath: fullConfigPath,
+        level: 'critical',
         title: i18n.translate('telemetry.endpointConfigs.deprecationTitle', {
           defaultMessage: 'Setting "{configPath}" is deprecated',
           values: { configPath: fullConfigPath },
diff --git a/src/plugins/usage_collection/server/config.ts b/src/plugins/usage_collection/server/config.ts
index faf8ce7535e8a..0c52f4525c134 100644
--- a/src/plugins/usage_collection/server/config.ts
+++ b/src/plugins/usage_collection/server/config.ts
@@ -30,10 +30,16 @@ export type ConfigType = TypeOf<typeof configSchema>;
 export const config: PluginConfigDescriptor<ConfigType> = {
   schema: configSchema,
   deprecations: ({ renameFromRoot }) => [
-    renameFromRoot('ui_metric.enabled', 'usageCollection.uiCounters.enabled'),
-    renameFromRoot('ui_metric.debug', 'usageCollection.uiCounters.debug'),
-    renameFromRoot('usageCollection.uiMetric.enabled', 'usageCollection.uiCounters.enabled'),
-    renameFromRoot('usageCollection.uiMetric.debug', 'usageCollection.uiCounters.debug'),
+    renameFromRoot('ui_metric.enabled', 'usageCollection.uiCounters.enabled', {
+      level: 'critical',
+    }),
+    renameFromRoot('ui_metric.debug', 'usageCollection.uiCounters.debug', { level: 'critical' }),
+    renameFromRoot('usageCollection.uiMetric.enabled', 'usageCollection.uiCounters.enabled', {
+      level: 'critical',
+    }),
+    renameFromRoot('usageCollection.uiMetric.debug', 'usageCollection.uiCounters.debug', {
+      level: 'critical',
+    }),
   ],
   exposeToBrowser: {
     uiCounters: true,
diff --git a/x-pack/plugins/licensing/server/licensing_config.ts b/x-pack/plugins/licensing/server/licensing_config.ts
index a27eaba56df50..485351ec22048 100644
--- a/x-pack/plugins/licensing/server/licensing_config.ts
+++ b/x-pack/plugins/licensing/server/licensing_config.ts
@@ -21,7 +21,8 @@ export const config: PluginConfigDescriptor<LicenseConfigType> = {
   deprecations: ({ renameFromRoot }) => [
     renameFromRoot(
       'xpack.xpack_main.xpack_api_polling_frequency_millis',
-      'xpack.licensing.api_polling_frequency'
+      'xpack.licensing.api_polling_frequency',
+      { level: 'critical' }
     ),
   ],
 };

From de80e69b272cfd45e4b0afa1d9467d497481dd08 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 09:56:00 -0400
Subject: [PATCH 13/36] [Security Solution] Generate host isolation exceptions
 artifact (#115160) (#115512)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Esteban Beltran <academo@users.noreply.github.com>
---
 .../server/endpoint/lib/artifacts/common.ts   |   3 +
 .../server/endpoint/lib/artifacts/lists.ts    |  20 +++
 .../manifest_manager/manifest_manager.test.ts | 137 ++++++++++--------
 .../manifest_manager/manifest_manager.ts      |  42 ++++++
 4 files changed, 140 insertions(+), 62 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/common.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/common.ts
index af5e386464305..60f91330d4558 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/common.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/common.ts
@@ -25,6 +25,9 @@ export const ArtifactConstants = {
 
   SUPPORTED_EVENT_FILTERS_OPERATING_SYSTEMS: ['macos', 'windows', 'linux'],
   GLOBAL_EVENT_FILTERS_NAME: 'endpoint-eventfilterlist',
+
+  SUPPORTED_HOST_ISOLATION_EXCEPTIONS_OPERATING_SYSTEMS: ['macos', 'windows', 'linux'],
+  GLOBAL_HOST_ISOLATION_EXCEPTIONS_NAME: 'endpoint-hostisolationexceptionlist',
 };
 
 export const ManifestConstants = {
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
index e27a09efd9710..e26a2c7f4b4bc 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
@@ -15,6 +15,7 @@ import { validate } from '@kbn/securitysolution-io-ts-utils';
 
 import {
   ENDPOINT_EVENT_FILTERS_LIST_ID,
+  ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID,
   ENDPOINT_LIST_ID,
   ENDPOINT_TRUSTED_APPS_LIST_ID,
 } from '@kbn/securitysolution-list-constants';
@@ -65,6 +66,7 @@ export async function getFilteredEndpointExceptionList(
     | typeof ENDPOINT_LIST_ID
     | typeof ENDPOINT_TRUSTED_APPS_LIST_ID
     | typeof ENDPOINT_EVENT_FILTERS_LIST_ID
+    | typeof ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID
 ): Promise<WrappedTranslatedExceptionList> {
   const exceptions: WrappedTranslatedExceptionList = { entries: [] };
   let page = 1;
@@ -148,6 +150,24 @@ export async function getEndpointEventFiltersList(
   );
 }
 
+export async function getHostIsolationExceptionsList(
+  eClient: ExceptionListClient,
+  schemaVersion: string,
+  os: string,
+  policyId?: string
+): Promise<WrappedTranslatedExceptionList> {
+  const osFilter = `exception-list-agnostic.attributes.os_types:\"${os}\"`;
+  const policyFilter = `(exception-list-agnostic.attributes.tags:\"policy:all\"${
+    policyId ? ` or exception-list-agnostic.attributes.tags:\"policy:${policyId}\"` : ''
+  })`;
+
+  return getFilteredEndpointExceptionList(
+    eClient,
+    schemaVersion,
+    `${osFilter} and ${policyFilter}`,
+    ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID
+  );
+}
 /**
  * Translates Exception list items to Exceptions the endpoint can understand
  * @param exceptions
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
index d75e347b86bd5..0ef2abd5f50aa 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
@@ -7,6 +7,7 @@
 
 import { savedObjectsClientMock } from 'src/core/server/mocks';
 import {
+  ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID,
   ENDPOINT_LIST_ID,
   ENDPOINT_TRUSTED_APPS_LIST_ID,
 } from '@kbn/securitysolution-list-constants';
@@ -66,6 +67,12 @@ describe('ManifestManager', () => {
   const ARTIFACT_NAME_EVENT_FILTERS_MACOS = 'endpoint-eventfilterlist-macos-v1';
   const ARTIFACT_NAME_EVENT_FILTERS_WINDOWS = 'endpoint-eventfilterlist-windows-v1';
   const ARTIFACT_NAME_EVENT_FILTERS_LINUX = 'endpoint-eventfilterlist-linux-v1';
+  const ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_MACOS =
+    'endpoint-hostisolationexceptionlist-macos-v1';
+  const ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_WINDOWS =
+    'endpoint-hostisolationexceptionlist-windows-v1';
+  const ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_LINUX =
+    'endpoint-hostisolationexceptionlist-linux-v1';
 
   let ARTIFACTS: InternalArtifactCompleteSchema[] = [];
   let ARTIFACTS_BY_ID: { [K: string]: InternalArtifactCompleteSchema } = {};
@@ -157,31 +164,29 @@ describe('ManifestManager', () => {
       const manifestManagerContext = buildManifestManagerContextMock({ savedObjectsClient });
       const manifestManager = new ManifestManager(manifestManagerContext);
 
-      savedObjectsClient.get = jest
-        .fn()
-        .mockImplementation(async (objectType: string, id: string) => {
-          if (objectType === ManifestConstants.SAVED_OBJECT_TYPE) {
-            return {
-              attributes: {
-                created: '20-01-2020 10:00:00.000Z',
-                schemaVersion: 'v2',
-                semanticVersion: '1.0.0',
-                artifacts: [
-                  { artifactId: ARTIFACT_ID_EXCEPTIONS_MACOS, policyId: undefined },
-                  { artifactId: ARTIFACT_ID_EXCEPTIONS_WINDOWS, policyId: undefined },
-                  { artifactId: ARTIFACT_ID_EXCEPTIONS_LINUX, policyId: undefined },
-                  { artifactId: ARTIFACT_ID_EXCEPTIONS_WINDOWS, policyId: TEST_POLICY_ID_1 },
-                  { artifactId: ARTIFACT_ID_TRUSTED_APPS_MACOS, policyId: TEST_POLICY_ID_1 },
-                  { artifactId: ARTIFACT_ID_TRUSTED_APPS_WINDOWS, policyId: TEST_POLICY_ID_1 },
-                  { artifactId: ARTIFACT_ID_TRUSTED_APPS_WINDOWS, policyId: TEST_POLICY_ID_2 },
-                ],
-              },
-              version: '2.0.0',
-            };
-          } else {
-            return null;
-          }
-        });
+      savedObjectsClient.get = jest.fn().mockImplementation(async (objectType: string) => {
+        if (objectType === ManifestConstants.SAVED_OBJECT_TYPE) {
+          return {
+            attributes: {
+              created: '20-01-2020 10:00:00.000Z',
+              schemaVersion: 'v2',
+              semanticVersion: '1.0.0',
+              artifacts: [
+                { artifactId: ARTIFACT_ID_EXCEPTIONS_MACOS, policyId: undefined },
+                { artifactId: ARTIFACT_ID_EXCEPTIONS_WINDOWS, policyId: undefined },
+                { artifactId: ARTIFACT_ID_EXCEPTIONS_LINUX, policyId: undefined },
+                { artifactId: ARTIFACT_ID_EXCEPTIONS_WINDOWS, policyId: TEST_POLICY_ID_1 },
+                { artifactId: ARTIFACT_ID_TRUSTED_APPS_MACOS, policyId: TEST_POLICY_ID_1 },
+                { artifactId: ARTIFACT_ID_TRUSTED_APPS_WINDOWS, policyId: TEST_POLICY_ID_1 },
+                { artifactId: ARTIFACT_ID_TRUSTED_APPS_WINDOWS, policyId: TEST_POLICY_ID_2 },
+              ],
+            },
+            version: '2.0.0',
+          };
+        } else {
+          return null;
+        }
+      });
 
       (
         manifestManagerContext.artifactClient as jest.Mocked<EndpointArtifactClientInterface>
@@ -218,31 +223,29 @@ describe('ManifestManager', () => {
       const manifestManagerContext = buildManifestManagerContextMock({ savedObjectsClient });
       const manifestManager = new ManifestManager(manifestManagerContext);
 
-      savedObjectsClient.get = jest
-        .fn()
-        .mockImplementation(async (objectType: string, id: string) => {
-          if (objectType === ManifestConstants.SAVED_OBJECT_TYPE) {
-            return {
-              attributes: {
-                created: '20-01-2020 10:00:00.000Z',
-                schemaVersion: 'v2',
-                semanticVersion: '1.0.0',
-                artifacts: [
-                  { artifactId: ARTIFACT_ID_EXCEPTIONS_MACOS, policyId: undefined },
-                  { artifactId: ARTIFACT_ID_EXCEPTIONS_WINDOWS, policyId: undefined },
-                  { artifactId: ARTIFACT_ID_EXCEPTIONS_LINUX, policyId: undefined },
-                  { artifactId: ARTIFACT_ID_EXCEPTIONS_WINDOWS, policyId: TEST_POLICY_ID_1 },
-                  { artifactId: ARTIFACT_ID_TRUSTED_APPS_MACOS, policyId: TEST_POLICY_ID_1 },
-                  { artifactId: ARTIFACT_ID_TRUSTED_APPS_WINDOWS, policyId: TEST_POLICY_ID_1 },
-                  { artifactId: ARTIFACT_ID_TRUSTED_APPS_WINDOWS, policyId: TEST_POLICY_ID_2 },
-                ],
-              },
-              version: '2.0.0',
-            };
-          } else {
-            return null;
-          }
-        });
+      savedObjectsClient.get = jest.fn().mockImplementation(async (objectType: string) => {
+        if (objectType === ManifestConstants.SAVED_OBJECT_TYPE) {
+          return {
+            attributes: {
+              created: '20-01-2020 10:00:00.000Z',
+              schemaVersion: 'v2',
+              semanticVersion: '1.0.0',
+              artifacts: [
+                { artifactId: ARTIFACT_ID_EXCEPTIONS_MACOS, policyId: undefined },
+                { artifactId: ARTIFACT_ID_EXCEPTIONS_WINDOWS, policyId: undefined },
+                { artifactId: ARTIFACT_ID_EXCEPTIONS_LINUX, policyId: undefined },
+                { artifactId: ARTIFACT_ID_EXCEPTIONS_WINDOWS, policyId: TEST_POLICY_ID_1 },
+                { artifactId: ARTIFACT_ID_TRUSTED_APPS_MACOS, policyId: TEST_POLICY_ID_1 },
+                { artifactId: ARTIFACT_ID_TRUSTED_APPS_WINDOWS, policyId: TEST_POLICY_ID_1 },
+                { artifactId: ARTIFACT_ID_TRUSTED_APPS_WINDOWS, policyId: TEST_POLICY_ID_2 },
+              ],
+            },
+            version: '2.0.0',
+          };
+        } else {
+          return null;
+        }
+      });
 
       (
         manifestManagerContext.artifactClient as jest.Mocked<EndpointArtifactClientInterface>
@@ -278,6 +281,9 @@ describe('ManifestManager', () => {
       ARTIFACT_NAME_EVENT_FILTERS_MACOS,
       ARTIFACT_NAME_EVENT_FILTERS_WINDOWS,
       ARTIFACT_NAME_EVENT_FILTERS_LINUX,
+      ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_MACOS,
+      ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_WINDOWS,
+      ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_LINUX,
     ];
 
     const getArtifactIds = (artifacts: InternalArtifactSchema[]) => [
@@ -310,7 +316,7 @@ describe('ManifestManager', () => {
 
       context.savedObjectsClient.create = jest
         .fn()
-        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+        .mockImplementation((_type: string, object: InternalManifestSchema) => ({
           attributes: object,
         }));
       const manifest = await manifestManager.buildNewManifest();
@@ -321,7 +327,7 @@ describe('ManifestManager', () => {
 
       const artifacts = manifest.getAllArtifacts();
 
-      expect(artifacts.length).toBe(9);
+      expect(artifacts.length).toBe(12);
       expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);
 
       for (const artifact of artifacts) {
@@ -336,16 +342,18 @@ describe('ManifestManager', () => {
     test('Builds fully new manifest if no baseline parameter passed and present exception list items', async () => {
       const exceptionListItem = getExceptionListItemSchemaMock({ os_types: ['macos'] });
       const trustedAppListItem = getExceptionListItemSchemaMock({ os_types: ['linux'] });
+      const hostIsolationExceptionsItem = getExceptionListItemSchemaMock({ os_types: ['linux'] });
       const context = buildManifestManagerContextMock({});
       const manifestManager = new ManifestManager(context);
 
       context.exceptionListClient.findExceptionListItem = mockFindExceptionListItemResponses({
         [ENDPOINT_LIST_ID]: { macos: [exceptionListItem] },
         [ENDPOINT_TRUSTED_APPS_LIST_ID]: { linux: [trustedAppListItem] },
+        [ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID]: { linux: [hostIsolationExceptionsItem] },
       });
       context.savedObjectsClient.create = jest
         .fn()
-        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+        .mockImplementation((_type: string, object: InternalManifestSchema) => ({
           attributes: object,
         }));
       context.packagePolicyService.listIds = mockPolicyListIdsResponse([TEST_POLICY_ID_1]);
@@ -358,7 +366,7 @@ describe('ManifestManager', () => {
 
       const artifacts = manifest.getAllArtifacts();
 
-      expect(artifacts.length).toBe(9);
+      expect(artifacts.length).toBe(12);
       expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);
 
       expect(getArtifactObject(artifacts[0])).toStrictEqual({
@@ -374,6 +382,11 @@ describe('ManifestManager', () => {
       expect(getArtifactObject(artifacts[6])).toStrictEqual({ entries: [] });
       expect(getArtifactObject(artifacts[7])).toStrictEqual({ entries: [] });
       expect(getArtifactObject(artifacts[8])).toStrictEqual({ entries: [] });
+      expect(getArtifactObject(artifacts[9])).toStrictEqual({ entries: [] });
+      expect(getArtifactObject(artifacts[10])).toStrictEqual({ entries: [] });
+      expect(getArtifactObject(artifacts[11])).toStrictEqual({
+        entries: translateToEndpointExceptions([hostIsolationExceptionsItem], 'v1'),
+      });
 
       for (const artifact of artifacts) {
         expect(manifest.isDefaultArtifact(artifact)).toBe(true);
@@ -395,7 +408,7 @@ describe('ManifestManager', () => {
       context.packagePolicyService.listIds = mockPolicyListIdsResponse([TEST_POLICY_ID_1]);
       context.savedObjectsClient.create = jest
         .fn()
-        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+        .mockImplementation((_type: string, object: InternalManifestSchema) => ({
           attributes: object,
         }));
       const oldManifest = await manifestManager.buildNewManifest();
@@ -413,7 +426,7 @@ describe('ManifestManager', () => {
 
       const artifacts = manifest.getAllArtifacts();
 
-      expect(artifacts.length).toBe(9);
+      expect(artifacts.length).toBe(12);
       expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);
 
       expect(artifacts[0]).toStrictEqual(oldManifest.getAllArtifacts()[0]);
@@ -462,7 +475,7 @@ describe('ManifestManager', () => {
 
       context.savedObjectsClient.create = jest
         .fn()
-        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+        .mockImplementation((_type: string, object: InternalManifestSchema) => ({
           attributes: object,
         }));
 
@@ -474,7 +487,7 @@ describe('ManifestManager', () => {
 
       const artifacts = manifest.getAllArtifacts();
 
-      expect(artifacts.length).toBe(10);
+      expect(artifacts.length).toBe(13);
       expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);
 
       expect(getArtifactObject(artifacts[0])).toStrictEqual({
@@ -653,7 +666,7 @@ describe('ManifestManager', () => {
 
       context.savedObjectsClient.create = jest
         .fn()
-        .mockImplementation((type: string, object: InternalManifestSchema) => object);
+        .mockImplementation((_type: string, object: InternalManifestSchema) => object);
 
       await expect(manifestManager.commit(manifest)).resolves.toBeUndefined();
 
@@ -690,7 +703,7 @@ describe('ManifestManager', () => {
 
       context.savedObjectsClient.update = jest
         .fn()
-        .mockImplementation((type: string, id: string, object: InternalManifestSchema) => object);
+        .mockImplementation((_type: string, _id: string, object: InternalManifestSchema) => object);
 
       await expect(manifestManager.commit(manifest)).resolves.toBeUndefined();
 
@@ -1023,7 +1036,7 @@ describe('ManifestManager', () => {
 
       context.savedObjectsClient.create = jest
         .fn()
-        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+        .mockImplementation((_type: string, object: InternalManifestSchema) => ({
           attributes: object,
         }));
       const manifest = await manifestManager.buildNewManifest();
@@ -1046,7 +1059,7 @@ describe('ManifestManager', () => {
 
       context.savedObjectsClient.create = jest
         .fn()
-        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+        .mockImplementation((_type: string, object: InternalManifestSchema) => ({
           attributes: object,
         }));
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
index 5c1d327b1b892..736bf1c58cb90 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
@@ -26,6 +26,7 @@ import {
   getEndpointEventFiltersList,
   getEndpointExceptionList,
   getEndpointTrustedAppsList,
+  getHostIsolationExceptionsList,
   Manifest,
 } from '../../../lib/artifacts';
 import {
@@ -237,6 +238,46 @@ export class ManifestManager {
     );
   }
 
+  protected async buildHostIsolationExceptionsArtifacts(): Promise<ArtifactsBuildResult> {
+    const defaultArtifacts: InternalArtifactCompleteSchema[] = [];
+    const policySpecificArtifacts: Record<string, InternalArtifactCompleteSchema[]> = {};
+
+    for (const os of ArtifactConstants.SUPPORTED_HOST_ISOLATION_EXCEPTIONS_OPERATING_SYSTEMS) {
+      defaultArtifacts.push(await this.buildHostIsolationExceptionForOs(os));
+    }
+
+    await iterateAllListItems(
+      (page) => this.listEndpointPolicyIds(page),
+      async (policyId) => {
+        for (const os of ArtifactConstants.SUPPORTED_HOST_ISOLATION_EXCEPTIONS_OPERATING_SYSTEMS) {
+          policySpecificArtifacts[policyId] = policySpecificArtifacts[policyId] || [];
+          policySpecificArtifacts[policyId].push(
+            await this.buildHostIsolationExceptionForOs(os, policyId)
+          );
+        }
+      }
+    );
+
+    return { defaultArtifacts, policySpecificArtifacts };
+  }
+
+  protected async buildHostIsolationExceptionForOs(
+    os: string,
+    policyId?: string
+  ): Promise<InternalArtifactCompleteSchema> {
+    return buildArtifact(
+      await getHostIsolationExceptionsList(
+        this.exceptionListClient,
+        this.schemaVersion,
+        os,
+        policyId
+      ),
+      this.schemaVersion,
+      os,
+      ArtifactConstants.GLOBAL_HOST_ISOLATION_EXCEPTIONS_NAME
+    );
+  }
+
   /**
    * Writes new artifact SO.
    *
@@ -381,6 +422,7 @@ export class ManifestManager {
       this.buildExceptionListArtifacts(),
       this.buildTrustedAppsArtifacts(),
       this.buildEventFiltersArtifacts(),
+      this.buildHostIsolationExceptionsArtifacts(),
     ]);
 
     const manifest = new Manifest({

From 8e6ba2736d1c78460864e7e408d1597b8f82de58 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 10:17:41 -0400
Subject: [PATCH 14/36] Update heading on telemetry management section.
 (#115425) (#115508)

Co-authored-by: Pete Hampton <pjhampton@users.noreply.github.com>
---
 .../telemetry_management_section.test.tsx.snap            | 4 ++--
 .../public/components/telemetry_management_section.tsx    | 8 ++++----
 x-pack/plugins/translations/translations/ja-JP.json       | 2 --
 x-pack/plugins/translations/translations/zh-CN.json       | 2 --
 4 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
index 758ecf54f4bf0..72947b1514911 100644
--- a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
+++ b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
@@ -53,7 +53,7 @@ exports[`TelemetryManagementSectionComponent renders as expected 1`] = `
           loading={false}
           setting={
             Object {
-              "ariaName": "Provide usage statistics",
+              "ariaName": "Provide usage data",
               "category": Array [],
               "defVal": true,
               "description": <React.Fragment>
@@ -109,7 +109,7 @@ exports[`TelemetryManagementSectionComponent renders as expected 1`] = `
                   />
                 </p>
               </React.Fragment>,
-              "displayName": "Provide usage statistics",
+              "displayName": "Provide usage data",
               "isCustom": true,
               "isOverridden": false,
               "name": "telemetry:enabled",
diff --git a/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
index 3686cb10706bf..037603cb165d9 100644
--- a/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
+++ b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
@@ -116,14 +116,14 @@ export class TelemetryManagementSection extends Component<Props, State> {
                 setting={{
                   type: 'boolean',
                   name: 'telemetry:enabled',
-                  displayName: i18n.translate('telemetry.provideUsageStatisticsTitle', {
-                    defaultMessage: 'Provide usage statistics',
+                  displayName: i18n.translate('telemetry.provideUsageDataTitle', {
+                    defaultMessage: 'Provide usage data',
                   }),
                   value: enabled,
                   description: this.renderDescription(),
                   defVal: true,
-                  ariaName: i18n.translate('telemetry.provideUsageStatisticsAriaName', {
-                    defaultMessage: 'Provide usage statistics',
+                  ariaName: i18n.translate('telemetry.provideUsageDataAriaName', {
+                    defaultMessage: 'Provide usage data',
                   }),
                   requiresPageReload: false,
                   category: [],
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index f86167046c4c2..ea98d0554d58b 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -4605,8 +4605,6 @@
     "telemetry.optInNoticeSeenErrorToastText": "通知の消去中にエラーが発生しました",
     "telemetry.optInSuccessOff": "使用状況データ収集がオフです。",
     "telemetry.optInSuccessOn": "使用状況データ収集がオンです。",
-    "telemetry.provideUsageStatisticsAriaName": "使用統計を提供",
-    "telemetry.provideUsageStatisticsTitle": "使用統計を提供",
     "telemetry.readOurUsageDataPrivacyStatementLinkText": "プライバシーポリシー",
     "telemetry.securityData": "Endpoint Security データ",
     "telemetry.telemetryBannerDescription": "Elastic Stackの改善にご協力ください使用状況データの収集は現在無効です。使用状況データの収集を有効にすると、製品とサービスを管理して改善することができます。詳細については、{privacyStatementLink}をご覧ください。",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 6cfdc69c9e897..2c8bc37c32208 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -4651,8 +4651,6 @@
     "telemetry.optInNoticeSeenErrorToastText": "关闭声明时发生错误",
     "telemetry.optInSuccessOff": "使用情况数据收集已关闭。",
     "telemetry.optInSuccessOn": "使用情况数据收集已打开。",
-    "telemetry.provideUsageStatisticsAriaName": "提供使用情况统计",
-    "telemetry.provideUsageStatisticsTitle": "提供使用情况统计",
     "telemetry.readOurUsageDataPrivacyStatementLinkText": "隐私声明",
     "telemetry.securityData": "终端安全数据",
     "telemetry.telemetryBannerDescription": "想帮助我们改进 Elastic Stack？数据使用情况收集当前已禁用。启用使用情况数据收集可帮助我们管理并改善产品和服务。有关更多详情，请参阅我们的{privacyStatementLink}。",

From 00c6f114fc1ff0c05172f7b5d6dbf8c42f3b77f2 Mon Sep 17 00:00:00 2001
From: Tre <wayne.seymour@elastic.co>
Date: Tue, 19 Oct 2021 10:42:52 -0400
Subject: [PATCH 15/36] [QA][refactor] Use ui settings - sample data (#114530)
 (#115549)

# Conflicts:
#	test/functional/page_objects/common_page.ts
---
 test/functional/apps/home/_sample_data.ts   | 21 ++++++++-----------
 test/functional/page_objects/common_page.ts | 23 +++++++++++++++++----
 2 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/test/functional/apps/home/_sample_data.ts b/test/functional/apps/home/_sample_data.ts
index 3cf387133bc9c..e0a96940337e2 100644
--- a/test/functional/apps/home/_sample_data.ts
+++ b/test/functional/apps/home/_sample_data.ts
@@ -31,6 +31,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     after(async () => {
       await security.testUser.restoreDefaults();
+      await PageObjects.common.unsetTime();
     });
 
     it('should display registered flights sample data sets', async () => {
@@ -74,6 +75,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     describe('dashboard', () => {
       beforeEach(async () => {
+        await time();
         await PageObjects.common.navigateToUrl('home', '/tutorial_directory/sampleData', {
           useActualUrl: true,
         });
@@ -84,10 +86,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('flights');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(17);
       });
@@ -112,10 +110,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('logs');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(13);
       });
@@ -124,10 +118,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('ecommerce');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(15);
       });
@@ -160,5 +150,12 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         expect(isInstalled).to.be(false);
       });
     });
+
+    async function time() {
+      const today = moment().format('MMM D, YYYY');
+      const from = `${today} @ 00:00:00.000`;
+      const to = `${today} @ 23:59:59.999`;
+      await PageObjects.common.setTime({ from, to });
+    }
   });
 }
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 03e49f1642f55..5e5c3abcb9607 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -30,7 +30,8 @@ export class CommonPageObject extends FtrService {
   private readonly find = this.ctx.getService('find');
   private readonly globalNav = this.ctx.getService('globalNav');
   private readonly testSubjects = this.ctx.getService('testSubjects');
-  private readonly login = this.ctx.getPageObject('login');
+  private readonly loginPage = this.ctx.getPageObject('login');
+  private readonly kibanaServer = this.ctx.getService('kibanaServer');
 
   private readonly defaultTryTimeout = this.config.get('timeouts.try');
   private readonly defaultFindTimeout = this.config.get('timeouts.find');
@@ -60,12 +61,12 @@ export class CommonPageObject extends FtrService {
     if (loginPage && !wantedLoginPage) {
       this.log.debug('Found login page');
       if (this.config.get('security.disableTestUser')) {
-        await this.login.login(
+        await this.loginPage.login(
           this.config.get('servers.kibana.username'),
           this.config.get('servers.kibana.password')
         );
       } else {
-        await this.login.login('test_user', 'changeme');
+        await this.loginPage.login('test_user', 'changeme');
       }
 
       if (appUrl.includes('/status')) {
@@ -344,6 +345,12 @@ export class CommonPageObject extends FtrService {
     await this.browser.pressKeys(this.browser.keys.TAB);
   }
 
+  // Pause the browser at a certain place for debugging
+  // Not meant for usage in CI, only for dev-usage
+  async pause() {
+    return this.browser.pause();
+  }
+
   /**
    * Clicks cancel button on modal
    * @param overlayWillStay pass in true if your test will show multiple modals in succession
@@ -402,7 +409,7 @@ export class CommonPageObject extends FtrService {
     const toastShown = await this.find.existsByCssSelector('.euiToast');
     if (toastShown) {
       try {
-        await this.closeToast();
+        await this.find.clickByCssSelector('.euiToast__closeButton');
       } catch (err) {
         // ignore errors, toast clear themselves after timeout
       }
@@ -495,4 +502,12 @@ export class CommonPageObject extends FtrService {
       await this.testSubjects.exists(validator);
     }
   }
+
+  async setTime(time: { from: string; to: string }) {
+    await this.kibanaServer.uiSettings.replace({ 'timepicker:timeDefaults': JSON.stringify(time) });
+  }
+
+  async unsetTime() {
+    await this.kibanaServer.uiSettings.unset('timepicker:timeDefaults');
+  }
 }

From 56d1c9b7c98d39642c5d1ccd30743342090d9221 Mon Sep 17 00:00:00 2001
From: Diana Derevyankina
 <54894989+DziyanaDzeraviankina@users.noreply.github.com>
Date: Tue, 19 Oct 2021 17:43:28 +0300
Subject: [PATCH 16/36] Respect external URL allow list in TSVB (#114093)
 (#115550)

* Respect external URL allow list in TSVB

* Remove showExternalUrlErrorModal and onContextMenu handler for table

* Update modal message

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../lib/external_url_error_modal.tsx          | 60 +++++++++++++++++++
 .../components/vis_types/table/vis.js         | 57 ++++++++++++++----
 .../components/vis_types/top_n/vis.js         | 21 ++++++-
 3 files changed, 125 insertions(+), 13 deletions(-)
 create mode 100644 src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx

diff --git a/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx b/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx
new file mode 100644
index 0000000000000..ebb806387d9cf
--- /dev/null
+++ b/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiButton,
+  EuiModal,
+  EuiModalBody,
+  EuiModalFooter,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiTextColor,
+} from '@elastic/eui';
+
+interface ExternalUrlErrorModalProps {
+  url: string;
+  handleClose: () => void;
+}
+
+export const ExternalUrlErrorModal = ({ url, handleClose }: ExternalUrlErrorModalProps) => (
+  <EuiModal onClose={handleClose}>
+    <EuiModalHeader>
+      <EuiModalHeaderTitle>
+        <FormattedMessage
+          id="visTypeTimeseries.externalUrlErrorModal.headerTitle"
+          defaultMessage="Access to this external URL is not yet enabled"
+        />
+      </EuiModalHeaderTitle>
+    </EuiModalHeader>
+    <EuiModalBody>
+      <FormattedMessage
+        id="visTypeTimeseries.externalUrlErrorModal.bodyMessage"
+        defaultMessage="Configure {externalUrlPolicy} in your {kibanaConfigFileName} to allow access to {url}."
+        values={{
+          url: (
+            <EuiTextColor color="warning" component="span">
+              {url}
+            </EuiTextColor>
+          ),
+          externalUrlPolicy: 'externalUrl.policy',
+          kibanaConfigFileName: 'kibana.yml',
+        }}
+      />
+    </EuiModalBody>
+    <EuiModalFooter>
+      <EuiButton onClick={handleClose} fill>
+        <FormattedMessage
+          id="visTypeTimeseries.externalUrlErrorModal.closeButtonLabel"
+          defaultMessage="Close"
+        />
+      </EuiButton>
+    </EuiModalFooter>
+  </EuiModal>
+);
diff --git a/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js b/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
index 7b1db4b362647..b3a48a997b301 100644
--- a/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
+++ b/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
@@ -17,6 +17,7 @@ import { createFieldFormatter } from '../../lib/create_field_formatter';
 import { isSortable } from './is_sortable';
 import { EuiToolTip, EuiIcon } from '@elastic/eui';
 import { replaceVars } from '../../lib/replace_vars';
+import { ExternalUrlErrorModal } from '../../lib/external_url_error_modal';
 import { FIELD_FORMAT_IDS } from '../../../../../../../../plugins/field_formats/common';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { getFieldFormats, getCoreStart } from '../../../../services';
@@ -53,12 +54,26 @@ class TableVis extends Component {
     const DateFormat = fieldFormatsService.getType(FIELD_FORMAT_IDS.DATE);
 
     this.dateFormatter = new DateFormat({}, this.props.getConfig);
+
+    this.state = {
+      accessDeniedDrilldownUrl: null,
+    };
   }
 
   get visibleSeries() {
     return get(this.props, 'model.series', []).filter((series) => !series.hidden);
   }
 
+  createDrilldownUrlClickHandler = (url) => (event) => {
+    const validatedUrl = getCoreStart().http.externalUrl.validateUrl(url);
+    if (validatedUrl) {
+      this.setState({ accessDeniedDrilldownUrl: null });
+    } else {
+      event.preventDefault();
+      this.setState({ accessDeniedDrilldownUrl: url });
+    }
+  };
+
   renderRow = (row) => {
     const { model, fieldFormatMap, getConfig } = this.props;
 
@@ -74,7 +89,16 @@ class TableVis extends Component {
 
     if (model.drilldown_url) {
       const url = replaceVars(model.drilldown_url, {}, { key: row.key });
-      rowDisplay = <a href={sanitizeUrl(url)}>{rowDisplay}</a>;
+      const handleDrilldownUrlClick = this.createDrilldownUrlClickHandler(url);
+      rowDisplay = (
+        <a
+          href={sanitizeUrl(url)}
+          onClick={handleDrilldownUrlClick}
+          onContextMenu={handleDrilldownUrlClick}
+        >
+          {rowDisplay}
+        </a>
+      );
     }
 
     const columns = row.series
@@ -213,8 +237,11 @@ class TableVis extends Component {
     );
   }
 
+  closeExternalUrlErrorModal = () => this.setState({ accessDeniedDrilldownUrl: null });
+
   render() {
     const { visData, model } = this.props;
+    const { accessDeniedDrilldownUrl } = this.state;
     const header = this.renderHeader();
     let rows;
 
@@ -239,16 +266,24 @@ class TableVis extends Component {
       );
     }
     return (
-      <RedirectAppLinks
-        application={getCoreStart().application}
-        className="tvbVis"
-        data-test-subj="tableView"
-      >
-        <table className="table">
-          <thead>{header}</thead>
-          <tbody>{rows}</tbody>
-        </table>
-      </RedirectAppLinks>
+      <>
+        <RedirectAppLinks
+          application={getCoreStart().application}
+          className="tvbVis"
+          data-test-subj="tableView"
+        >
+          <table className="table">
+            <thead>{header}</thead>
+            <tbody>{rows}</tbody>
+          </table>
+        </RedirectAppLinks>
+        {accessDeniedDrilldownUrl && (
+          <ExternalUrlErrorModal
+            url={accessDeniedDrilldownUrl}
+            handleClose={this.closeExternalUrlErrorModal}
+          />
+        )}
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js b/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
index 8176f6ece2805..5eb850a753384 100644
--- a/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
+++ b/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
@@ -15,10 +15,11 @@ import { getLastValue } from '../../../../../common/last_value_utils';
 import { isBackgroundInverted } from '../../../lib/set_is_reversed';
 import { replaceVars } from '../../lib/replace_vars';
 import PropTypes from 'prop-types';
-import React from 'react';
+import React, { useState, useCallback } from 'react';
 import { sortBy, first, get } from 'lodash';
 import { DATA_FORMATTERS } from '../../../../../common/enums';
 import { getOperator, shouldOperate } from '../../../../../common/operators_utils';
+import { ExternalUrlErrorModal } from '../../lib/external_url_error_modal';
 
 function sortByDirection(data, direction, fn) {
   if (direction === 'desc') {
@@ -41,6 +42,8 @@ function sortSeries(visData, model) {
 }
 
 function TopNVisualization(props) {
+  const [accessDeniedDrilldownUrl, setAccessDeniedDrilldownUrl] = useState(null);
+  const coreStart = getCoreStart();
   const { backgroundColor, model, visData, fieldFormatMap, getConfig } = props;
 
   const series = sortSeries(visData, model).map((item) => {
@@ -83,13 +86,27 @@ function TopNVisualization(props) {
   if (model.drilldown_url) {
     params.onClick = (item) => {
       const url = replaceVars(model.drilldown_url, {}, { key: item.label });
-      getCoreStart().application.navigateToUrl(url);
+      const validatedUrl = coreStart.http.externalUrl.validateUrl(url);
+      if (validatedUrl) {
+        setAccessDeniedDrilldownUrl(null);
+        coreStart.application.navigateToUrl(url);
+      } else {
+        setAccessDeniedDrilldownUrl(url);
+      }
     };
   }
 
+  const closeExternalUrlErrorModal = useCallback(() => setAccessDeniedDrilldownUrl(null), []);
+
   return (
     <div className="tvbVis" style={style}>
       <TopN {...params} />
+      {accessDeniedDrilldownUrl && (
+        <ExternalUrlErrorModal
+          url={accessDeniedDrilldownUrl}
+          handleClose={closeExternalUrlErrorModal}
+        />
+      )}
     </div>
   );
 }

From b4f1db42d1e835be5e7a134c31a874d984d680bc Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:19:27 -0400
Subject: [PATCH 17/36] Fixes console errors seen (#115448) (#115494)

## Summary

During testing I encountered this error message:

```
[2021-10-18T13:19:07.053-06:00][ERROR][plugins.securitySolution] The notification throttle "from" and/or "to" range values could not be constructed as valid. Tried to construct the values of "from": now-null "to": 2021-10-18T19:19:00.835Z. This will cause a reset of the notification throttle. Expect either missing alert notifications or alert notifications happening earlier than expected.
```

This error was happening whenever I had a rule that was using an immediately invoked action and was encountering an error such as a non ECS compliant signal.  The root cause is that I was not checking everywhere to ensure we had a throttle rule to ensure scheduling.

This fixes that by adding an `if` statement/guard around the areas of code.

I also improve the error message by adding which ruleId the error is coming from.

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

Co-authored-by: Frank Hassanabad <frank.hassanabad@elastic.co>
---
 ...dule_throttle_notification_actions.test.ts |  2 +-
 .../schedule_throttle_notification_actions.ts |  1 +
 .../create_security_rule_type_wrapper.ts      | 60 +++++++++--------
 .../legacy_notifications/one_action.json      |  2 +-
 .../signals/signal_rule_alert_type.test.ts    | 64 ++++++++++++++++++-
 .../signals/signal_rule_alert_type.ts         | 61 +++++++++---------
 6 files changed, 129 insertions(+), 61 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.test.ts
index 81f229c636bd8..964df3c91eb08 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.test.ts
@@ -278,7 +278,7 @@ describe('schedule_throttle_notification_actions', () => {
     });
 
     expect(logger.error).toHaveBeenCalledWith(
-      'The notification throttle "from" and/or "to" range values could not be constructed as valid. Tried to construct the values of "from": now-invalid "to": 2021-08-24T19:19:22.094Z. This will cause a reset of the notification throttle. Expect either missing alert notifications or alert notifications happening earlier than expected.'
+      'The notification throttle "from" and/or "to" range values could not be constructed as valid. Tried to construct the values of "from": now-invalid "to": 2021-08-24T19:19:22.094Z. This will cause a reset of the notification throttle. Expect either missing alert notifications or alert notifications happening earlier than expected. Check your rule with ruleId: "rule-123" for data integrity issues'
     );
   });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts
index 5bf18496e6375..7b4b314cc8911 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts
@@ -145,6 +145,7 @@ export const scheduleThrottledNotificationActions = async ({
         ` "from": now-${throttle}`,
         ` "to": ${startedAt.toISOString()}.`,
         ' This will cause a reset of the notification throttle. Expect either missing alert notifications or alert notifications happening earlier than expected.',
+        ` Check your rule with ruleId: "${ruleId}" for data integrity issues`,
       ].join('')
     );
   }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
index 0ad416e86e31a..0fe7cbdc9bd9f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
@@ -375,20 +375,22 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
             );
           } else {
             // NOTE: Since this is throttled we have to call it even on an error condition, otherwise it will "reset" the throttle and fire early
-            await scheduleThrottledNotificationActions({
-              alertInstance: services.alertInstanceFactory(alertId),
-              throttle: ruleSO.attributes.throttle,
-              startedAt,
-              id: ruleSO.id,
-              kibanaSiemAppUrl: (meta as { kibana_siem_app_url?: string } | undefined)
-                ?.kibana_siem_app_url,
-              outputIndex: ruleDataClient.indexName,
-              ruleId,
-              esClient: services.scopedClusterClient.asCurrentUser,
-              notificationRuleParams,
-              signals: result.createdSignals,
-              logger,
-            });
+            if (ruleSO.attributes.throttle != null) {
+              await scheduleThrottledNotificationActions({
+                alertInstance: services.alertInstanceFactory(alertId),
+                throttle: ruleSO.attributes.throttle,
+                startedAt,
+                id: ruleSO.id,
+                kibanaSiemAppUrl: (meta as { kibana_siem_app_url?: string } | undefined)
+                  ?.kibana_siem_app_url,
+                outputIndex: ruleDataClient.indexName,
+                ruleId,
+                esClient: services.scopedClusterClient.asCurrentUser,
+                notificationRuleParams,
+                signals: result.createdSignals,
+                logger,
+              });
+            }
             const errorMessage = buildRuleMessage(
               'Bulk Indexing of signals failed:',
               truncateMessageList(result.errors).join()
@@ -407,20 +409,22 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
           }
         } catch (error) {
           // NOTE: Since this is throttled we have to call it even on an error condition, otherwise it will "reset" the throttle and fire early
-          await scheduleThrottledNotificationActions({
-            alertInstance: services.alertInstanceFactory(alertId),
-            throttle: ruleSO.attributes.throttle,
-            startedAt,
-            id: ruleSO.id,
-            kibanaSiemAppUrl: (meta as { kibana_siem_app_url?: string } | undefined)
-              ?.kibana_siem_app_url,
-            outputIndex: ruleDataClient.indexName,
-            ruleId,
-            esClient: services.scopedClusterClient.asCurrentUser,
-            notificationRuleParams,
-            signals: result.createdSignals,
-            logger,
-          });
+          if (ruleSO.attributes.throttle != null) {
+            await scheduleThrottledNotificationActions({
+              alertInstance: services.alertInstanceFactory(alertId),
+              throttle: ruleSO.attributes.throttle,
+              startedAt,
+              id: ruleSO.id,
+              kibanaSiemAppUrl: (meta as { kibana_siem_app_url?: string } | undefined)
+                ?.kibana_siem_app_url,
+              outputIndex: ruleDataClient.indexName,
+              ruleId,
+              esClient: services.scopedClusterClient.asCurrentUser,
+              notificationRuleParams,
+              signals: result.createdSignals,
+              logger,
+            });
+          }
 
           const errorMessage = error.message ?? '(no error message given)';
           const message = buildRuleMessage(
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/legacy_notifications/one_action.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/legacy_notifications/one_action.json
index 1966dcf5ff53c..bf980e370e3a3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/legacy_notifications/one_action.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/legacy_notifications/one_action.json
@@ -3,7 +3,7 @@
   "interval": "1m",
   "actions": [
     {
-      "id": "42534430-2092-11ec-99a6-05d79563c01a",
+      "id": "1fa31c30-3046-11ec-8971-1f3f7bae65af",
       "group": "default",
       "params": {
         "message": "Hourly\nRule {{context.rule.name}} generated {{state.signals_count}} alerts"
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
index 88b276358a705..6a84776ccee5d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
@@ -536,14 +536,74 @@ describe('signal_rule_alert_type', () => {
         errors: ['Error that bubbled up.'],
       };
       (queryExecutor as jest.Mock).mockResolvedValue(result);
-      await alert.executor(payload);
+      const ruleAlert = getAlertMock(false, getQueryRuleParams());
+      ruleAlert.throttle = '1h';
+      const payLoadWithThrottle = getPayload(
+        ruleAlert,
+        alertServices
+      ) as jest.Mocked<RuleExecutorOptions>;
+      payLoadWithThrottle.rule.throttle = '1h';
+      alertServices.savedObjectsClient.get.mockResolvedValue({
+        id: 'id',
+        type: 'type',
+        references: [],
+        attributes: ruleAlert,
+      });
+      await alert.executor(payLoadWithThrottle);
       expect(scheduleThrottledNotificationActions).toHaveBeenCalledTimes(1);
     });
 
+    it('should NOT call scheduleThrottledNotificationActions if result is false and the throttle is not set', async () => {
+      const result: SearchAfterAndBulkCreateReturnType = {
+        success: false,
+        warning: false,
+        searchAfterTimes: [],
+        bulkCreateTimes: [],
+        lastLookBackDate: null,
+        createdSignalsCount: 0,
+        createdSignals: [],
+        warningMessages: [],
+        errors: ['Error that bubbled up.'],
+      };
+      (queryExecutor as jest.Mock).mockResolvedValue(result);
+      await alert.executor(payload);
+      expect(scheduleThrottledNotificationActions).toHaveBeenCalledTimes(0);
+    });
+
     it('should call scheduleThrottledNotificationActions if an error was thrown to prevent the throttle from being reset', async () => {
       (queryExecutor as jest.Mock).mockRejectedValue({});
-      await alert.executor(payload);
+      const ruleAlert = getAlertMock(false, getQueryRuleParams());
+      ruleAlert.throttle = '1h';
+      const payLoadWithThrottle = getPayload(
+        ruleAlert,
+        alertServices
+      ) as jest.Mocked<RuleExecutorOptions>;
+      payLoadWithThrottle.rule.throttle = '1h';
+      alertServices.savedObjectsClient.get.mockResolvedValue({
+        id: 'id',
+        type: 'type',
+        references: [],
+        attributes: ruleAlert,
+      });
+      await alert.executor(payLoadWithThrottle);
       expect(scheduleThrottledNotificationActions).toHaveBeenCalledTimes(1);
     });
+
+    it('should NOT call scheduleThrottledNotificationActions if an error was thrown to prevent the throttle from being reset if throttle is not defined', async () => {
+      const result: SearchAfterAndBulkCreateReturnType = {
+        success: false,
+        warning: false,
+        searchAfterTimes: [],
+        bulkCreateTimes: [],
+        lastLookBackDate: null,
+        createdSignalsCount: 0,
+        createdSignals: [],
+        warningMessages: [],
+        errors: ['Error that bubbled up.'],
+      };
+      (queryExecutor as jest.Mock).mockRejectedValue(result);
+      await alert.executor(payload);
+      expect(scheduleThrottledNotificationActions).toHaveBeenCalledTimes(0);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 4e98bee83aeb5..90220814fb928 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -474,21 +474,22 @@ export const signalRulesAlertType = ({
           );
         } else {
           // NOTE: Since this is throttled we have to call it even on an error condition, otherwise it will "reset" the throttle and fire early
-          await scheduleThrottledNotificationActions({
-            alertInstance: services.alertInstanceFactory(alertId),
-            throttle: savedObject.attributes.throttle,
-            startedAt,
-            id: savedObject.id,
-            kibanaSiemAppUrl: (meta as { kibana_siem_app_url?: string } | undefined)
-              ?.kibana_siem_app_url,
-            outputIndex,
-            ruleId,
-            signals: result.createdSignals,
-            esClient: services.scopedClusterClient.asCurrentUser,
-            notificationRuleParams,
-            logger,
-          });
-
+          if (savedObject.attributes.throttle != null) {
+            await scheduleThrottledNotificationActions({
+              alertInstance: services.alertInstanceFactory(alertId),
+              throttle: savedObject.attributes.throttle,
+              startedAt,
+              id: savedObject.id,
+              kibanaSiemAppUrl: (meta as { kibana_siem_app_url?: string } | undefined)
+                ?.kibana_siem_app_url,
+              outputIndex,
+              ruleId,
+              signals: result.createdSignals,
+              esClient: services.scopedClusterClient.asCurrentUser,
+              notificationRuleParams,
+              logger,
+            });
+          }
           const errorMessage = buildRuleMessage(
             'Bulk Indexing of signals failed:',
             truncateMessageList(result.errors).join()
@@ -507,20 +508,22 @@ export const signalRulesAlertType = ({
         }
       } catch (error) {
         // NOTE: Since this is throttled we have to call it even on an error condition, otherwise it will "reset" the throttle and fire early
-        await scheduleThrottledNotificationActions({
-          alertInstance: services.alertInstanceFactory(alertId),
-          throttle: savedObject.attributes.throttle,
-          startedAt,
-          id: savedObject.id,
-          kibanaSiemAppUrl: (meta as { kibana_siem_app_url?: string } | undefined)
-            ?.kibana_siem_app_url,
-          outputIndex,
-          ruleId,
-          signals: result.createdSignals,
-          esClient: services.scopedClusterClient.asCurrentUser,
-          notificationRuleParams,
-          logger,
-        });
+        if (savedObject.attributes.throttle != null) {
+          await scheduleThrottledNotificationActions({
+            alertInstance: services.alertInstanceFactory(alertId),
+            throttle: savedObject.attributes.throttle,
+            startedAt,
+            id: savedObject.id,
+            kibanaSiemAppUrl: (meta as { kibana_siem_app_url?: string } | undefined)
+              ?.kibana_siem_app_url,
+            outputIndex,
+            ruleId,
+            signals: result.createdSignals,
+            esClient: services.scopedClusterClient.asCurrentUser,
+            notificationRuleParams,
+            logger,
+          });
+        }
         const errorMessage = error.message ?? '(no error message given)';
         const message = buildRuleMessage(
           'An error occurred during rule execution:',

From 635859f9ff519f0508189b99d946e2127741fe3a Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:19:40 -0400
Subject: [PATCH 18/36] [APM] Ensure APM deprecation documentationUrl point to
 correct doc branch (#115401) (#115482)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* using branch in the url

* fixing TS

Co-authored-by: Cauê Marcondes <55978943+cauemarcondes@users.noreply.github.com>
---
 x-pack/plugins/apm/server/deprecations/deprecations.test.ts | 5 ++++-
 x-pack/plugins/apm/server/deprecations/index.ts             | 5 +++--
 x-pack/plugins/apm/server/plugin.ts                         | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/apm/server/deprecations/deprecations.test.ts b/x-pack/plugins/apm/server/deprecations/deprecations.test.ts
index d706146faf212..43e8140fb9b3c 100644
--- a/x-pack/plugins/apm/server/deprecations/deprecations.test.ts
+++ b/x-pack/plugins/apm/server/deprecations/deprecations.test.ts
@@ -19,7 +19,7 @@ const deprecationContext = {
 describe('getDeprecations', () => {
   describe('when fleet is disabled', () => {
     it('returns no deprecations', async () => {
-      const deprecationsCallback = getDeprecations({});
+      const deprecationsCallback = getDeprecations({ branch: 'master' });
       const deprecations = await deprecationsCallback(deprecationContext);
       expect(deprecations).toEqual([]);
     });
@@ -28,6 +28,7 @@ describe('getDeprecations', () => {
   describe('when running on cloud with legacy apm-server', () => {
     it('returns deprecations', async () => {
       const deprecationsCallback = getDeprecations({
+        branch: 'master',
         cloudSetup: { isCloudEnabled: true } as unknown as CloudSetup,
         fleet: {
           start: () => ({
@@ -43,6 +44,7 @@ describe('getDeprecations', () => {
   describe('when running on cloud with fleet', () => {
     it('returns no deprecations', async () => {
       const deprecationsCallback = getDeprecations({
+        branch: 'master',
         cloudSetup: { isCloudEnabled: true } as unknown as CloudSetup,
         fleet: {
           start: () => ({
@@ -58,6 +60,7 @@ describe('getDeprecations', () => {
   describe('when running on prem', () => {
     it('returns no deprecations', async () => {
       const deprecationsCallback = getDeprecations({
+        branch: 'master',
         cloudSetup: { isCloudEnabled: false } as unknown as CloudSetup,
         fleet: {
           start: () => ({ agentPolicyService: { get: () => undefined } }),
diff --git a/x-pack/plugins/apm/server/deprecations/index.ts b/x-pack/plugins/apm/server/deprecations/index.ts
index b592a2bf13268..76c90270abb8f 100644
--- a/x-pack/plugins/apm/server/deprecations/index.ts
+++ b/x-pack/plugins/apm/server/deprecations/index.ts
@@ -15,9 +15,11 @@ import { APMRouteHandlerResources } from '../';
 export function getDeprecations({
   cloudSetup,
   fleet,
+  branch,
 }: {
   cloudSetup?: CloudSetup;
   fleet?: APMRouteHandlerResources['plugins']['fleet'];
+  branch: string;
 }) {
   return async ({
     savedObjectsClient,
@@ -46,8 +48,7 @@ export function getDeprecations({
           defaultMessage:
             'Running the APM Server binary directly is considered a legacy option and is deprecated since 7.16. Switch to APM Server managed by an Elastic Agent instead. Read our documentation to learn more.',
         }),
-        documentationUrl:
-          'https://www.elastic.co/guide/en/apm/server/current/apm-integration.html',
+        documentationUrl: `https://www.elastic.co/guide/en/apm/server/${branch}/apm-integration.html`,
         level: 'warning',
         correctiveActions: {
           manualSteps: [
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index d2d8dbf602364..72a1bc483015e 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -215,10 +215,12 @@ export class APMPlugin
         );
       })();
     });
+
     core.deprecations.registerDeprecations({
       getDeprecations: getDeprecations({
         cloudSetup: plugins.cloud,
         fleet: resourcePlugins.fleet,
+        branch: this.initContext.env.packageInfo.branch,
       }),
     });
 

From c63c2c51569ffa3a2e30f11eac27edc6ef429e6d Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:32:16 -0400
Subject: [PATCH 19/36] [DataTable] Add rowHeightsOptions to table (#114637)
 (#115431)

* Upgraded the version of EUI to 38.2.0 from 38.0.1

* Updated the i18n mappings required for EUI v.38.2.0

* Update i18n snapshots and resolve linting error

* Removed html_id_generator mocks.

Current mock was failing due to missing useGeneratedHtmlId export. This is safe to remove because EUI contains a .testenv that contains an mock for html_id_generator. More info at https://github.com/elastic/eui/blob/master/src/services/accessibility/html_id_generator.testenv.ts

* Resolve linting error in i18n mapping file

* Removed html_id_generator mocks.

Current mock was failing due to missing useGeneratedHtmlId export. This is safe to remove because EUI contains a .testenv that contains a mock for html_id_generator. More info at https://github.com/elastic/eui/blob/master/src/services/accessibility/html_id_generator.testenv.ts

* Update plugin snapshots

* Resolve merge conflict in license_checker config.ts file

* Upgrade EUI to version 39.0.0 from the original target (38.2.0) to handle an issue found with a functional test during the original upgrade

* Updated the i18n mapping for EUI v.39.0.0

* Update various snapshots to account for the an i18n translation token addition in EUI v. 39.0.0

* Updated test cases marked as obsolete by CI

* Update src/dev/license_checker/config.ts

Removing TODO comments from src/dev/license_checker/config.ts as they are no longer needed.

Co-authored-by: Constance <constancecchen@users.noreply.github.com>

* Add option auto fit row to content

* Fix tests

* Fix tests

* Add temp fix for correct rendering grid with auto-height when changing data or setting

* Fix lint

* Fix lint and tests

* Adds new dependency for temp fix

Co-authored-by: Brianna Hall <briannajdhall@gmail.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Bree Hall <40739624+breehall@users.noreply.github.com>
Co-authored-by: Constance <constancecchen@users.noreply.github.com>

Co-authored-by: Uladzislau Lasitsa <Uladzislau_Lasitsa@epam.com>
Co-authored-by: Brianna Hall <briannajdhall@gmail.com>
Co-authored-by: Bree Hall <40739624+breehall@users.noreply.github.com>
Co-authored-by: Constance <constancecchen@users.noreply.github.com>
---
 src/plugins/vis_types/table/common/types.ts   |  1 +
 .../__snapshots__/table_vis_fn.test.ts.snap   |  1 +
 .../table_vis_basic.test.tsx.snap             |  3 ++
 .../components/table_vis_basic.test.tsx       |  3 +-
 .../public/components/table_vis_basic.tsx     | 36 +++++++++++++++++--
 .../public/components/table_vis_cell.tsx      |  4 +--
 .../public/components/table_vis_options.tsx   | 10 ++++++
 .../table/public/table_vis_fn.test.ts         |  1 +
 .../vis_types/table/public/table_vis_fn.ts    |  5 +++
 .../vis_types/table/public/table_vis_type.ts  |  1 +
 src/plugins/vis_types/table/public/to_ast.ts  |  1 +
 11 files changed, 60 insertions(+), 6 deletions(-)

diff --git a/src/plugins/vis_types/table/common/types.ts b/src/plugins/vis_types/table/common/types.ts
index 015af80adf0dc..9f607a964977b 100644
--- a/src/plugins/vis_types/table/common/types.ts
+++ b/src/plugins/vis_types/table/common/types.ts
@@ -24,5 +24,6 @@ export interface TableVisParams {
   showTotal: boolean;
   totalFunc: AggTypes;
   percentageCol: string;
+  autoFitRowToContent?: boolean;
   row?: boolean;
 }
diff --git a/src/plugins/vis_types/table/public/__snapshots__/table_vis_fn.test.ts.snap b/src/plugins/vis_types/table/public/__snapshots__/table_vis_fn.test.ts.snap
index be7e2822f128d..1a2badbd26634 100644
--- a/src/plugins/vis_types/table/public/__snapshots__/table_vis_fn.test.ts.snap
+++ b/src/plugins/vis_types/table/public/__snapshots__/table_vis_fn.test.ts.snap
@@ -26,6 +26,7 @@ Object {
   "type": "render",
   "value": Object {
     "visConfig": Object {
+      "autoFitRowToContent": false,
       "buckets": Array [],
       "metrics": Array [
         Object {
diff --git a/src/plugins/vis_types/table/public/components/__snapshots__/table_vis_basic.test.tsx.snap b/src/plugins/vis_types/table/public/components/__snapshots__/table_vis_basic.test.tsx.snap
index 85cf9422630d6..38e3dcbb7097c 100644
--- a/src/plugins/vis_types/table/public/components/__snapshots__/table_vis_basic.test.tsx.snap
+++ b/src/plugins/vis_types/table/public/components/__snapshots__/table_vis_basic.test.tsx.snap
@@ -17,6 +17,7 @@ exports[`TableVisBasic should init data grid 1`] = `
         "header": "underline",
       }
     }
+    key="0"
     minSizeForControls={1}
     onColumnResize={[Function]}
     renderCellValue={[Function]}
@@ -55,6 +56,7 @@ exports[`TableVisBasic should init data grid with title provided - for split mod
         "header": "underline",
       }
     }
+    key="0"
     minSizeForControls={1}
     onColumnResize={[Function]}
     renderCellValue={[Function]}
@@ -86,6 +88,7 @@ exports[`TableVisBasic should render the toolbar 1`] = `
         "header": "underline",
       }
     }
+    key="0"
     minSizeForControls={1}
     onColumnResize={[Function]}
     renderCellValue={[Function]}
diff --git a/src/plugins/vis_types/table/public/components/table_vis_basic.test.tsx b/src/plugins/vis_types/table/public/components/table_vis_basic.test.tsx
index 0fb74a41b5df0..0296f2ec1327a 100644
--- a/src/plugins/vis_types/table/public/components/table_vis_basic.test.tsx
+++ b/src/plugins/vis_types/table/public/components/table_vis_basic.test.tsx
@@ -67,6 +67,7 @@ describe('TableVisBasic', () => {
   });
 
   it('should sort rows by column and pass the sorted rows for consumers', () => {
+    (createTableVisCell as jest.Mock).mockClear();
     const uiStateProps = {
       ...props.uiStateProps,
       sort: {
@@ -96,7 +97,7 @@ describe('TableVisBasic', () => {
         visConfig={{ ...props.visConfig, showToolbar: true }}
       />
     );
-    expect(createTableVisCell).toHaveBeenCalledWith(sortedRows, table.formattedColumns);
+    expect(createTableVisCell).toHaveBeenCalledWith(sortedRows, table.formattedColumns, undefined);
     expect(createGridColumns).toHaveBeenCalledWith(
       table.columns,
       sortedRows,
diff --git a/src/plugins/vis_types/table/public/components/table_vis_basic.tsx b/src/plugins/vis_types/table/public/components/table_vis_basic.tsx
index e627b9e7f92f2..cfe1ce5d40a1e 100644
--- a/src/plugins/vis_types/table/public/components/table_vis_basic.tsx
+++ b/src/plugins/vis_types/table/public/components/table_vis_basic.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { memo, useCallback, useMemo } from 'react';
+import React, { memo, useCallback, useMemo, useEffect, useState, useRef } from 'react';
 import { EuiDataGrid, EuiDataGridProps, EuiDataGridSorting, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { orderBy } from 'lodash';
@@ -47,8 +47,16 @@ export const TableVisBasic = memo(
 
     // renderCellValue is a component which renders a cell based on column and row indexes
     const renderCellValue = useMemo(
-      () => createTableVisCell(sortedRows, formattedColumns),
-      [formattedColumns, sortedRows]
+      () => createTableVisCell(sortedRows, formattedColumns, visConfig.autoFitRowToContent),
+      [formattedColumns, sortedRows, visConfig.autoFitRowToContent]
+    );
+
+    const rowHeightsOptions = useMemo(
+      () =>
+        visConfig.autoFitRowToContent
+          ? ({ defaultHeight: 'auto' } as unknown as EuiDataGridProps['rowHeightsOptions'])
+          : undefined,
+      [visConfig.autoFitRowToContent]
     );
 
     // Columns config
@@ -103,6 +111,26 @@ export const TableVisBasic = memo(
       [columns, setColumnsWidth]
     );
 
+    const firstRender = useRef(true);
+    const [dataGridUpdateCounter, setDataGridUpdateCounter] = useState(0);
+
+    // key was added as temporary solution to force re-render if we change autoFitRowToContent or we get new data
+    // cause we have problem with correct updating height cache in EUI datagrid when we use auto-height
+    // will be removed as soon as fix problem on EUI side
+    useEffect(() => {
+      // skip first render
+      if (firstRender.current) {
+        firstRender.current = false;
+        return;
+      }
+      // skip if auto height was turned off
+      if (!visConfig.autoFitRowToContent) {
+        return;
+      }
+      // update counter to remount grid from scratch
+      setDataGridUpdateCounter((counter) => counter + 1);
+    }, [visConfig.autoFitRowToContent, table, sort, pagination, columnsWidth]);
+
     return (
       <>
         {title && (
@@ -111,12 +139,14 @@ export const TableVisBasic = memo(
           </EuiTitle>
         )}
         <EuiDataGrid
+          key={String(dataGridUpdateCounter)}
           aria-label={dataGridAriaLabel}
           columns={gridColumns}
           gridStyle={{
             border: 'horizontal',
             header: 'underline',
           }}
+          rowHeightsOptions={rowHeightsOptions}
           rowCount={rows.length}
           columnVisibility={{
             visibleColumns: columns.map(({ id }) => id),
diff --git a/src/plugins/vis_types/table/public/components/table_vis_cell.tsx b/src/plugins/vis_types/table/public/components/table_vis_cell.tsx
index 9749cdcb5740c..7d7af447db489 100644
--- a/src/plugins/vis_types/table/public/components/table_vis_cell.tsx
+++ b/src/plugins/vis_types/table/public/components/table_vis_cell.tsx
@@ -13,7 +13,7 @@ import { DatatableRow } from 'src/plugins/expressions';
 import { FormattedColumns } from '../types';
 
 export const createTableVisCell =
-  (rows: DatatableRow[], formattedColumns: FormattedColumns) =>
+  (rows: DatatableRow[], formattedColumns: FormattedColumns, autoFitRowToContent?: boolean) =>
   ({ rowIndex, columnId }: EuiDataGridCellValueElementProps) => {
     const rowValue = rows[rowIndex][columnId];
     const column = formattedColumns[columnId];
@@ -28,7 +28,7 @@ export const createTableVisCell =
          */
         dangerouslySetInnerHTML={{ __html: content }} // eslint-disable-line react/no-danger
         data-test-subj="tbvChartCellContent"
-        className="tbvChartCellContent"
+        className={autoFitRowToContent ? '' : 'tbvChartCellContent'}
       />
     );
 
diff --git a/src/plugins/vis_types/table/public/components/table_vis_options.tsx b/src/plugins/vis_types/table/public/components/table_vis_options.tsx
index 8a6b8586fce7d..698aca6034a6b 100644
--- a/src/plugins/vis_types/table/public/components/table_vis_options.tsx
+++ b/src/plugins/vis_types/table/public/components/table_vis_options.tsx
@@ -93,6 +93,16 @@ function TableOptions({
         data-test-subj="showMetricsAtAllLevels"
       />
 
+      <SwitchOption
+        label={i18n.translate('visTypeTable.params.autoFitRow', {
+          defaultMessage: 'Auto fit rows to content',
+        })}
+        paramName="autoFitRowToContent"
+        value={stateParams.autoFitRowToContent}
+        setValue={setValue}
+        data-test-subj="autoFitRowToContent"
+      />
+
       <SwitchOption
         label={i18n.translate('visTypeTable.params.showPartialRowsLabel', {
           defaultMessage: 'Show partial rows',
diff --git a/src/plugins/vis_types/table/public/table_vis_fn.test.ts b/src/plugins/vis_types/table/public/table_vis_fn.test.ts
index d0d9a414bbcce..2ddb68695387f 100644
--- a/src/plugins/vis_types/table/public/table_vis_fn.test.ts
+++ b/src/plugins/vis_types/table/public/table_vis_fn.test.ts
@@ -36,6 +36,7 @@ describe('interpreter/functions#table', () => {
     splitColumn: undefined,
     splitRow: undefined,
     showMetricsAtAllLevels: false,
+    autoFitRowToContent: false,
     sort: {
       columnIndex: null,
       direction: null,
diff --git a/src/plugins/vis_types/table/public/table_vis_fn.ts b/src/plugins/vis_types/table/public/table_vis_fn.ts
index ebddb0b4b7fef..861923ef5086e 100644
--- a/src/plugins/vis_types/table/public/table_vis_fn.ts
+++ b/src/plugins/vis_types/table/public/table_vis_fn.ts
@@ -118,6 +118,11 @@ export const createTableVisFn = (): TableExpressionFunctionDefinition => ({
         defaultMessage: 'Specifies calculating function for the total row. Possible options are: ',
       }),
     },
+    autoFitRowToContent: {
+      types: ['boolean'],
+      help: '',
+      default: false,
+    },
   },
   fn(input, args, handlers) {
     const convertedData = tableVisResponseHandler(input, args);
diff --git a/src/plugins/vis_types/table/public/table_vis_type.ts b/src/plugins/vis_types/table/public/table_vis_type.ts
index 4664e87cea79b..a641224e23f52 100644
--- a/src/plugins/vis_types/table/public/table_vis_type.ts
+++ b/src/plugins/vis_types/table/public/table_vis_type.ts
@@ -35,6 +35,7 @@ export const tableVisTypeDefinition: VisTypeDefinition<TableVisParams> = {
       showToolbar: false,
       totalFunc: 'sum',
       percentageCol: '',
+      autoFitRowToContent: false,
     },
   },
   editorConfig: {
diff --git a/src/plugins/vis_types/table/public/to_ast.ts b/src/plugins/vis_types/table/public/to_ast.ts
index 8e1c92c8dde4f..0268708f22dfe 100644
--- a/src/plugins/vis_types/table/public/to_ast.ts
+++ b/src/plugins/vis_types/table/public/to_ast.ts
@@ -64,6 +64,7 @@ export const toExpressionAst: VisToExpressionAst<TableVisParams> = (vis, params)
     showMetricsAtAllLevels: vis.params.showMetricsAtAllLevels,
     showToolbar: vis.params.showToolbar,
     showTotal: vis.params.showTotal,
+    autoFitRowToContent: vis.params.autoFitRowToContent,
     totalFunc: vis.params.totalFunc,
     title: vis.title,
     metrics: metrics.map(prepareDimension),

From 3c0b0c54996452ec69aca8cc2b1b2f24e38158f8 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:32:28 -0400
Subject: [PATCH 20/36] [Fleet] Add beta flag for custom integrations (#115447)
 (#115487)

Co-authored-by: Thomas Neirynck <thomas@elastic.co>
---
 .../integrations/sections/epm/screens/home/index.tsx     | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
index 2d1077f586a1a..4270d360b9294 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
@@ -66,6 +66,13 @@ export const mapToCard = (
     uiInternalPathUrl = url;
   }
 
+  let release: 'ga' | 'beta' | 'experimental' | undefined;
+  if ('release' in item) {
+    release = item.release;
+  } else if (item.isBeta === true) {
+    release = 'beta';
+  }
+
   return {
     id: `${item.type === 'ui_link' ? 'ui_link' : 'epr'}-${item.id}`,
     description: item.description,
@@ -75,7 +82,7 @@ export const mapToCard = (
     integration: 'integration' in item ? item.integration || '' : '',
     name: 'name' in item ? item.name || '' : '',
     version: 'version' in item ? item.version || '' : '',
-    release: 'release' in item ? item.release : undefined,
+    release,
     categories: ((item.categories || []) as string[]).filter((c: string) => !!c),
   };
 };

From 11b35f7156e03818371e94925d9f12bdd70e5650 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:34:19 -0400
Subject: [PATCH 21/36] [Fleet] Address Package Policy upgrade UX review
 (#115414) (#115442)

* Fix package update button + icon

* Adjust order of modal of states based on UX review

* Clarify integration/agent policies in integration UI policy table

Co-authored-by: Kyle Pollich <kyle.pollich@elastic.co>
---
 .../integrations/sections/epm/screens/detail/index.tsx     | 2 +-
 .../epm/screens/detail/policies/package_policies.tsx       | 2 +-
 .../sections/epm/screens/detail/settings/update_button.tsx | 7 +++----
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
index 881fc566c932d..6e3eba19c52e3 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/index.tsx
@@ -452,7 +452,7 @@ export function Detail() {
         name: (
           <FormattedMessage
             id="xpack.fleet.epm.packageDetailsNav.packagePoliciesLinkText"
-            defaultMessage="Policies"
+            defaultMessage="Integration Policies"
           />
         ),
         isSelected: panel === 'policies',
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/policies/package_policies.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/policies/package_policies.tsx
index d6dc7e8440dae..69487454dcb94 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/policies/package_policies.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/policies/package_policies.tsx
@@ -211,7 +211,7 @@ export const PackagePoliciesPage = ({ name, version }: PackagePoliciesPanelProps
       {
         field: 'packagePolicy.name',
         name: i18n.translate('xpack.fleet.epm.packageDetails.integrationList.name', {
-          defaultMessage: 'Integration',
+          defaultMessage: 'Integration Policy',
         }),
         render(_, { packagePolicy }) {
           return <IntegrationDetailsLink packagePolicy={packagePolicy} />;
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/update_button.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/update_button.tsx
index 2acd5634b1e5f..b5a8394fa2cb2 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/update_button.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/update_button.tsx
@@ -154,6 +154,7 @@ export const UpdateButton: React.FunctionComponent<UpdateButtonProps> = ({
       return;
     }
 
+    setIsUpdateModalVisible(false);
     setIsUpgradingPackagePolicies(true);
 
     await installPackage({ name, version, title });
@@ -166,7 +167,6 @@ export const UpdateButton: React.FunctionComponent<UpdateButtonProps> = ({
     );
 
     setIsUpgradingPackagePolicies(false);
-    setIsUpdateModalVisible(false);
 
     notifications.toasts.addSuccess({
       title: toMountPoint(
@@ -285,15 +285,14 @@ export const UpdateButton: React.FunctionComponent<UpdateButtonProps> = ({
       <EuiFlexGroup alignItems="center">
         <EuiFlexItem grow={false}>
           <EuiButton
-            iconType={'refresh'}
-            isLoading={isInstalling}
+            isLoading={isInstalling || isUpgradingPackagePolicies}
             onClick={
               upgradePackagePolicies ? () => setIsUpdateModalVisible(true) : handleClickUpdate
             }
           >
             <FormattedMessage
               id="xpack.fleet.integrations.updatePackage.updatePackageButtonLabel"
-              defaultMessage="Update to latest version"
+              defaultMessage="Upgrade to latest version"
             />
           </EuiButton>
         </EuiFlexItem>

From 51e773fad22e5b2222a31917395ab3cbfed07e39 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:37:03 -0400
Subject: [PATCH 22/36] [Security Solution] Improves the formatting of array
 values and JSON in the Event and Alert Details panels (#115141) (#115532)

## [Security Solution] Improves the formatting of array values and JSON in the Event and Alert Details panels

This PR improves the formatting of array values and JSON in the Event and Alert details panels by:

- in the `Table` tab, formatting array values such that each value appears on a separate line, (instead of joining the values on a single line)
- in the `JSON` tab, displaying the raw search hit JSON, instead displaying a JSON representation based on the `Fields` API

### Table value formatting

In the Event and Alert details `Table` tab, array values were joined on a single line, as shown in the _before_ screenshot below:

![event-details-value-formatting-before](https://user-images.githubusercontent.com/4459398/137524968-6450cd73-3154-457d-b850-32a3e7faaab2.png)

_Above: (before) array values were joined on a single line_

Array values are now formatted such that each value appears on a separate line, as shown in the _after_ screenshot below:

![event-details-value-formatting-after](https://user-images.githubusercontent.com/4459398/137436705-b0bec735-5a83-402e-843a-2776e1c80da9.png)

_Above: (after) array values each appear on a separte line_

### JSON formatting

The `JSON` tab previously displayed a JSON representation based on the `Fields` API. Array values were previously represented as a joined string, as shown in the _before_ screenshot below:

![event-details-json-formatting-before](https://user-images.githubusercontent.com/4459398/137525039-d1b14f21-5f9c-4201-905e-8b08f00bb5a0.png)

_Above: (before) array values were previously represented as a joined string_

The `JSON` tab now displays the raw search hit JSON, per the _after_ screenshot below:

![event-details-json-formatting-after](https://user-images.githubusercontent.com/4459398/137437257-330c5b49-a4ad-418e-a976-923f7a35c0cf.png)

_Above: (after) the `JSON` tab displays the raw search hit_

CC @monina-n @paulewing

Co-authored-by: Andrew Goldstein <andrew-goldstein@users.noreply.github.com>
---
 .../detection_alerts/alerts_details.spec.ts   |  20 +-
 .../detection_alerts/cti_enrichments.spec.ts  |  49 ++-
 .../cypress/screens/alerts_details.ts         |   2 +
 .../alert_summary_view.test.tsx.snap          | 120 ++++--
 .../__snapshots__/json_view.test.tsx.snap     | 343 ++++++++++++++++--
 .../event_details/event_details.test.tsx      |   3 +-
 .../event_details/event_details.tsx           |   6 +-
 .../event_details/json_view.test.tsx          |  49 +--
 .../components/event_details/json_view.tsx    |  23 +-
 .../table/field_value_cell.test.tsx           | 193 ++++++++++
 .../event_details/table/field_value_cell.tsx  |  26 +-
 .../public/common/mock/mock_detail_item.ts    | 188 ++++++++++
 .../event_details/expandable_event.tsx        |   3 +
 .../side_panel/event_details/index.tsx        |   4 +-
 .../timelines/containers/details/index.tsx    |   7 +-
 .../timeline/events/details/index.ts          |   1 +
 .../timeline/factory/events/details/index.ts  |   4 +
 17 files changed, 872 insertions(+), 169 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx

diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
index 8908adb42f202..d211a5914656b 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import { ALERT_FLYOUT, CELL_TEXT, JSON_LINES, TABLE_ROWS } from '../../screens/alerts_details';
+import { ALERT_FLYOUT, CELL_TEXT, JSON_TEXT, TABLE_ROWS } from '../../screens/alerts_details';
 
 import {
   expandFirstAlert,
   waitForAlertsIndexToBeCreated,
   waitForAlertsPanelToBeLoaded,
 } from '../../tasks/alerts';
-import { openJsonView, openTable, scrollJsonViewToBottom } from '../../tasks/alerts_details';
+import { openJsonView, openTable } from '../../tasks/alerts_details';
 import { createCustomRuleActivated } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
 import { esArchiverLoad } from '../../tasks/es_archiver';
@@ -36,20 +36,14 @@ describe('Alert details with unmapped fields', () => {
   });
 
   it('Displays the unmapped field on the JSON view', () => {
-    const expectedUnmappedField = { line: 2, text: '  "unmapped": "This is the unmapped field"' };
+    const expectedUnmappedValue = 'This is the unmapped field';
 
     openJsonView();
-    scrollJsonViewToBottom();
 
-    cy.get(ALERT_FLYOUT)
-      .find(JSON_LINES)
-      .then((elements) => {
-        const length = elements.length;
-        cy.wrap(elements)
-          .eq(length - expectedUnmappedField.line)
-          .invoke('text')
-          .should('include', expectedUnmappedField.text);
-      });
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.unmapped).to.equal(expectedUnmappedValue);
+    });
   });
 
   it('Displays the unmapped field on the table', () => {
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
index b3c6abcd8e426..f15e7adbbca44 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
@@ -10,7 +10,7 @@ import { cleanKibana, reload } from '../../tasks/common';
 import { esArchiverLoad, esArchiverUnload } from '../../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import {
-  JSON_LINES,
+  JSON_TEXT,
   TABLE_CELL,
   TABLE_ROWS,
   THREAT_DETAILS_VIEW,
@@ -28,11 +28,7 @@ import {
   viewThreatIntelTab,
 } from '../../tasks/alerts';
 import { createCustomIndicatorRule } from '../../tasks/api_calls/rules';
-import {
-  openJsonView,
-  openThreatIndicatorDetails,
-  scrollJsonViewToBottom,
-} from '../../tasks/alerts_details';
+import { openJsonView, openThreatIndicatorDetails } from '../../tasks/alerts_details';
 
 import { ALERTS_URL } from '../../urls/navigation';
 import { addsFieldsToTimeline } from '../../tasks/rule_details';
@@ -76,26 +72,39 @@ describe('CTI Enrichment', () => {
 
   it('Displays persisted enrichments on the JSON view', () => {
     const expectedEnrichment = [
-      { line: 4, text: '  "threat": {' },
       {
-        line: 3,
-        text: '    "enrichments": "{\\"indicator\\":{\\"first_seen\\":\\"2021-03-10T08:02:14.000Z\\",\\"file\\":{\\"size\\":80280,\\"pe\\":{},\\"type\\":\\"elf\\",\\"hash\\":{\\"sha256\\":\\"a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3\\",\\"tlsh\\":\\"6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE\\",\\"ssdeep\\":\\"1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL\\",\\"md5\\":\\"9b6c3518a91d23ed77504b5416bfb5b3\\"}},\\"type\\":\\"file\\"},\\"matched\\":{\\"atomic\\":\\"a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3\\",\\"field\\":\\"myhash.mysha256\\",\\"id\\":\\"84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f\\",\\"index\\":\\"logs-ti_abusech.malware\\",\\"type\\":\\"indicator_match_rule\\"}}"',
+        indicator: {
+          first_seen: '2021-03-10T08:02:14.000Z',
+          file: {
+            size: 80280,
+            pe: {},
+            type: 'elf',
+            hash: {
+              sha256: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
+              tlsh: '6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE',
+              ssdeep:
+                '1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL',
+              md5: '9b6c3518a91d23ed77504b5416bfb5b3',
+            },
+          },
+          type: 'file',
+        },
+        matched: {
+          atomic: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
+          field: 'myhash.mysha256',
+          id: '84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f',
+          index: 'logs-ti_abusech.malware',
+          type: 'indicator_match_rule',
+        },
       },
-      { line: 2, text: '  }' },
     ];
 
     expandFirstAlert();
     openJsonView();
-    scrollJsonViewToBottom();
-
-    cy.get(JSON_LINES).then((elements) => {
-      const length = elements.length;
-      expectedEnrichment.forEach((enrichment) => {
-        cy.wrap(elements)
-          .eq(length - enrichment.line)
-          .invoke('text')
-          .should('include', enrichment.text);
-      });
+
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.threat.enrichments).to.deep.equal(expectedEnrichment);
     });
   });
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
index c740a669d059a..584fba05452f0 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
@@ -28,6 +28,8 @@ export const JSON_LINES = '.euiCodeBlock__line';
 
 export const JSON_VIEW_TAB = '[data-test-subj="jsonViewTab"]';
 
+export const JSON_TEXT = '[data-test-subj="jsonView"]';
+
 export const TABLE_CELL = '.euiTableRowCell';
 
 export const TABLE_TAB = '[data-test-subj="tableTab"]';
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
index d367c68586be1..930e1282ebca5 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
@@ -138,12 +138,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.status"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  open
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    open
+                  </div>
                 </div>
               </div>
               <div
@@ -204,10 +209,11 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-@timestamp"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
@@ -274,12 +280,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  xxx
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    xxx
+                  </div>
                 </div>
               </div>
               <div
@@ -340,12 +351,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.severity"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  low
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    low
+                  </div>
                 </div>
               </div>
               <div
@@ -406,12 +422,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.risk_score"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  21
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    21
+                  </div>
                 </div>
               </div>
               <div
@@ -472,12 +493,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-host.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  windows-native
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    windows-native
+                  </div>
                 </div>
               </div>
               <div
@@ -538,12 +564,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-user.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  administrator
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    administrator
+                  </div>
                 </div>
               </div>
               <div
@@ -604,10 +635,11 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-source.ip"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor"
@@ -800,12 +832,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.status"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  open
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    open
+                  </div>
                 </div>
               </div>
               <div
@@ -866,10 +903,11 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-@timestamp"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
@@ -936,12 +974,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  xxx
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    xxx
+                  </div>
                 </div>
               </div>
               <div
@@ -1002,12 +1045,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.severity"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  low
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    low
+                  </div>
                 </div>
               </div>
               <div
@@ -1068,12 +1116,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.risk_score"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  21
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    21
+                  </div>
                 </div>
               </div>
               <div
@@ -1134,12 +1187,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-host.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  windows-native
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    windows-native
+                  </div>
                 </div>
               </div>
               <div
@@ -1200,12 +1258,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-user.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  administrator
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    administrator
+                  </div>
                 </div>
               </div>
               <div
@@ -1266,10 +1329,11 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-source.ip"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor"
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
index d4e839c4bef77..a2e4971899dcc 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
@@ -10,40 +10,325 @@ exports[`JSON View rendering should match snapshot 1`] = `
     paddingSize="m"
   >
     {
-  "_id": "pEMaMmkBUV60JmNWmWVi",
-  "_index": "filebeat-8.0.0-2019.02.19-000001",
+  "_index": ".ds-logs-endpoint.events.network-default-2021.09.28-000001",
+  "_id": "TUWyf3wBFCFU0qRJTauW",
   "_score": 1,
-  "_type": "_doc",
-  "@timestamp": "2019-02-28T16:50:54.621Z",
-  "agent": {
-    "ephemeral_id": "9d391ef2-a734-4787-8891-67031178c641",
-    "hostname": "siem-kibana",
-    "id": "5de03d5f-52f3-482e-91d4-853c7de073c3",
-    "type": "filebeat",
-    "version": "8.0.0"
-  },
-  "cloud": {
-    "availability_zone": "projects/189716325846/zones/us-east1-b",
-    "instance": {
-      "id": "5412578377715150143",
-      "name": "siem-kibana"
+  "_source": {
+    "agent": {
+      "id": "2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624",
+      "type": "endpoint",
+      "version": "8.0.0-SNAPSHOT"
     },
-    "machine": {
-      "type": "projects/189716325846/machineTypes/n1-standard-1"
+    "process": {
+      "Ext": {
+        "ancestry": [
+          "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=",
+          "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA=="
+        ]
+      },
+      "name": "filebeat",
+      "pid": 22535,
+      "entity_id": "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=",
+      "executable": "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
     },
-    "project": {
-      "id": "elastic-beats"
+    "destination": {
+      "address": "127.0.0.1",
+      "port": 9200,
+      "ip": "127.0.0.1"
     },
-    "provider": "gce"
-  },
-  "destination": {
-    "bytes": 584,
-    "ip": "10.47.8.200",
-    "packets": 4,
-    "port": 902
+    "source": {
+      "address": "127.0.0.1",
+      "port": 54146,
+      "ip": "127.0.0.1"
+    },
+    "message": "Endpoint network event",
+    "network": {
+      "transport": "tcp",
+      "type": "ipv4"
+    },
+    "@timestamp": "2021-10-14T16:45:58.0310772Z",
+    "ecs": {
+      "version": "1.11.0"
+    },
+    "data_stream": {
+      "namespace": "default",
+      "type": "logs",
+      "dataset": "endpoint.events.network"
+    },
+    "elastic": {
+      "agent": {
+        "id": "12345"
+      }
+    },
+    "host": {
+      "hostname": "test-linux-1",
+      "os": {
+        "Ext": {
+          "variant": "Debian"
+        },
+        "kernel": "4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)",
+        "name": "Linux",
+        "family": "debian",
+        "type": "linux",
+        "version": "10",
+        "platform": "debian",
+        "full": "Debian 10"
+      },
+      "ip": [
+        "127.0.0.1",
+        "::1",
+        "10.1.2.3",
+        "2001:0DB8:AC10:FE01::"
+      ],
+      "name": "test-linux-1",
+      "id": "76ea303129f249aa7382338e4263eac1",
+      "mac": [
+        "aa:bb:cc:dd:ee:ff"
+      ],
+      "architecture": "x86_64"
+    },
+    "event": {
+      "agent_id_status": "verified",
+      "sequence": 44872,
+      "ingested": "2021-10-14T16:46:04Z",
+      "created": "2021-10-14T16:45:58.0310772Z",
+      "kind": "event",
+      "module": "endpoint",
+      "action": "connection_attempted",
+      "id": "MKPXftjGeHiQzUNj++++nn6R",
+      "category": [
+        "network"
+      ],
+      "type": [
+        "start"
+      ],
+      "dataset": "endpoint.events.network",
+      "outcome": "unknown"
+    },
+    "user": {
+      "Ext": {
+        "real": {
+          "name": "root",
+          "id": 0
+        }
+      },
+      "name": "root",
+      "id": 0
+    },
+    "group": {
+      "Ext": {
+        "real": {
+          "name": "root",
+          "id": 0
+        }
+      },
+      "name": "root",
+      "id": 0
+    }
   },
-  "event": {
-    "kind": "event"
+  "fields": {
+    "host.os.full.text": [
+      "Debian 10"
+    ],
+    "event.category": [
+      "network"
+    ],
+    "process.name.text": [
+      "filebeat"
+    ],
+    "host.os.name.text": [
+      "Linux"
+    ],
+    "host.os.full": [
+      "Debian 10"
+    ],
+    "host.hostname": [
+      "test-linux-1"
+    ],
+    "process.pid": [
+      22535
+    ],
+    "host.mac": [
+      "42:01:0a:c8:00:32"
+    ],
+    "elastic.agent.id": [
+      "abcdefg-f6d5-4ce6-915d-8f1f8f413624"
+    ],
+    "host.os.version": [
+      "10"
+    ],
+    "host.os.name": [
+      "Linux"
+    ],
+    "source.ip": [
+      "127.0.0.1"
+    ],
+    "destination.address": [
+      "127.0.0.1"
+    ],
+    "host.name": [
+      "test-linux-1"
+    ],
+    "event.agent_id_status": [
+      "verified"
+    ],
+    "event.kind": [
+      "event"
+    ],
+    "event.outcome": [
+      "unknown"
+    ],
+    "group.name": [
+      "root"
+    ],
+    "user.id": [
+      "0"
+    ],
+    "host.os.type": [
+      "linux"
+    ],
+    "process.Ext.ancestry": [
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=",
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA=="
+    ],
+    "user.Ext.real.id": [
+      "0"
+    ],
+    "data_stream.type": [
+      "logs"
+    ],
+    "host.architecture": [
+      "x86_64"
+    ],
+    "process.name": [
+      "filebeat"
+    ],
+    "agent.id": [
+      "2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624"
+    ],
+    "source.port": [
+      54146
+    ],
+    "ecs.version": [
+      "1.11.0"
+    ],
+    "event.created": [
+      "2021-10-14T16:45:58.031Z"
+    ],
+    "agent.version": [
+      "8.0.0-SNAPSHOT"
+    ],
+    "host.os.family": [
+      "debian"
+    ],
+    "destination.port": [
+      9200
+    ],
+    "group.id": [
+      "0"
+    ],
+    "user.name": [
+      "root"
+    ],
+    "source.address": [
+      "127.0.0.1"
+    ],
+    "process.entity_id": [
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA="
+    ],
+    "host.ip": [
+      "127.0.0.1",
+      "::1",
+      "10.1.2.3",
+      "2001:0DB8:AC10:FE01::"
+    ],
+    "process.executable.caseless": [
+      "/opt/elastic/agent/data/elastic-agent-058c40/install/filebeat-8.0.0-snapshot-linux-x86_64/filebeat"
+    ],
+    "event.sequence": [
+      44872
+    ],
+    "agent.type": [
+      "endpoint"
+    ],
+    "process.executable.text": [
+      "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
+    ],
+    "group.Ext.real.name": [
+      "root"
+    ],
+    "event.module": [
+      "endpoint"
+    ],
+    "host.os.kernel": [
+      "4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)"
+    ],
+    "host.os.full.caseless": [
+      "debian 10"
+    ],
+    "host.id": [
+      "76ea303129f249aa7382338e4263eac1"
+    ],
+    "process.name.caseless": [
+      "filebeat"
+    ],
+    "network.type": [
+      "ipv4"
+    ],
+    "process.executable": [
+      "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
+    ],
+    "user.Ext.real.name": [
+      "root"
+    ],
+    "data_stream.namespace": [
+      "default"
+    ],
+    "message": [
+      "Endpoint network event"
+    ],
+    "destination.ip": [
+      "127.0.0.1"
+    ],
+    "network.transport": [
+      "tcp"
+    ],
+    "host.os.Ext.variant": [
+      "Debian"
+    ],
+    "group.Ext.real.id": [
+      "0"
+    ],
+    "event.ingested": [
+      "2021-10-14T16:46:04.000Z"
+    ],
+    "event.action": [
+      "connection_attempted"
+    ],
+    "@timestamp": [
+      "2021-10-14T16:45:58.031Z"
+    ],
+    "host.os.platform": [
+      "debian"
+    ],
+    "data_stream.dataset": [
+      "endpoint.events.network"
+    ],
+    "event.type": [
+      "start"
+    ],
+    "event.id": [
+      "MKPXftjGeHiQzUNj++++nn6R"
+    ],
+    "host.os.name.caseless": [
+      "linux"
+    ],
+    "event.dataset": [
+      "endpoint.events.network"
+    ],
+    "user.name.text": [
+      "root"
+    ]
   }
 }
   </EuiCodeBlock>
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
index a8ba536a75541..37ca3b0b897a6 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
@@ -11,7 +11,7 @@ import React from 'react';
 
 import '../../mock/match_media';
 import '../../mock/react_beautiful_dnd';
-import { mockDetailItemData, mockDetailItemDataId, TestProviders } from '../../mock';
+import { mockDetailItemData, mockDetailItemDataId, rawEventData, TestProviders } from '../../mock';
 
 import { EventDetails, EventsViewType } from './event_details';
 import { mockBrowserFields } from '../../containers/source/mock';
@@ -48,6 +48,7 @@ describe('EventDetails', () => {
     timelineId: 'test',
     eventView: EventsViewType.summaryView,
     hostRisk: { fields: [], loading: true },
+    rawEventData,
   };
 
   const alertsProps = {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index e7092d9d6f466..a8305a635f157 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -61,6 +61,7 @@ interface Props {
   id: string;
   isAlert: boolean;
   isDraggable?: boolean;
+  rawEventData: object | undefined;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
   hostRisk: HostRisk | null;
@@ -106,6 +107,7 @@ const EventDetailsComponent: React.FC<Props> = ({
   id,
   isAlert,
   isDraggable,
+  rawEventData,
   timelineId,
   timelineTabType,
   hostRisk,
@@ -278,12 +280,12 @@ const EventDetailsComponent: React.FC<Props> = ({
         <>
           <EuiSpacer size="m" />
           <TabContentWrapper data-test-subj="jsonViewWrapper">
-            <JsonView data={data} />
+            <JsonView rawEventData={rawEventData} />
           </TabContentWrapper>
         </>
       ),
     }),
-    [data]
+    [rawEventData]
   );
 
   const tabs = useMemo(() => {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
index 696fac6016603..b20270266602d 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
@@ -8,58 +8,15 @@
 import { shallow } from 'enzyme';
 import React from 'react';
 
-import { mockDetailItemData } from '../../mock';
+import { rawEventData } from '../../mock';
 
-import { buildJsonView, JsonView } from './json_view';
+import { JsonView } from './json_view';
 
 describe('JSON View', () => {
   describe('rendering', () => {
     test('should match snapshot', () => {
-      const wrapper = shallow(<JsonView data={mockDetailItemData} />);
+      const wrapper = shallow(<JsonView rawEventData={rawEventData} />);
       expect(wrapper).toMatchSnapshot();
     });
   });
-
-  describe('buildJsonView', () => {
-    test('should match a json', () => {
-      const expectedData = {
-        '@timestamp': '2019-02-28T16:50:54.621Z',
-        _id: 'pEMaMmkBUV60JmNWmWVi',
-        _index: 'filebeat-8.0.0-2019.02.19-000001',
-        _score: 1,
-        _type: '_doc',
-        agent: {
-          ephemeral_id: '9d391ef2-a734-4787-8891-67031178c641',
-          hostname: 'siem-kibana',
-          id: '5de03d5f-52f3-482e-91d4-853c7de073c3',
-          type: 'filebeat',
-          version: '8.0.0',
-        },
-        cloud: {
-          availability_zone: 'projects/189716325846/zones/us-east1-b',
-          instance: {
-            id: '5412578377715150143',
-            name: 'siem-kibana',
-          },
-          machine: {
-            type: 'projects/189716325846/machineTypes/n1-standard-1',
-          },
-          project: {
-            id: 'elastic-beats',
-          },
-          provider: 'gce',
-        },
-        destination: {
-          bytes: 584,
-          ip: '10.47.8.200',
-          packets: 4,
-          port: 902,
-        },
-        event: {
-          kind: 'event',
-        },
-      };
-      expect(buildJsonView(mockDetailItemData)).toEqual(expectedData);
-    });
-  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
index 0614f131bcd10..0227d44f32305 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
@@ -6,15 +6,13 @@
  */
 
 import { EuiCodeBlock } from '@elastic/eui';
-import { set } from '@elastic/safer-lodash-set/fp';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 import { omitTypenameAndEmpty } from '../../../timelines/components/timeline/body/helpers';
 
 interface Props {
-  data: TimelineEventsDetailsItem[];
+  rawEventData: object | undefined;
 }
 
 const EuiCodeEditorContainer = styled.div`
@@ -23,15 +21,15 @@ const EuiCodeEditorContainer = styled.div`
   }
 `;
 
-export const JsonView = React.memo<Props>(({ data }) => {
+export const JsonView = React.memo<Props>(({ rawEventData }) => {
   const value = useMemo(
     () =>
       JSON.stringify(
-        buildJsonView(data),
+        rawEventData,
         omitTypenameAndEmpty,
         2 // indent level
       ),
-    [data]
+    [rawEventData]
   );
 
   return (
@@ -50,16 +48,3 @@ export const JsonView = React.memo<Props>(({ data }) => {
 });
 
 JsonView.displayName = 'JsonView';
-
-export const buildJsonView = (data: TimelineEventsDetailsItem[]) =>
-  data
-    .sort((a, b) => a.field.localeCompare(b.field))
-    .reduce(
-      (accumulator, item) =>
-        set(
-          item.field,
-          Array.isArray(item.originalValue) ? item.originalValue.join() : item.originalValue,
-          accumulator
-        ),
-      {}
-    );
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
new file mode 100644
index 0000000000000..f6c43da2da8ac
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
@@ -0,0 +1,193 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+
+import { BrowserField } from '../../../containers/source';
+import { FieldValueCell } from './field_value_cell';
+import { TestProviders } from '../../../mock';
+import { EventFieldsData } from '../types';
+
+const contextId = 'test';
+
+const eventId = 'TUWyf3wBFCFU0qRJTauW';
+
+const hostIpData: EventFieldsData = {
+  aggregatable: true,
+  ariaRowindex: 35,
+  category: 'host',
+  description: 'Host ip addresses.',
+  example: '127.0.0.1',
+  field: 'host.ip',
+  fields: {},
+  format: '',
+  indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+  isObjectArray: false,
+  name: 'host.ip',
+  originalValue: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+  searchable: true,
+  type: 'ip',
+  values: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+};
+const hostIpValues = ['127.0.0.1', '::1', '10.1.2.3', 'fe80::4001:aff:fec8:32'];
+
+describe('FieldValueCell', () => {
+  describe('common behavior', () => {
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it formats multiple values such that each value is displayed on a single line', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`)).toHaveClass(
+        'euiFlexGroup--directionColumn'
+      );
+    });
+  });
+
+  describe('when `BrowserField` metadata is NOT available', () => {
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            fieldFromBrowserField={undefined} // <-- no metadata
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders each of the expected values when `fieldFromBrowserField` is undefined', () => {
+      hostIpValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+
+    test('it renders values formatted as plain text (without `eventFieldsTable__fieldValue` formatting)', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`).firstChild).not.toHaveClass(
+        'eventFieldsTable__fieldValue'
+      );
+    });
+  });
+
+  describe('`message` field formatting', () => {
+    const messageData: EventFieldsData = {
+      aggregatable: false,
+      ariaRowindex: 50,
+      category: 'base',
+      description:
+        'For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.',
+      example: 'Hello World',
+      field: 'message',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      isObjectArray: false,
+      name: 'message',
+      originalValue: ['Endpoint network event'],
+      searchable: true,
+      type: 'string',
+      values: ['Endpoint network event'],
+    };
+    const messageValues = ['Endpoint network event'];
+
+    const messageFieldFromBrowserField: BrowserField = {
+      aggregatable: false,
+      category: 'base',
+      description:
+        'For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.',
+      example: 'Hello World',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      name: 'message',
+      searchable: true,
+      type: 'string',
+    };
+
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={messageData}
+            eventId={eventId}
+            fieldFromBrowserField={messageFieldFromBrowserField}
+            values={messageValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders special formatting for the `message` field', () => {
+      expect(screen.getByTestId('event-field-message')).toBeInTheDocument();
+    });
+
+    test('it renders the expected message value', () => {
+      messageValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('when `BrowserField` metadata IS available', () => {
+    const hostIpFieldFromBrowserField: BrowserField = {
+      aggregatable: true,
+      category: 'host',
+      description: 'Host ip addresses.',
+      example: '127.0.0.1',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      name: 'host.ip',
+      searchable: true,
+      type: 'ip',
+    };
+
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            fieldFromBrowserField={hostIpFieldFromBrowserField} // <-- metadata
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders values formatted with the expected class', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`).firstChild).toHaveClass(
+        'eventFieldsTable__fieldValue'
+      );
+    });
+
+    test('it renders link buttons for each of the host ip addresses', () => {
+      expect(screen.getAllByRole('button').length).toBe(hostIpValues.length);
+    });
+
+    test('it renders each of the expected values when `fieldFromBrowserField` is provided', () => {
+      hostIpValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
index fc20f84d3650d..dc6c84b8138fe 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { EuiText } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
 import { BrowserField } from '../../../containers/source';
 import { OverflowField } from '../../tables/helpers';
 import { FormattedFieldValue } from '../../../../timelines/components/timeline/body/renderers/formatted_field';
@@ -36,18 +36,28 @@ export const FieldValueCell = React.memo(
     values,
   }: FieldValueCellProps) => {
     return (
-      <div data-test-subj={`event-field-${data.field}`}>
+      <EuiFlexGroup
+        data-test-subj={`event-field-${data.field}`}
+        direction="column"
+        gutterSize="none"
+      >
         {values != null &&
           values.map((value, i) => {
             if (fieldFromBrowserField == null) {
               return (
-                <EuiText size="xs" key={value}>
-                  {value}
-                </EuiText>
+                <EuiFlexItem grow={false} key={`${i}-${value}`}>
+                  <EuiText size="xs" key={`${i}-${value}`}>
+                    {value}
+                  </EuiText>
+                </EuiFlexItem>
               );
             }
             return (
-              <div className="eventFieldsTable__fieldValue" key={value}>
+              <EuiFlexItem
+                className="eventFieldsTable__fieldValue"
+                grow={false}
+                key={`${i}-${value}`}
+              >
                 {data.field === MESSAGE_FIELD_NAME ? (
                   <OverflowField value={value} />
                 ) : (
@@ -63,10 +73,10 @@ export const FieldValueCell = React.memo(
                     linkValue={(getLinkValue && getLinkValue(data.field)) ?? linkValue}
                   />
                 )}
-              </div>
+              </EuiFlexItem>
             );
           })}
-      </div>
+      </EuiFlexGroup>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts b/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
index 3712d389edeb1..035bdbbceff88 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
@@ -139,3 +139,191 @@ export const generateMockDetailItemData = (): TimelineEventsDetailsItem[] => [
 ];
 
 export const mockDetailItemData: TimelineEventsDetailsItem[] = generateMockDetailItemData();
+
+export const rawEventData = {
+  _index: '.ds-logs-endpoint.events.network-default-2021.09.28-000001',
+  _id: 'TUWyf3wBFCFU0qRJTauW',
+  _score: 1,
+  _source: {
+    agent: {
+      id: '2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624',
+      type: 'endpoint',
+      version: '8.0.0-SNAPSHOT',
+    },
+    process: {
+      Ext: {
+        ancestry: [
+          'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=',
+          'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA==',
+        ],
+      },
+      name: 'filebeat',
+      pid: 22535,
+      entity_id: 'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=',
+      executable:
+        '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    },
+    destination: {
+      address: '127.0.0.1',
+      port: 9200,
+      ip: '127.0.0.1',
+    },
+    source: {
+      address: '127.0.0.1',
+      port: 54146,
+      ip: '127.0.0.1',
+    },
+    message: 'Endpoint network event',
+    network: {
+      transport: 'tcp',
+      type: 'ipv4',
+    },
+    '@timestamp': '2021-10-14T16:45:58.0310772Z',
+    ecs: {
+      version: '1.11.0',
+    },
+    data_stream: {
+      namespace: 'default',
+      type: 'logs',
+      dataset: 'endpoint.events.network',
+    },
+    elastic: {
+      agent: {
+        id: '12345',
+      },
+    },
+    host: {
+      hostname: 'test-linux-1',
+      os: {
+        Ext: {
+          variant: 'Debian',
+        },
+        kernel: '4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)',
+        name: 'Linux',
+        family: 'debian',
+        type: 'linux',
+        version: '10',
+        platform: 'debian',
+        full: 'Debian 10',
+      },
+      ip: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+      name: 'test-linux-1',
+      id: '76ea303129f249aa7382338e4263eac1',
+      mac: ['aa:bb:cc:dd:ee:ff'],
+      architecture: 'x86_64',
+    },
+    event: {
+      agent_id_status: 'verified',
+      sequence: 44872,
+      ingested: '2021-10-14T16:46:04Z',
+      created: '2021-10-14T16:45:58.0310772Z',
+      kind: 'event',
+      module: 'endpoint',
+      action: 'connection_attempted',
+      id: 'MKPXftjGeHiQzUNj++++nn6R',
+      category: ['network'],
+      type: ['start'],
+      dataset: 'endpoint.events.network',
+      outcome: 'unknown',
+    },
+    user: {
+      Ext: {
+        real: {
+          name: 'root',
+          id: 0,
+        },
+      },
+      name: 'root',
+      id: 0,
+    },
+    group: {
+      Ext: {
+        real: {
+          name: 'root',
+          id: 0,
+        },
+      },
+      name: 'root',
+      id: 0,
+    },
+  },
+  fields: {
+    'host.os.full.text': ['Debian 10'],
+    'event.category': ['network'],
+    'process.name.text': ['filebeat'],
+    'host.os.name.text': ['Linux'],
+    'host.os.full': ['Debian 10'],
+    'host.hostname': ['test-linux-1'],
+    'process.pid': [22535],
+    'host.mac': ['42:01:0a:c8:00:32'],
+    'elastic.agent.id': ['abcdefg-f6d5-4ce6-915d-8f1f8f413624'],
+    'host.os.version': ['10'],
+    'host.os.name': ['Linux'],
+    'source.ip': ['127.0.0.1'],
+    'destination.address': ['127.0.0.1'],
+    'host.name': ['test-linux-1'],
+    'event.agent_id_status': ['verified'],
+    'event.kind': ['event'],
+    'event.outcome': ['unknown'],
+    'group.name': ['root'],
+    'user.id': ['0'],
+    'host.os.type': ['linux'],
+    'process.Ext.ancestry': [
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=',
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA==',
+    ],
+    'user.Ext.real.id': ['0'],
+    'data_stream.type': ['logs'],
+    'host.architecture': ['x86_64'],
+    'process.name': ['filebeat'],
+    'agent.id': ['2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624'],
+    'source.port': [54146],
+    'ecs.version': ['1.11.0'],
+    'event.created': ['2021-10-14T16:45:58.031Z'],
+    'agent.version': ['8.0.0-SNAPSHOT'],
+    'host.os.family': ['debian'],
+    'destination.port': [9200],
+    'group.id': ['0'],
+    'user.name': ['root'],
+    'source.address': ['127.0.0.1'],
+    'process.entity_id': [
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=',
+    ],
+    'host.ip': ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+    'process.executable.caseless': [
+      '/opt/elastic/agent/data/elastic-agent-058c40/install/filebeat-8.0.0-snapshot-linux-x86_64/filebeat',
+    ],
+    'event.sequence': [44872],
+    'agent.type': ['endpoint'],
+    'process.executable.text': [
+      '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    ],
+    'group.Ext.real.name': ['root'],
+    'event.module': ['endpoint'],
+    'host.os.kernel': ['4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)'],
+    'host.os.full.caseless': ['debian 10'],
+    'host.id': ['76ea303129f249aa7382338e4263eac1'],
+    'process.name.caseless': ['filebeat'],
+    'network.type': ['ipv4'],
+    'process.executable': [
+      '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    ],
+    'user.Ext.real.name': ['root'],
+    'data_stream.namespace': ['default'],
+    message: ['Endpoint network event'],
+    'destination.ip': ['127.0.0.1'],
+    'network.transport': ['tcp'],
+    'host.os.Ext.variant': ['Debian'],
+    'group.Ext.real.id': ['0'],
+    'event.ingested': ['2021-10-14T16:46:04.000Z'],
+    'event.action': ['connection_attempted'],
+    '@timestamp': ['2021-10-14T16:45:58.031Z'],
+    'host.os.platform': ['debian'],
+    'data_stream.dataset': ['endpoint.events.network'],
+    'event.type': ['start'],
+    'event.id': ['MKPXftjGeHiQzUNj++++nn6R'],
+    'host.os.name.caseless': ['linux'],
+    'event.dataset': ['endpoint.events.network'],
+    'user.name.text': ['root'],
+  },
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
index 17d43d80a5a9a..6a7f0602c3675 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
@@ -33,6 +33,7 @@ interface Props {
   isDraggable?: boolean;
   loading: boolean;
   messageHeight?: number;
+  rawEventData: object | undefined;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
   hostRisk: HostRisk | null;
@@ -93,6 +94,7 @@ export const ExpandableEvent = React.memo<Props>(
     loading,
     detailsData,
     hostRisk,
+    rawEventData,
   }) => {
     if (!event.eventId) {
       return <EuiTextColor color="subdued">{i18n.EVENT_DETAILS_PLACEHOLDER}</EuiTextColor>;
@@ -111,6 +113,7 @@ export const ExpandableEvent = React.memo<Props>(
             id={event.eventId}
             isAlert={isAlert}
             isDraggable={isDraggable}
+            rawEventData={rawEventData}
             timelineId={timelineId}
             timelineTabType={timelineTabType}
             hostRisk={hostRisk}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
index f8786e0706834..b9d7e0a8c024f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
@@ -79,7 +79,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
   tabType,
   timelineId,
 }) => {
-  const [loading, detailsData] = useTimelineEventsDetails({
+  const [loading, detailsData, rawEventData] = useTimelineEventsDetails({
     docValueFields,
     entityType,
     indexName: expandedEvent.indexName ?? '',
@@ -195,6 +195,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
             isAlert={isAlert}
             isDraggable={isDraggable}
             loading={loading}
+            rawEventData={rawEventData}
             timelineId={timelineId}
             timelineTabType="flyout"
             hostRisk={hostRisk}
@@ -228,6 +229,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
         isAlert={isAlert}
         isDraggable={isDraggable}
         loading={loading}
+        rawEventData={rawEventData}
         timelineId={timelineId}
         timelineTabType={tabType}
         hostRisk={hostRisk}
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
index e59eaeed4f2a6..f05966bd97870 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
@@ -42,7 +42,7 @@ export const useTimelineEventsDetails = ({
   indexName,
   eventId,
   skip,
-}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData']] => {
+}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData'], object | undefined] => {
   const { data } = useKibana().services;
   const refetch = useRef<inputsModel.Refetch>(noop);
   const abortCtrl = useRef(new AbortController());
@@ -55,6 +55,8 @@ export const useTimelineEventsDetails = ({
   const [timelineDetailsResponse, setTimelineDetailsResponse] =
     useState<EventsArgs['detailsData']>(null);
 
+  const [rawEventData, setRawEventData] = useState<object | undefined>(undefined);
+
   const timelineDetailsSearch = useCallback(
     (request: TimelineEventsDetailsRequestOptions | null) => {
       if (request == null || skip || isEmpty(request.eventId)) {
@@ -78,6 +80,7 @@ export const useTimelineEventsDetails = ({
               if (isCompleteResponse(response)) {
                 setLoading(false);
                 setTimelineDetailsResponse(response.data || []);
+                setRawEventData(response.rawResponse.hits.hits[0]);
                 searchSubscription$.current.unsubscribe();
               } else if (isErrorResponse(response)) {
                 setLoading(false);
@@ -125,5 +128,5 @@ export const useTimelineEventsDetails = ({
     };
   }, [timelineDetailsRequest, timelineDetailsSearch]);
 
-  return [loading, timelineDetailsResponse];
+  return [loading, timelineDetailsResponse, rawEventData];
 };
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
index 5bceb31081687..f9f6a2ea57917 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
@@ -24,6 +24,7 @@ export interface TimelineEventsDetailsItem {
 export interface TimelineEventsDetailsStrategyResponse extends IEsSearchResponse {
   data?: Maybe<TimelineEventsDetailsItem[]>;
   inspect?: Maybe<Inspect>;
+  rawEventData?: Maybe<object>;
 }
 
 export interface TimelineEventsDetailsRequestOptions
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
index c82d9af938a98..b60add2515ec9 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
@@ -57,10 +57,14 @@ export const timelineEventsDetails: TimelineFactory<TimelineEventsQueries.detail
     );
 
     const data = unionBy('field', fieldsData, sourceData);
+
+    const rawEventData = response.rawResponse.hits.hits[0];
+
     return {
       ...response,
       data,
       inspect,
+      rawEventData,
     };
   },
 };

From 361ba9215d567232f5c2c06298ae9e4ccdae9bec Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:38:58 -0400
Subject: [PATCH 23/36] [Security Solution][Detections] Fix a bug in
 siem-detection-engine-rule-status Saved Object migration to SO references
 (#115355) (#115486)

**Ticket:** https://github.com/elastic/kibana/issues/107068
**Follow-up after:** https://github.com/elastic/kibana/pull/114585

## Summary

The existing migration function `legacyMigrateRuleAlertIdSOReferences` that migrates `alertId` fields to SO references array did not include all the other attributes of a `siem-detection-engine-rule-status` doc being migrated to the resulting doc.

This PR includes a fix and an integration test for that.

## Run the test

To run the test, in one terminal execute:

```
cd ${KIBANA_HOME} && node scripts/functional_tests_server --config x-pack/test/detection_engine_api_integration/security_and_spaces/config.ts
```

In another terminal execute:

```
cd ${KIBANA_HOME} && node scripts/functional_test_runner --config x-pack/test/detection_engine_api_integration/security_and_spaces/config.ts --include=x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts
```

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
---
 .../legacy_rule_status/legacy_migrations.ts   | 63 ++++++++-----------
 .../security_and_spaces/tests/migrations.ts   | 25 ++++++++
 2 files changed, 52 insertions(+), 36 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/legacy_rule_status/legacy_migrations.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/legacy_rule_status/legacy_migrations.ts
index 92d7487be0cdb..72ab4a2237ba1 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/legacy_rule_status/legacy_migrations.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/legacy_rule_status/legacy_migrations.ts
@@ -18,34 +18,19 @@ import { IRuleSavedAttributesSavedObjectAttributes } from '../types';
 import { legacyGetRuleReference } from './legacy_utils';
 
 export const truncateMessageFields: SavedObjectMigrationFn<Record<string, unknown>> = (doc) => {
-  const { lastFailureMessage, lastSuccessMessage, ...restAttributes } = doc.attributes;
+  const { lastFailureMessage, lastSuccessMessage, ...otherAttributes } = doc.attributes;
 
   return {
     ...doc,
     attributes: {
+      ...otherAttributes,
       lastFailureMessage: truncateMessage(lastFailureMessage),
       lastSuccessMessage: truncateMessage(lastSuccessMessage),
-      ...restAttributes,
     },
     references: doc.references ?? [],
   };
 };
 
-/**
- * This side-car rule status SO is deprecated and is to be replaced by the RuleExecutionLog on Event-Log and
- * additional fields on the Alerting Framework Rule SO.
- *
- * @deprecated Remove this once we've fully migrated to event-log and no longer require addition status SO (8.x)
- */
-export const legacyRuleStatusSavedObjectMigration = {
-  '7.15.2': truncateMessageFields,
-  '7.16.0': (
-    doc: SavedObjectUnsanitizedDoc<IRuleSavedAttributesSavedObjectAttributes>
-  ): SavedObjectSanitizedDoc<IRuleSavedAttributesSavedObjectAttributes> => {
-    return legacyMigrateRuleAlertIdSOReferences(doc);
-  },
-};
-
 /**
  * This migrates alertId within legacy `siem-detection-engine-rule-status` to saved object references on an upgrade.
  * We only migrate alertId if we find these conditions:
@@ -62,29 +47,24 @@ export const legacyRuleStatusSavedObjectMigration = {
 export const legacyMigrateRuleAlertIdSOReferences = (
   doc: SavedObjectUnsanitizedDoc<IRuleSavedAttributesSavedObjectAttributes>
 ): SavedObjectSanitizedDoc<IRuleSavedAttributesSavedObjectAttributes> => {
-  const { references } = doc;
-
-  // Isolate alertId from the doc
-  const { alertId, ...attributesWithoutAlertId } = doc.attributes;
-  const existingReferences = references ?? [];
+  const { alertId, ...otherAttributes } = doc.attributes;
+  const existingReferences = doc.references ?? [];
 
+  // early return if alertId is not a string as expected
   if (!isString(alertId)) {
-    // early return if alertId is not a string as expected
     return { ...doc, references: existingReferences };
-  } else {
-    const alertReferences = legacyMigrateAlertId({
-      alertId,
-      existingReferences,
-    });
-
-    return {
-      ...doc,
-      attributes: {
-        ...attributesWithoutAlertId.attributes,
-      },
-      references: [...existingReferences, ...alertReferences],
-    };
   }
+
+  const alertReferences = legacyMigrateAlertId({
+    alertId,
+    existingReferences,
+  });
+
+  return {
+    ...doc,
+    attributes: otherAttributes,
+    references: [...existingReferences, ...alertReferences],
+  };
 };
 
 /**
@@ -113,3 +93,14 @@ export const legacyMigrateAlertId = ({
     return [legacyGetRuleReference(alertId)];
   }
 };
+
+/**
+ * This side-car rule status SO is deprecated and is to be replaced by the RuleExecutionLog on Event-Log and
+ * additional fields on the Alerting Framework Rule SO.
+ *
+ * @deprecated Remove this once we've fully migrated to event-log and no longer require addition status SO (8.x)
+ */
+export const legacyRuleStatusSavedObjectMigration = {
+  '7.15.2': truncateMessageFields,
+  '7.16.0': legacyMigrateRuleAlertIdSOReferences,
+};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts
index 6d1d64a04cd93..cfae7532ba496 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts
@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import { IRuleStatusSOAttributes } from '../../../../plugins/security_solution/server/lib/detection_engine/rules/types';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -113,6 +114,30 @@ export default ({ getService }: FtrProviderContext): void => {
           undefined
         );
       });
+
+      it('migrates legacy siem-detection-engine-rule-status and retains other attributes as the same attributes as before', async () => {
+        const response = await es.get<{
+          'siem-detection-engine-rule-status': IRuleStatusSOAttributes;
+        }>({
+          index: '.kibana',
+          id: 'siem-detection-engine-rule-status:d62d2980-27c4-11ec-92b0-f7b47106bb35',
+        });
+        expect(response.statusCode).to.eql(200);
+
+        expect(response.body._source?.['siem-detection-engine-rule-status']).to.eql({
+          statusDate: '2021-10-11T20:51:26.622Z',
+          status: 'succeeded',
+          lastFailureAt: '2021-10-11T18:10:08.982Z',
+          lastSuccessAt: '2021-10-11T20:51:26.622Z',
+          lastFailureMessage:
+            '4 days (323690920ms) were not queried between this rule execution and the last execution, so signals may have been missed. Consider increasing your look behind time or adding more Kibana instances. name: "Threshy" id: "fb1046a0-0452-11ec-9b15-d13d79d162f3" rule id: "b789c80f-f6d8-41f1-8b4f-b4a23342cde2" signals index: ".siem-signals-spong-default"',
+          lastSuccessMessage: 'succeeded',
+          gap: '4 days',
+          bulkCreateTimeDurations: ['34.49'],
+          searchAfterTimeDurations: ['62.58'],
+          lastLookBackDate: null,
+        });
+      });
     });
   });
 };

From 6e115400257ee1f2c7a542829666599b1c38f70e Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 12:02:19 -0400
Subject: [PATCH 24/36] [7.x] [Fleet] Allow package to specify cluster
 privileges (#114945) (#115416)

* [Fleet] Allow package to specify cluster privileges (#114945)

* Fix types

* Fix types

Co-authored-by: Nicolas Chaulet <nicolas.chaulet@elastic.co>
---
 .../plugins/fleet/common/types/models/epm.ts  |  5 +
 .../common/types/models/package_policy.ts     |  5 +
 x-pack/plugins/fleet/server/mocks/index.ts    |  2 +-
 .../routes/package_policy/handlers.test.ts    |  2 +-
 .../fleet/server/saved_objects/index.ts       | 10 ++
 ...kage_policies_to_agent_permissions.test.ts | 97 +++++++++++++++++++
 .../package_policies_to_agent_permissions.ts  |  9 ++
 .../server/services/package_policy.test.ts    | 96 +++++++++++++++---
 .../fleet/server/services/package_policy.ts   | 42 +++++---
 9 files changed, 241 insertions(+), 27 deletions(-)

diff --git a/x-pack/plugins/fleet/common/types/models/epm.ts b/x-pack/plugins/fleet/common/types/models/epm.ts
index df4cdec184dc8..4d5e53a5c8078 100644
--- a/x-pack/plugins/fleet/common/types/models/epm.ts
+++ b/x-pack/plugins/fleet/common/types/models/epm.ts
@@ -125,6 +125,11 @@ interface RegistryAdditionalProperties {
   readme?: string;
   internal?: boolean; // Registry addition[0] and EPM uses it[1] [0]: https://github.com/elastic/package-registry/blob/dd7b021893aa8d66a5a5fde963d8ff2792a9b8fa/util/package.go#L63 [1]
   data_streams?: RegistryDataStream[]; // Registry addition [0] [0]: https://github.com/elastic/package-registry/blob/dd7b021893aa8d66a5a5fde963d8ff2792a9b8fa/util/package.go#L65
+  elasticsearch?: {
+    privileges?: {
+      cluster?: string[];
+    };
+  };
 }
 interface RegistryOverridePropertyValue {
   icons?: RegistryImage[];
diff --git a/x-pack/plugins/fleet/common/types/models/package_policy.ts b/x-pack/plugins/fleet/common/types/models/package_policy.ts
index aca537ae31b52..df484646ef66b 100644
--- a/x-pack/plugins/fleet/common/types/models/package_policy.ts
+++ b/x-pack/plugins/fleet/common/types/models/package_policy.ts
@@ -65,6 +65,11 @@ export interface NewPackagePolicy {
   package?: PackagePolicyPackage;
   inputs: NewPackagePolicyInput[];
   vars?: PackagePolicyConfigRecord;
+  elasticsearch?: {
+    privileges?: {
+      cluster?: string[];
+    };
+  };
 }
 
 export interface UpdatePackagePolicy extends NewPackagePolicy {
diff --git a/x-pack/plugins/fleet/server/mocks/index.ts b/x-pack/plugins/fleet/server/mocks/index.ts
index 0e7b335da6775..c7f6b6fefc414 100644
--- a/x-pack/plugins/fleet/server/mocks/index.ts
+++ b/x-pack/plugins/fleet/server/mocks/index.ts
@@ -65,7 +65,7 @@ export const xpackMocks = {
 
 export const createPackagePolicyServiceMock = (): jest.Mocked<PackagePolicyServiceInterface> => {
   return {
-    compilePackagePolicyInputs: jest.fn(),
+    _compilePackagePolicyInputs: jest.fn(),
     buildPackagePolicyFromPackage: jest.fn(),
     bulkCreate: jest.fn(),
     create: jest.fn(),
diff --git a/x-pack/plugins/fleet/server/routes/package_policy/handlers.test.ts b/x-pack/plugins/fleet/server/routes/package_policy/handlers.test.ts
index 729417fa96060..5441af0af686a 100644
--- a/x-pack/plugins/fleet/server/routes/package_policy/handlers.test.ts
+++ b/x-pack/plugins/fleet/server/routes/package_policy/handlers.test.ts
@@ -35,7 +35,7 @@ jest.mock(
   } => {
     return {
       packagePolicyService: {
-        compilePackagePolicyInputs: jest.fn((packageInfo, vars, dataInputs) =>
+        _compilePackagePolicyInputs: jest.fn((registryPkgInfo, packageInfo, vars, dataInputs) =>
           Promise.resolve(dataInputs)
         ),
         buildPackagePolicyFromPackage: jest.fn(),
diff --git a/x-pack/plugins/fleet/server/saved_objects/index.ts b/x-pack/plugins/fleet/server/saved_objects/index.ts
index ac5ca401da000..f0b51b19dda33 100644
--- a/x-pack/plugins/fleet/server/saved_objects/index.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/index.ts
@@ -236,6 +236,16 @@ const getSavedObjectTypes = (
             version: { type: 'keyword' },
           },
         },
+        elasticsearch: {
+          enabled: false,
+          properties: {
+            privileges: {
+              properties: {
+                cluster: { type: 'keyword' },
+              },
+            },
+          },
+        },
         vars: { type: 'flattened' },
         inputs: {
           type: 'nested',
diff --git a/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.test.ts b/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.test.ts
index 845e4f1d2670e..b0294d7a3b1f3 100644
--- a/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.test.ts
+++ b/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.test.ts
@@ -277,6 +277,103 @@ describe('storedPackagePoliciesToAgentPermissions()', () => {
     });
   });
 
+  it('Returns the cluster privileges if there is one in the package policy', async () => {
+    getPackageInfoMock.mockResolvedValueOnce({
+      name: 'test-package',
+      version: '0.0.0',
+      latestVersion: '0.0.0',
+      release: 'experimental',
+      format_version: '1.0.0',
+      title: 'Test Package',
+      description: '',
+      icons: [],
+      owner: { github: '' },
+      status: 'not_installed',
+      assets: {
+        kibana: {
+          dashboard: [],
+          visualization: [],
+          search: [],
+          index_pattern: [],
+          map: [],
+          lens: [],
+          security_rule: [],
+          ml_module: [],
+          tag: [],
+        },
+        elasticsearch: {
+          component_template: [],
+          ingest_pipeline: [],
+          ilm_policy: [],
+          transform: [],
+          index_template: [],
+          data_stream_ilm_policy: [],
+        },
+      },
+      data_streams: [
+        {
+          type: 'logs',
+          dataset: 'some-logs',
+          title: '',
+          release: '',
+          package: 'test-package',
+          path: '',
+          ingest_pipeline: '',
+          streams: [{ input: 'test-logs', title: 'Test Logs', template_path: '' }],
+        },
+      ],
+    });
+
+    const packagePolicies: PackagePolicy[] = [
+      {
+        id: '12345',
+        name: 'test-policy',
+        namespace: 'test',
+        enabled: true,
+        package: { name: 'test-package', version: '0.0.0', title: 'Test Package' },
+        elasticsearch: {
+          privileges: {
+            cluster: ['monitor'],
+          },
+        },
+        inputs: [
+          {
+            type: 'test-logs',
+            enabled: true,
+            streams: [
+              {
+                id: 'test-logs',
+                enabled: true,
+                data_stream: { type: 'logs', dataset: 'some-logs' },
+                compiled_stream: { data_stream: { dataset: 'compiled' } },
+              },
+            ],
+          },
+        ],
+        created_at: '',
+        updated_at: '',
+        created_by: '',
+        updated_by: '',
+        revision: 1,
+        policy_id: '',
+        output_id: '',
+      },
+    ];
+
+    const permissions = await storedPackagePoliciesToAgentPermissions(soClient, packagePolicies);
+    expect(permissions).toMatchObject({
+      'test-policy': {
+        indices: [
+          {
+            names: ['logs-compiled-test'],
+            privileges: ['auto_configure', 'create_doc'],
+          },
+        ],
+        cluster: ['monitor'],
+      },
+    });
+  });
+
   it('Returns the dataset for osquery_manager package', async () => {
     getPackageInfoMock.mockResolvedValueOnce({
       format_version: '1.0.0',
diff --git a/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.ts b/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.ts
index 22dcb8ac7b4cb..383747fe126c0 100644
--- a/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.ts
+++ b/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.ts
@@ -121,12 +121,21 @@ export async function storedPackagePoliciesToAgentPermissions(
             });
       }
 
+      let clusterRoleDescriptor = {};
+      const cluster = packagePolicy?.elasticsearch?.privileges?.cluster ?? [];
+      if (cluster.length > 0) {
+        clusterRoleDescriptor = {
+          cluster,
+        };
+      }
+
       return [
         packagePolicy.name,
         {
           indices: dataStreamsForPermissions.map((ds) =>
             getDataStreamPrivileges(ds, packagePolicy.namespace)
           ),
+          ...clusterRoleDescriptor,
         },
       ];
     }
diff --git a/x-pack/plugins/fleet/server/services/package_policy.test.ts b/x-pack/plugins/fleet/server/services/package_policy.test.ts
index 0b6b3579f7b87..9dc05ee2cb4ba 100644
--- a/x-pack/plugins/fleet/server/services/package_policy.test.ts
+++ b/x-pack/plugins/fleet/server/services/package_policy.test.ts
@@ -33,6 +33,7 @@ import type {
   InputsOverride,
   NewPackagePolicy,
   NewPackagePolicyInput,
+  RegistryPackage,
 } from '../../common';
 
 import { IngestManagerError } from '../errors';
@@ -43,6 +44,7 @@ import {
   _applyIndexPrivileges,
 } from './package_policy';
 import { appContextService } from './app_context';
+import { fetchInfo } from './epm/registry';
 
 async function mockedGetAssetsData(_a: any, _b: any, dataset: string) {
   if (dataset === 'dataset1') {
@@ -88,6 +90,10 @@ hosts:
   ];
 }
 
+function mockedRegistryInfo(): RegistryPackage {
+  return {} as RegistryPackage;
+}
+
 jest.mock('./epm/packages/assets', () => {
   return {
     getAssetsData: mockedGetAssetsData,
@@ -100,11 +106,7 @@ jest.mock('./epm/packages', () => {
   };
 });
 
-jest.mock('./epm/registry', () => {
-  return {
-    fetchInfo: () => ({}),
-  };
-});
+jest.mock('./epm/registry');
 
 jest.mock('./agent_policy', () => {
   return {
@@ -126,12 +128,18 @@ jest.mock('./agent_policy', () => {
   };
 });
 
+const mockedFetchInfo = fetchInfo as jest.Mock<ReturnType<typeof fetchInfo>>;
+
 type CombinedExternalCallback = PutPackagePolicyUpdateCallback | PostPackagePolicyCreateCallback;
 
 describe('Package policy service', () => {
-  describe('compilePackagePolicyInputs', () => {
+  beforeEach(() => {
+    mockedFetchInfo.mockResolvedValue({} as RegistryPackage);
+  });
+  describe('_compilePackagePolicyInputs', () => {
     it('should work with config variables from the stream', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -194,7 +202,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with a two level dataset name', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -246,7 +255,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with config variables at the input level', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -309,7 +319,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with config variables at the package level', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -377,7 +388,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with an input with a template and no streams', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [],
           policy_templates: [
@@ -419,7 +431,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with an input with a template and streams', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -524,7 +537,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with a package without input', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           policy_templates: [
             {
@@ -540,7 +554,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with a package with a empty inputs array', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           policy_templates: [
             {
@@ -834,6 +849,59 @@ describe('Package policy service', () => {
       expect(modifiedStream.vars!.paths.value).toEqual(expect.arrayContaining(['north', 'south']));
       expect(modifiedStream.vars!.period.value).toEqual('12mo');
     });
+
+    it('should update elasticsearch.priviles.cluster when updating', async () => {
+      const savedObjectsClient = savedObjectsClientMock.create();
+      const mockPackagePolicy = createPackagePolicyMock();
+
+      const attributes = {
+        ...mockPackagePolicy,
+        inputs: [],
+      };
+
+      mockedFetchInfo.mockResolvedValue({
+        elasticsearch: {
+          privileges: {
+            cluster: ['monitor'],
+          },
+        },
+      } as RegistryPackage);
+
+      savedObjectsClient.get.mockResolvedValue({
+        id: 'test',
+        type: 'abcd',
+        references: [],
+        version: 'test',
+        attributes,
+      });
+
+      savedObjectsClient.update.mockImplementation(
+        async (
+          type: string,
+          id: string,
+          attrs: any
+        ): Promise<SavedObjectsUpdateResponse<PackagePolicySOAttributes>> => {
+          savedObjectsClient.get.mockResolvedValue({
+            id: 'test',
+            type: 'abcd',
+            references: [],
+            version: 'test',
+            attributes: attrs,
+          });
+          return attrs;
+        }
+      );
+      const elasticsearchClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+      const result = await packagePolicyService.update(
+        savedObjectsClient,
+        elasticsearchClient,
+        'the-package-policy-id',
+        { ...mockPackagePolicy, inputs: [] }
+      );
+
+      expect(result.elasticsearch).toMatchObject({ privileges: { cluster: ['monitor'] } });
+    });
   });
 
   describe('runDeleteExternalCallbacks', () => {
diff --git a/x-pack/plugins/fleet/server/services/package_policy.ts b/x-pack/plugins/fleet/server/services/package_policy.ts
index b7772892f542a..b0c0b9499c68e 100644
--- a/x-pack/plugins/fleet/server/services/package_policy.ts
+++ b/x-pack/plugins/fleet/server/services/package_policy.ts
@@ -114,7 +114,7 @@ class PackagePolicyService {
         'There is already a package with the same name on this agent policy'
       );
     }
-
+    let elasticsearch: PackagePolicy['elasticsearch'];
     // Add ids to stream
     const packagePolicyId = options?.id || uuid.v4();
     let inputs: PackagePolicyInput[] = packagePolicy.inputs.map((input) =>
@@ -155,7 +155,15 @@ class PackagePolicyService {
         }
       }
 
-      inputs = await this.compilePackagePolicyInputs(pkgInfo, packagePolicy.vars || {}, inputs);
+      const registryPkgInfo = await Registry.fetchInfo(pkgInfo.name, pkgInfo.version);
+      inputs = await this._compilePackagePolicyInputs(
+        registryPkgInfo,
+        pkgInfo,
+        packagePolicy.vars || {},
+        inputs
+      );
+
+      elasticsearch = registryPkgInfo.elasticsearch;
     }
 
     const isoDate = new Date().toISOString();
@@ -164,6 +172,7 @@ class PackagePolicyService {
       {
         ...packagePolicy,
         inputs,
+        elasticsearch,
         revision: 1,
         created_at: isoDate,
         created_by: options?.user?.username ?? 'system',
@@ -375,15 +384,21 @@ class PackagePolicyService {
     );
 
     inputs = enforceFrozenInputs(oldPackagePolicy.inputs, inputs);
-
+    let elasticsearch: PackagePolicy['elasticsearch'];
     if (packagePolicy.package?.name) {
       const pkgInfo = await getPackageInfo({
         savedObjectsClient: soClient,
         pkgName: packagePolicy.package.name,
         pkgVersion: packagePolicy.package.version,
       });
-
-      inputs = await this.compilePackagePolicyInputs(pkgInfo, packagePolicy.vars || {}, inputs);
+      const registryPkgInfo = await Registry.fetchInfo(pkgInfo.name, pkgInfo.version);
+      inputs = await this._compilePackagePolicyInputs(
+        registryPkgInfo,
+        pkgInfo,
+        packagePolicy.vars || {},
+        inputs
+      );
+      elasticsearch = registryPkgInfo.elasticsearch;
     }
 
     await soClient.update<PackagePolicySOAttributes>(
@@ -392,6 +407,7 @@ class PackagePolicyService {
       {
         ...restOfPackagePolicy,
         inputs,
+        elasticsearch,
         revision: oldPackagePolicy.revision + 1,
         updated_at: new Date().toISOString(),
         updated_by: options?.user?.username ?? 'system',
@@ -563,12 +579,14 @@ class PackagePolicyService {
           packageInfo,
           packageToPackagePolicyInputs(packageInfo) as InputsOverride[]
         );
-
-        updatePackagePolicy.inputs = await this.compilePackagePolicyInputs(
+        const registryPkgInfo = await Registry.fetchInfo(packageInfo.name, packageInfo.version);
+        updatePackagePolicy.inputs = await this._compilePackagePolicyInputs(
+          registryPkgInfo,
           packageInfo,
           updatePackagePolicy.vars || {},
           updatePackagePolicy.inputs as PackagePolicyInput[]
         );
+        updatePackagePolicy.elasticsearch = registryPkgInfo.elasticsearch;
 
         await this.update(soClient, esClient, id, updatePackagePolicy, options);
         result.push({
@@ -618,12 +636,14 @@ class PackagePolicyService {
         packageToPackagePolicyInputs(packageInfo) as InputsOverride[],
         true
       );
-
-      updatedPackagePolicy.inputs = await this.compilePackagePolicyInputs(
+      const registryPkgInfo = await Registry.fetchInfo(packageInfo.name, packageInfo.version);
+      updatedPackagePolicy.inputs = await this._compilePackagePolicyInputs(
+        registryPkgInfo,
         packageInfo,
         updatedPackagePolicy.vars || {},
         updatedPackagePolicy.inputs as PackagePolicyInput[]
       );
+      updatedPackagePolicy.elasticsearch = registryPkgInfo.elasticsearch;
 
       const hasErrors = 'errors' in updatedPackagePolicy;
 
@@ -663,12 +683,12 @@ class PackagePolicyService {
     }
   }
 
-  public async compilePackagePolicyInputs(
+  public async _compilePackagePolicyInputs(
+    registryPkgInfo: RegistryPackage,
     pkgInfo: PackageInfo,
     vars: PackagePolicy['vars'],
     inputs: PackagePolicyInput[]
   ): Promise<PackagePolicyInput[]> {
-    const registryPkgInfo = await Registry.fetchInfo(pkgInfo.name, pkgInfo.version);
     const inputsPromises = inputs.map(async (input) => {
       const compiledInput = await _compilePackagePolicyInput(registryPkgInfo, pkgInfo, vars, input);
       const compiledStreams = await _compilePackageStreams(registryPkgInfo, pkgInfo, vars, input);

From 68194c025b0ce5912f22e6dd71d2391ff90c54e2 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 12:23:27 -0400
Subject: [PATCH 25/36] [App Search] Update "overrides" badge (#115437)
 (#115566)

Co-authored-by: Jason Stoltzfus <jastoltz24@gmail.com>
---
 .../components/curations/components/suggestions_table.test.tsx  | 2 +-
 .../components/curations/components/suggestions_table.tsx       | 2 +-
 .../applications/app_search/components/curations/types.ts       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
index 28c368d942c1f..439f9dabadee6 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
@@ -88,7 +88,7 @@ describe('SuggestionsTable', () => {
     wrapper = renderColumn(0)('test', {});
     expect(wrapper.find(EuiBadge)).toHaveLength(0);
 
-    wrapper = renderColumn(0)('test', { override_curation_id: '1-2-3' });
+    wrapper = renderColumn(0)('test', { override_manual_curation: true });
     expect(wrapper.find(EuiBadge).prop('children')).toEqual('Overrides');
   });
 
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
index b7a731c1654ca..c91468e67529e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
@@ -42,7 +42,7 @@ const columns: Array<EuiBasicTableColumn<CurationSuggestion>> = [
     render: (query: string, curation: CurationSuggestion) => (
       <EuiLinkTo to={getSuggestionRoute(query)}>
         {query}
-        {curation.override_curation_id && (
+        {curation.override_manual_curation && (
           <>
             <EuiBadge iconType="alert" color="warning" className="suggestionsTableBadge">
               {i18n.translate(
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
index f00da5deec7e3..7479505ea86da 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
@@ -15,7 +15,7 @@ export interface CurationSuggestion {
   status: 'pending' | 'applied' | 'automated' | 'rejected' | 'disabled';
   curation_id?: string;
   operation: 'create' | 'update' | 'delete';
-  override_curation_id?: string;
+  override_manual_curation?: boolean;
 }
 
 export interface Curation {

From 492823c36c95df1a7030f942b67f6d6b98efb952 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 12:23:40 -0400
Subject: [PATCH 26/36] [SecuritySolution][Detections] Enables Index Action and
 Connector for Detection Actions (#111813) (#115563)

## Summary

This PR enables the [Index Connector and Action](https://www.elastic.co/guide/en/kibana/master/index-action-type.html) for the detection engine, addressing https://github.com/elastic/kibana/issues/110550.

<details><summary>Action type available in list:</summary>
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132774871-285ff387-eebe-44ee-9172-3143d0283b09.png" />
</p>
</details>

<details><summary>No Connector UI:</summary>
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132774935-e7e71061-e3b6-40ae-bc77-4adb76132de0.png" />
</p>
</details>


<details><summary>Create Connector UI:</summary>
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132774985-50980dcf-b022-4101-809a-a2d5a617a892.png" />
</p>
</details>

<details><summary>Connector Template:</summary>
<p>

``` json
{
    "rule_id": "{{context.rule.id}}",
    "rule_name": "{{context.rule.name}}",
    "alert_id": "{{alert.id}}",
    "context_message": "Threshold Results: {{#context.alerts}}{{#signal.threshold_result.terms}}{{value}}, {{/signal.threshold_result.terms}}{{/context.alerts}}"
}
```

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132775311-3091ed5d-d7df-4dc1-89d6-c02a93c04779.png" />
</p>
</p>
</details>



<details><summary>Documents successfully written:</summary>
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132775457-128f0e62-0978-46a6-ae6e-bd951a1d6c96.png" />
</p>
</details>


---

If wanting to store the alert index timestamp, create index first with `timestamp` field and use `Define timefield for each document` option:


```
PUT .homemade-alerts-index
{
  "mappings" : {
    "dynamic": "true",
    "properties" : {
      "@timestamp": {
        "type": "date"
      }
    }
  }
}
```
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132775842-ac6534a7-289d-426f-851b-f5f2c2bb5716.png" />
</p>

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132776120-2def172f-3bfa-4a7e-b041-155e817173ab.png" />
</p>




### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials (will need to update documentation if we proceed with this PR)

Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
---
 x-pack/plugins/security_solution/common/constants.ts | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 5a7e19e2cdd05..6e8d574c15860 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -296,15 +296,16 @@ export const ML_GROUP_IDS = [ML_GROUP_ID, LEGACY_ML_GROUP_ID];
 */
 export const NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS = [
   '.email',
-  '.slack',
+  '.index',
+  '.jira',
   '.pagerduty',
-  '.swimlane',
-  '.webhook',
+  '.resilient',
   '.servicenow',
   '.servicenow-sir',
-  '.jira',
-  '.resilient',
+  '.slack',
+  '.swimlane',
   '.teams',
+  '.webhook',
 ];
 
 if (ENABLE_CASE_CONNECTOR) {

From d66619f4123fa85c233c96f62a973b3ae19a329e Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 12:30:46 -0400
Subject: [PATCH 27/36] [Fleet] Add telemetry for integration cards (#115413)
 (#115569)

Co-authored-by: Thomas Neirynck <thomas@elastic.co>
---
 x-pack/plugins/fleet/kibana.json              |  2 +-
 .../applications/integrations/index.tsx       | 23 +++++----
 .../sections/epm/components/package_card.tsx  | 47 +++++++++++--------
 .../epm/screens/home/available_packages.tsx   |  2 +-
 .../sections/epm/screens/home/index.tsx       |  2 +-
 x-pack/plugins/fleet/public/plugin.ts         | 16 ++++++-
 6 files changed, 58 insertions(+), 34 deletions(-)

diff --git a/x-pack/plugins/fleet/kibana.json b/x-pack/plugins/fleet/kibana.json
index 9de538ee91b8c..1ca88cac1cc11 100644
--- a/x-pack/plugins/fleet/kibana.json
+++ b/x-pack/plugins/fleet/kibana.json
@@ -11,5 +11,5 @@
   "requiredPlugins": ["licensing", "data", "encryptedSavedObjects", "navigation", "customIntegrations", "share"],
   "optionalPlugins": ["security", "features", "cloud", "usageCollection", "home", "globalSearch"],
   "extraPublicDirs": ["common"],
-  "requiredBundles": ["kibanaReact", "esUiShared", "home", "infra", "kibanaUtils"]
+  "requiredBundles": ["kibanaReact", "esUiShared", "home", "infra", "kibanaUtils", "usageCollection"]
 }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/index.tsx
index 0abb78f850076..4099879538afa 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/index.tsx
@@ -70,18 +70,21 @@ export function renderApp(
   { element, appBasePath, history, setHeaderActionMenu }: AppMountParameters,
   config: FleetConfigType,
   kibanaVersion: string,
-  extensions: UIExtensionsStorage
+  extensions: UIExtensionsStorage,
+  UsageTracker: React.FC
 ) {
   ReactDOM.render(
-    <IntegrationsApp
-      basepath={appBasePath}
-      startServices={startServices}
-      config={config}
-      history={history}
-      kibanaVersion={kibanaVersion}
-      extensions={extensions}
-      setHeaderActionMenu={setHeaderActionMenu}
-    />,
+    <UsageTracker>
+      <IntegrationsApp
+        basepath={appBasePath}
+        startServices={startServices}
+        config={config}
+        history={history}
+        kibanaVersion={kibanaVersion}
+        extensions={extensions}
+        setHeaderActionMenu={setHeaderActionMenu}
+      />
+    </UsageTracker>,
     element
   );
 
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
index 091eb4c97183d..7181241776dda 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_card.tsx
@@ -9,6 +9,8 @@ import React from 'react';
 import styled from 'styled-components';
 import { EuiCard, EuiFlexItem, EuiBadge, EuiToolTip, EuiSpacer } from '@elastic/eui';
 
+import { TrackApplicationView } from '../../../../../../../../../src/plugins/usage_collection/public';
+
 import { CardIcon } from '../../../../../components/package_icon';
 import type { IntegrationCardItem } from '../../../../../../common/types/models/epm';
 
@@ -31,6 +33,7 @@ export function PackageCard({
   integration,
   url,
   release,
+  id,
 }: PackageCardProps) {
   let releaseBadge: React.ReactNode | null = null;
 
@@ -47,26 +50,30 @@ export function PackageCard({
     );
   }
 
+  const testid = `integration-card:${id}`;
   return (
-    <Card
-      layout="horizontal"
-      title={title || ''}
-      titleSize="xs"
-      description={description}
-      hasBorder
-      icon={
-        <CardIcon
-          icons={icons}
-          packageName={name}
-          integrationName={integration}
-          version={version}
-          size="xl"
-        />
-      }
-      href={url}
-      target={url.startsWith('http') || url.startsWith('https') ? '_blank' : undefined}
-    >
-      {releaseBadge}
-    </Card>
+    <TrackApplicationView viewId={testid}>
+      <Card
+        data-test-subj={testid}
+        layout="horizontal"
+        title={title || ''}
+        titleSize="xs"
+        description={description}
+        hasBorder
+        icon={
+          <CardIcon
+            icons={icons}
+            packageName={name}
+            integrationName={integration}
+            version={version}
+            size="xl"
+          />
+        }
+        href={url}
+        target={url.startsWith('http') || url.startsWith('https') ? '_blank' : undefined}
+      >
+        {releaseBadge}
+      </Card>
+    </TrackApplicationView>
   );
 }
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
index f5c521ebacf16..73de0e51bea65 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
@@ -79,7 +79,7 @@ const packageListToIntegrationsList = (packages: PackageList): PackageList => {
             const allCategories = [...topCategories, ...categories];
             return {
               ...restOfPackage,
-              id: `${restOfPackage}-${name}`,
+              id: `${restOfPackage.id}-${name}`,
               integration: name,
               title,
               description,
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
index 4270d360b9294..e3fc5e15488e6 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
@@ -74,7 +74,7 @@ export const mapToCard = (
   }
 
   return {
-    id: `${item.type === 'ui_link' ? 'ui_link' : 'epr'}-${item.id}`,
+    id: `${item.type === 'ui_link' ? 'ui_link' : 'epr'}:${item.id}`,
     description: item.description,
     icons: !item.icons || !item.icons.length ? [] : item.icons,
     title: item.title,
diff --git a/x-pack/plugins/fleet/public/plugin.ts b/x-pack/plugins/fleet/public/plugin.ts
index 4a2a6900cc78c..b0e4e56aa344a 100644
--- a/x-pack/plugins/fleet/public/plugin.ts
+++ b/x-pack/plugins/fleet/public/plugin.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import React from 'react';
 import type {
   AppMountParameters,
   CoreSetup,
@@ -23,6 +24,8 @@ import type {
 
 import type { SharePluginStart } from 'src/plugins/share/public';
 
+import type { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/public';
+
 import { DEFAULT_APP_CATEGORIES, AppNavLinkStatus } from '../../../../src/core/public';
 
 import type {
@@ -73,6 +76,7 @@ export interface FleetSetupDeps {
   cloud?: CloudSetup;
   globalSearch?: GlobalSearchPluginSetup;
   customIntegrations: CustomIntegrationsSetup;
+  usageCollection?: UsageCollectionSetup;
 }
 
 export interface FleetStartDeps {
@@ -137,7 +141,17 @@ export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDep
           cloud: deps.cloud,
         };
         const { renderApp, teardownIntegrations } = await import('./applications/integrations');
-        const unmount = renderApp(startServices, params, config, kibanaVersion, extensions);
+
+        const Tracker =
+          deps.usageCollection?.components.ApplicationUsageTrackingProvider ?? React.Fragment;
+        const unmount = renderApp(
+          startServices,
+          params,
+          config,
+          kibanaVersion,
+          extensions,
+          Tracker
+        );
 
         return () => {
           unmount();

From 528841c3f699f4ad3f946623061dc1b698e0f9be Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 12:31:47 -0400
Subject: [PATCH 28/36] :bug: Fix single percentile case when ES is returning
 no buckets (#115214) (#115567)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Marco Liberati <dej611@users.noreply.github.com>
---
 .../common/search/aggs/metrics/single_percentile.test.ts     | 5 +++++
 .../data/common/search/aggs/metrics/single_percentile.ts     | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/plugins/data/common/search/aggs/metrics/single_percentile.test.ts b/src/plugins/data/common/search/aggs/metrics/single_percentile.test.ts
index c2ba6ee1a403a..967e1b1f624aa 100644
--- a/src/plugins/data/common/search/aggs/metrics/single_percentile.test.ts
+++ b/src/plugins/data/common/search/aggs/metrics/single_percentile.test.ts
@@ -73,6 +73,11 @@ describe('AggTypeMetricSinglePercentileProvider class', () => {
     ).toEqual(123);
   });
 
+  it('should not throw error for empty buckets', () => {
+    const agg = aggConfigs.getResponseAggs()[0];
+    expect(agg.getValue({})).toEqual(NaN);
+  });
+
   it('produces the expected expression ast', () => {
     const agg = aggConfigs.getResponseAggs()[0];
     expect(agg.toExpressionAst()).toMatchInlineSnapshot(`
diff --git a/src/plugins/data/common/search/aggs/metrics/single_percentile.ts b/src/plugins/data/common/search/aggs/metrics/single_percentile.ts
index 4bdafcae327cd..954576e2bbe1f 100644
--- a/src/plugins/data/common/search/aggs/metrics/single_percentile.ts
+++ b/src/plugins/data/common/search/aggs/metrics/single_percentile.ts
@@ -57,7 +57,9 @@ export const getSinglePercentileMetricAgg = () => {
       if (Number.isInteger(agg.params.percentile)) {
         valueKey += '.0';
       }
-      return bucket[agg.id].values[valueKey];
+      const { values } = bucket[agg.id] ?? {};
+
+      return values ? values[valueKey] : NaN;
     },
   });
 };

From 2d9b7d2a4aba7fced6715587516010ac440ef693 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 12:51:15 -0400
Subject: [PATCH 29/36] [Security Solution] [Platform] Migrate legacy actions
 whenever user interacts with the rule (#115101) (#115572)

Migrate legacy actions whenever user interacts with the rule (#115101)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Devin W. Hurley <devin.hurley@elastic.co>
---
 .../rules/add_prepackaged_rules_route.ts      |  1 +
 .../routes/rules/import_rules_route.ts        |  9 ++-
 .../routes/rules/patch_rules_bulk_route.ts    | 10 ++-
 .../routes/rules/patch_rules_route.ts         | 10 ++-
 .../rules/update_rules_bulk_route.test.ts     |  2 +
 .../routes/rules/update_rules_bulk_route.ts   | 16 +++++
 .../routes/rules/update_rules_route.test.ts   |  2 +-
 .../routes/rules/update_rules_route.ts        | 16 +++++
 .../rules/patch_rules.mock.ts                 |  3 +
 .../lib/detection_engine/rules/patch_rules.ts |  7 ++-
 .../lib/detection_engine/rules/types.ts       | 17 ++++-
 .../rules/update_prepacked_rules.test.ts      |  4 ++
 .../rules/update_prepacked_rules.ts           | 14 ++++-
 .../rules/update_rules.mock.ts                |  3 +
 .../detection_engine/rules/update_rules.ts    | 20 +++++-
 .../lib/detection_engine/rules/utils.ts       | 62 +++++++++++++++++++
 16 files changed, 183 insertions(+), 13 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts
index fed34743e220a..ddf4e956beac4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts
@@ -171,6 +171,7 @@ export const createPrepackagedRules = async (
   );
   await updatePrepackagedRules(
     rulesClient,
+    savedObjectsClient,
     context.securitySolution.getSpaceId(),
     ruleStatusClient,
     rulesToUpdate,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
index 8269fe8b36132..b09ef1a215747 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -40,6 +40,7 @@ import {
 } from '../utils';
 
 import { patchRules } from '../../rules/patch_rules';
+import { legacyMigrate } from '../../rules/utils';
 import { getTupleDuplicateErrorsAndUniqueRules } from './utils';
 import { createRulesStreamFromNdJson } from '../../rules/create_rules_stream_from_ndjson';
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
@@ -271,8 +272,14 @@ export const importRulesRoute = (
                           status_code: 200,
                         });
                       } else if (rule != null && request.query.overwrite) {
+                        const migratedRule = await legacyMigrate({
+                          rulesClient,
+                          savedObjectsClient,
+                          rule,
+                        });
                         await patchRules({
                           rulesClient,
+                          savedObjectsClient,
                           author,
                           buildingBlockType,
                           spaceId: context.securitySolution.getSpaceId(),
@@ -291,7 +298,7 @@ export const importRulesRoute = (
                           timelineTitle,
                           meta,
                           filters,
-                          rule,
+                          rule: migratedRule,
                           index,
                           interval,
                           maxSignals,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
index 67d68221d846f..2b514ba911091 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
@@ -24,6 +24,7 @@ import { transformValidateBulkError } from './validate';
 import { patchRules } from '../../rules/patch_rules';
 import { readRules } from '../../rules/read_rules';
 import { PartialFilter } from '../../types';
+import { legacyMigrate } from '../../rules/utils';
 
 export const patchRulesBulkRoute = (
   router: SecuritySolutionPluginRouter,
@@ -133,9 +134,16 @@ export const patchRulesBulkRoute = (
               throwHttpError(await mlAuthz.validateRuleType(existingRule?.params.type));
             }
 
-            const rule = await patchRules({
+            const migratedRule = await legacyMigrate({
+              rulesClient,
+              savedObjectsClient,
               rule: existingRule,
+            });
+
+            const rule = await patchRules({
+              rule: migratedRule,
               rulesClient,
+              savedObjectsClient,
               author,
               buildingBlockType,
               description,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
index cf140f22289de..0096cd2e38180 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/patch_rules_route.ts
@@ -24,6 +24,7 @@ import { buildSiemResponse } from '../utils';
 import { getIdError } from './utils';
 import { transformValidate } from './validate';
 import { readRules } from '../../rules/read_rules';
+import { legacyMigrate } from '../../rules/utils';
 import { PartialFilter } from '../../types';
 
 export const patchRulesRoute = (
@@ -134,8 +135,15 @@ export const patchRulesRoute = (
           throwHttpError(await mlAuthz.validateRuleType(existingRule?.params.type));
         }
 
+        const migratedRule = await legacyMigrate({
+          rulesClient,
+          savedObjectsClient,
+          rule: existingRule,
+        });
+
         const rule = await patchRules({
           rulesClient,
+          savedObjectsClient,
           author,
           buildingBlockType,
           description,
@@ -154,7 +162,7 @@ export const patchRulesRoute = (
           timelineTitle,
           meta,
           filters,
-          rule: existingRule,
+          rule: migratedRule,
           index,
           interval,
           maxSignals,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.test.ts
index f7bef76944a97..22e8f6543eb7c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.test.ts
@@ -41,6 +41,8 @@ describe.each([
       getAlertMock(isRuleRegistryEnabled, getQueryRuleParams())
     );
 
+    clients.appClient.getSignalsIndex.mockReturnValue('.siem-signals-test-index');
+
     updateRulesBulkRoute(server.router, ml, isRuleRegistryEnabled);
   });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
index 6138690070b62..d8b7e8cb2b724 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
@@ -19,6 +19,8 @@ import { getIdBulkError } from './utils';
 import { transformValidateBulkError } from './validate';
 import { transformBulkError, buildSiemResponse, createBulkErrorObject } from '../utils';
 import { updateRules } from '../../rules/update_rules';
+import { legacyMigrate } from '../../rules/utils';
+import { readRules } from '../../rules/read_rules';
 
 export const updateRulesBulkRoute = (
   router: SecuritySolutionPluginRouter,
@@ -69,10 +71,24 @@ export const updateRulesBulkRoute = (
 
             throwHttpError(await mlAuthz.validateRuleType(payloadRule.type));
 
+            const existingRule = await readRules({
+              isRuleRegistryEnabled,
+              rulesClient,
+              ruleId: payloadRule.rule_id,
+              id: payloadRule.id,
+            });
+
+            await legacyMigrate({
+              rulesClient,
+              savedObjectsClient,
+              rule: existingRule,
+            });
+
             const rule = await updateRules({
               spaceId: context.securitySolution.getSpaceId(),
               rulesClient,
               ruleStatusClient,
+              savedObjectsClient,
               defaultOutputIndex: siemClient.getSignalsIndex(),
               ruleUpdate: payloadRule,
               isRuleRegistryEnabled,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
index 7d611f3cccbf2..37df792b421b0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
@@ -44,7 +44,7 @@ describe.each([
       getAlertMock(isRuleRegistryEnabled, getQueryRuleParams())
     ); // successful update
     clients.ruleExecutionLogClient.find.mockResolvedValue([]); // successful transform: ;
-
+    clients.appClient.getSignalsIndex.mockReturnValue('.siem-signals-test-index');
     updateRulesRoute(server.router, ml, isRuleRegistryEnabled);
   });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
index 7cfe83093a549..cf443e3293510 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -19,6 +19,8 @@ import { getIdError } from './utils';
 import { transformValidate } from './validate';
 import { updateRules } from '../../rules/update_rules';
 import { buildRouteValidation } from '../../../../utils/build_validation/route_validation';
+import { legacyMigrate } from '../../rules/utils';
+import { readRules } from '../../rules/read_rules';
 
 export const updateRulesRoute = (
   router: SecuritySolutionPluginRouter,
@@ -59,11 +61,25 @@ export const updateRulesRoute = (
         throwHttpError(await mlAuthz.validateRuleType(request.body.type));
 
         const ruleStatusClient = context.securitySolution.getExecutionLogClient();
+
+        const existingRule = await readRules({
+          isRuleRegistryEnabled,
+          rulesClient,
+          ruleId: request.body.rule_id,
+          id: request.body.id,
+        });
+
+        await legacyMigrate({
+          rulesClient,
+          savedObjectsClient,
+          rule: existingRule,
+        });
         const rule = await updateRules({
           defaultOutputIndex: siemClient.getSignalsIndex(),
           isRuleRegistryEnabled,
           rulesClient,
           ruleStatusClient,
+          savedObjectsClient,
           ruleUpdate: request.body,
           spaceId: context.securitySolution.getSpaceId(),
         });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts
index 1d09e4ca5c508..3626bcd5f127e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.mock.ts
@@ -7,6 +7,7 @@
 
 import { PatchRulesOptions } from './types';
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
+import { savedObjectsClientMock } from '../../../../../../../src/core/server/mocks';
 import { getAlertMock } from '../routes/__mocks__/request_responses';
 import { getMlRuleParams, getQueryRuleParams } from '../schemas/rule_schemas.mock';
 import { ruleExecutionLogClientMock } from '../rule_execution_log/__mocks__/rule_execution_log_client';
@@ -15,6 +16,7 @@ export const getPatchRulesOptionsMock = (isRuleRegistryEnabled: boolean): PatchR
   author: ['Elastic'],
   buildingBlockType: undefined,
   rulesClient: rulesClientMock.create(),
+  savedObjectsClient: savedObjectsClientMock.create(),
   spaceId: 'default',
   ruleStatusClient: ruleExecutionLogClientMock.create(),
   anomalyThreshold: undefined,
@@ -68,6 +70,7 @@ export const getPatchMlRulesOptionsMock = (isRuleRegistryEnabled: boolean): Patc
   author: ['Elastic'],
   buildingBlockType: undefined,
   rulesClient: rulesClientMock.create(),
+  savedObjectsClient: savedObjectsClientMock.create(),
   spaceId: 'default',
   ruleStatusClient: ruleExecutionLogClientMock.create(),
   anomalyThreshold: 55,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts
index c3b7e7288dc57..fd48cd4eebc2c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/patch_rules.ts
@@ -37,6 +37,7 @@ class PatchError extends Error {
 
 export const patchRules = async ({
   rulesClient,
+  savedObjectsClient,
   author,
   buildingBlockType,
   ruleStatusClient,
@@ -191,14 +192,14 @@ export const patchRules = async ({
 
   const newRule = {
     tags: addTags(tags ?? rule.tags, rule.params.ruleId, rule.params.immutable),
-    throttle: throttle !== undefined ? transformToAlertThrottle(throttle) : rule.throttle,
-    notifyWhen: throttle !== undefined ? transformToNotifyWhen(throttle) : rule.notifyWhen,
     name: calculateName({ updatedName: name, originalName: rule.name }),
     schedule: {
       interval: calculateInterval(interval, rule.schedule.interval),
     },
-    actions: actions?.map(transformRuleToAlertAction) ?? rule.actions,
     params: removeUndefined(nextParams),
+    actions: actions?.map(transformRuleToAlertAction) ?? rule.actions,
+    throttle: throttle !== undefined ? transformToAlertThrottle(throttle) : rule.throttle,
+    notifyWhen: throttle !== undefined ? transformToNotifyWhen(throttle) : rule.notifyWhen,
   };
 
   const [validated, errors] = validate(newRule, internalRuleUpdate);
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts
index 53a83d61da78d..a4ef081154010 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/types.ts
@@ -8,7 +8,12 @@
 import { get } from 'lodash/fp';
 import { Readable } from 'stream';
 
-import { SavedObject, SavedObjectAttributes, SavedObjectsFindResult } from 'kibana/server';
+import {
+  SavedObject,
+  SavedObjectAttributes,
+  SavedObjectsClientContract,
+  SavedObjectsFindResult,
+} from 'kibana/server';
 import type {
   MachineLearningJobIdOrUndefined,
   From,
@@ -271,12 +276,14 @@ export interface UpdateRulesOptions {
   rulesClient: RulesClient;
   defaultOutputIndex: string;
   ruleUpdate: UpdateRulesSchema;
+  savedObjectsClient: SavedObjectsClientContract;
 }
 
 export interface PatchRulesOptions {
   spaceId: string;
   ruleStatusClient: IRuleExecutionLogClient;
   rulesClient: RulesClient;
+  savedObjectsClient: SavedObjectsClientContract;
   anomalyThreshold: AnomalyThresholdOrUndefined;
   author: AuthorOrUndefined;
   buildingBlockType: BuildingBlockTypeOrUndefined;
@@ -323,7 +330,7 @@ export interface PatchRulesOptions {
   version: VersionOrUndefined;
   exceptionsList: ListArrayOrUndefined;
   actions: RuleAlertAction[] | undefined;
-  rule: SanitizedAlert<RuleParams> | null;
+  rule: SanitizedAlert<RuleParams> | null | undefined;
   namespace?: NamespaceOrUndefined;
 }
 
@@ -351,3 +358,9 @@ export interface FindRuleOptions {
   fields: FieldsOrUndefined;
   sortOrder: SortOrderOrUndefined;
 }
+
+export interface LegacyMigrateParams {
+  rulesClient: RulesClient;
+  savedObjectsClient: SavedObjectsClientContract;
+  rule: SanitizedAlert<RuleParams> | null | undefined;
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts
index 7c9f0c9ec67a3..9bd0fe3cef59a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.test.ts
@@ -6,6 +6,7 @@
  */
 
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
+import { savedObjectsClientMock } from '../../../../../../../src/core/server/mocks';
 import { getFindResultWithSingleHit } from '../routes/__mocks__/request_responses';
 import { updatePrepackagedRules } from './update_prepacked_rules';
 import { patchRules } from './patch_rules';
@@ -19,10 +20,12 @@ describe.each([
 ])('updatePrepackagedRules - %s', (_, isRuleRegistryEnabled) => {
   let rulesClient: ReturnType<typeof rulesClientMock.create>;
   let ruleStatusClient: ReturnType<typeof ruleExecutionLogClientMock.create>;
+  let savedObjectsClient: ReturnType<typeof savedObjectsClientMock.create>;
 
   beforeEach(() => {
     rulesClient = rulesClientMock.create();
     ruleStatusClient = ruleExecutionLogClientMock.create();
+    savedObjectsClient = savedObjectsClientMock.create();
   });
 
   it('should omit actions and enabled when calling patchRules', async () => {
@@ -40,6 +43,7 @@ describe.each([
 
     await updatePrepackagedRules(
       rulesClient,
+      savedObjectsClient,
       'default',
       ruleStatusClient,
       [{ ...prepackagedRule, actions }],
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts
index d9c2ecd1b5732..dcf43d41e8d78 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_prepacked_rules.ts
@@ -6,6 +6,7 @@
  */
 
 import { chunk } from 'lodash/fp';
+import { SavedObjectsClientContract } from 'kibana/server';
 import { AddPrepackagedRulesSchemaDecoded } from '../../../../common/detection_engine/schemas/request/add_prepackaged_rules_schema';
 import { RulesClient, PartialAlert } from '../../../../../alerting/server';
 import { patchRules } from './patch_rules';
@@ -13,6 +14,7 @@ import { readRules } from './read_rules';
 import { PartialFilter } from '../types';
 import { RuleParams } from '../schemas/rule_schemas';
 import { IRuleExecutionLogClient } from '../rule_execution_log/types';
+import { legacyMigrate } from './utils';
 
 /**
  * How many rules to update at a time is set to 50 from errors coming from
@@ -51,6 +53,7 @@ export const UPDATE_CHUNK_SIZE = 50;
  */
 export const updatePrepackagedRules = async (
   rulesClient: RulesClient,
+  savedObjectsClient: SavedObjectsClientContract,
   spaceId: string,
   ruleStatusClient: IRuleExecutionLogClient,
   rules: AddPrepackagedRulesSchemaDecoded[],
@@ -61,6 +64,7 @@ export const updatePrepackagedRules = async (
   for (const ruleChunk of ruleChunks) {
     const rulePromises = createPromises(
       rulesClient,
+      savedObjectsClient,
       spaceId,
       ruleStatusClient,
       ruleChunk,
@@ -82,6 +86,7 @@ export const updatePrepackagedRules = async (
  */
 export const createPromises = (
   rulesClient: RulesClient,
+  savedObjectsClient: SavedObjectsClientContract,
   spaceId: string,
   ruleStatusClient: IRuleExecutionLogClient,
   rules: AddPrepackagedRulesSchemaDecoded[],
@@ -146,10 +151,17 @@ export const createPromises = (
     // TODO: Fix these either with an is conversion or by better typing them within io-ts
     const filters: PartialFilter[] | undefined = filtersObject as PartialFilter[];
 
+    const migratedRule = await legacyMigrate({
+      rulesClient,
+      savedObjectsClient,
+      rule: existingRule,
+    });
+
     // Note: we do not pass down enabled as we do not want to suddenly disable
     // or enable rules on the user when they were not expecting it if a rule updates
     return patchRules({
       rulesClient,
+      savedObjectsClient,
       author,
       buildingBlockType,
       description,
@@ -160,7 +172,7 @@ export const createPromises = (
       language,
       license,
       outputIndex,
-      rule: existingRule,
+      rule: migratedRule,
       savedId,
       spaceId,
       ruleStatusClient,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.mock.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.mock.ts
index 58d6cf1fd5e6b..9a7711fcc8987 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.mock.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.mock.ts
@@ -6,6 +6,7 @@
  */
 
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
+import { savedObjectsClientMock } from '../../../../../../../src/core/server/mocks';
 import {
   getUpdateMachineLearningSchemaMock,
   getUpdateRulesSchemaMock,
@@ -16,6 +17,7 @@ export const getUpdateRulesOptionsMock = (isRuleRegistryEnabled: boolean) => ({
   spaceId: 'default',
   rulesClient: rulesClientMock.create(),
   ruleStatusClient: ruleExecutionLogClientMock.create(),
+  savedObjectsClient: savedObjectsClientMock.create(),
   defaultOutputIndex: '.siem-signals-default',
   ruleUpdate: getUpdateRulesSchemaMock(),
   isRuleRegistryEnabled,
@@ -25,6 +27,7 @@ export const getUpdateMlRulesOptionsMock = (isRuleRegistryEnabled: boolean) => (
   spaceId: 'default',
   rulesClient: rulesClientMock.create(),
   ruleStatusClient: ruleExecutionLogClientMock.create(),
+  savedObjectsClient: savedObjectsClientMock.create(),
   defaultOutputIndex: '.siem-signals-default',
   ruleUpdate: getUpdateMachineLearningSchemaMock(),
   isRuleRegistryEnabled,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.ts
index f4060f7f831a9..4268ed9014066 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/update_rules.ts
@@ -6,7 +6,7 @@
  */
 
 /* eslint-disable complexity */
-
+import { validate } from '@kbn/securitysolution-io-ts-utils';
 import { DEFAULT_MAX_SIGNALS } from '../../../../common/constants';
 import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
 import { PartialAlert } from '../../../../../alerting/server';
@@ -14,10 +14,18 @@ import { readRules } from './read_rules';
 import { UpdateRulesOptions } from './types';
 import { addTags } from './add_tags';
 import { typeSpecificSnakeToCamel } from '../schemas/rule_converters';
-import { RuleParams } from '../schemas/rule_schemas';
+import { internalRuleUpdate, RuleParams } from '../schemas/rule_schemas';
 import { enableRule } from './enable_rule';
 import { maybeMute, transformToAlertThrottle, transformToNotifyWhen } from './utils';
 
+class UpdateError extends Error {
+  public readonly statusCode: number;
+  constructor(message: string, statusCode: number) {
+    super(message);
+    this.statusCode = statusCode;
+  }
+}
+
 export const updateRules = async ({
   isRuleRegistryEnabled,
   spaceId,
@@ -25,6 +33,7 @@ export const updateRules = async ({
   ruleStatusClient,
   defaultOutputIndex,
   ruleUpdate,
+  savedObjectsClient,
 }: UpdateRulesOptions): Promise<PartialAlert<RuleParams> | null> => {
   const existingRule = await readRules({
     isRuleRegistryEnabled,
@@ -82,9 +91,14 @@ export const updateRules = async ({
     notifyWhen: transformToNotifyWhen(ruleUpdate.throttle),
   };
 
+  const [validated, errors] = validate(newInternalRule, internalRuleUpdate);
+  if (errors != null || validated === null) {
+    throw new UpdateError(`Applying update would create invalid rule: ${errors}`, 400);
+  }
+
   const update = await rulesClient.update({
     id: existingRule.id,
-    data: newInternalRule,
+    data: validated,
   });
 
   await maybeMute({
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
index 4647a4a9951df..a558024a73e34 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
@@ -65,6 +65,9 @@ import { RulesClient } from '../../../../../alerting/server';
 import { LegacyRuleActions } from '../rule_actions/legacy_types';
 import { FullResponseSchema } from '../../../../common/detection_engine/schemas/request';
 import { transformAlertToRuleAction } from '../../../../common/detection_engine/transform_actions';
+// eslint-disable-next-line no-restricted-imports
+import { legacyRuleActionsSavedObjectType } from '../rule_actions/legacy_saved_object_mappings';
+import { LegacyMigrateParams } from './types';
 
 export const calculateInterval = (
   interval: string | undefined,
@@ -296,3 +299,62 @@ export const maybeMute = async ({
     // Do nothing, no-operation
   }
 };
+
+/**
+ * Determines if rule needs to be migrated from legacy actions
+ * and returns necessary pieces for the updated rule
+ */
+export const legacyMigrate = async ({
+  rulesClient,
+  savedObjectsClient,
+  rule,
+}: LegacyMigrateParams): Promise<SanitizedAlert<RuleParams> | null | undefined> => {
+  if (rule == null || rule.id == null) {
+    return rule;
+  }
+  /**
+   * On update / patch I'm going to take the actions as they are, better off taking rules client.find (siem.notification) result
+   * and putting that into the actions array of the rule, then set the rules onThrottle property, notifyWhen and throttle from null -> actualy value (1hr etc..)
+   * Then use the rules client to delete the siem.notification
+   * Then with the legacy Rule Actions saved object type, just delete it.
+   */
+
+  // find it using the references array, not params.ruleAlertId
+  const [siemNotification, legacyRuleActionsSO] = await Promise.all([
+    rulesClient.find({
+      options: {
+        hasReference: {
+          type: 'alert',
+          id: rule.id,
+        },
+      },
+    }),
+    savedObjectsClient.find({
+      type: legacyRuleActionsSavedObjectType,
+    }),
+  ]);
+
+  if (siemNotification != null && siemNotification.data.length > 0) {
+    await Promise.all([
+      rulesClient.delete({ id: siemNotification.data[0].id }),
+      legacyRuleActionsSO != null && legacyRuleActionsSO.saved_objects.length > 0
+        ? savedObjectsClient.delete(
+            legacyRuleActionsSavedObjectType,
+            legacyRuleActionsSO.saved_objects[0].id
+          )
+        : null,
+    ]);
+    const migratedRule = {
+      ...rule,
+      actions: siemNotification.data[0].actions,
+      throttle: siemNotification.data[0].schedule.interval,
+      notifyWhen: transformToNotifyWhen(siemNotification.data[0].throttle),
+    };
+    await rulesClient.update({
+      id: rule.id,
+      data: migratedRule,
+    });
+    return migratedRule;
+  }
+  return rule;
+};

From 9750b24fc04fcab2ceee0cb943d46084104de08d Mon Sep 17 00:00:00 2001
From: Ignacio Rivas <rivasign@gmail.com>
Date: Tue, 19 Oct 2021 17:59:07 +0100
Subject: [PATCH 30/36] [Upgrade Assistant] Rename upgrade_status to
 migration_status (#114755)

---
 .../migrate_system_indices.test.tsx                    | 10 +++++-----
 .../overview/migrate_system_indices/mocks.ts           | 10 +++++-----
 .../migrate_system_indices/step_completion.test.ts     |  8 ++++----
 x-pack/plugins/upgrade_assistant/common/types.ts       |  6 +++---
 .../overview/migrate_system_indices/flyout.tsx         | 10 +++++-----
 .../migrate_system_indices/migrate_system_indices.tsx  |  8 ++++----
 .../use_migrate_system_indices.ts                      |  2 +-
 .../server/lib/es_deprecations_status.test.ts          |  4 ++--
 .../server/lib/es_system_indices_migration.test.ts     |  6 +++---
 .../server/routes/system_indices_migration.test.ts     |  4 ++--
 10 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/migrate_system_indices.test.tsx b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/migrate_system_indices.test.tsx
index c5f680319d0ab..f6c69c818b378 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/migrate_system_indices.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/migrate_system_indices.test.tsx
@@ -45,7 +45,7 @@ describe('Overview - Migrate system indices', () => {
       component.update();
 
       httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-        upgrade_status: 'NO_UPGRADE_NEEDED',
+        migration_status: 'NO_MIGRATION_NEEDED',
       });
 
       await actions.clickRetrySystemIndicesButton();
@@ -56,7 +56,7 @@ describe('Overview - Migrate system indices', () => {
 
   test('No migration needed', async () => {
     httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-      upgrade_status: 'NO_UPGRADE_NEEDED',
+      migration_status: 'NO_MIGRATION_NEEDED',
     });
 
     testBed = await setupOverviewPage();
@@ -72,7 +72,7 @@ describe('Overview - Migrate system indices', () => {
 
   test('Migration in progress', async () => {
     httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-      upgrade_status: 'IN_PROGRESS',
+      migration_status: 'IN_PROGRESS',
     });
 
     testBed = await setupOverviewPage();
@@ -91,7 +91,7 @@ describe('Overview - Migrate system indices', () => {
   describe('Migration needed', () => {
     test('Initial state', async () => {
       httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-        upgrade_status: 'UPGRADE_NEEDED',
+        migration_status: 'MIGRATION_NEEDED',
       });
 
       testBed = await setupOverviewPage();
@@ -109,7 +109,7 @@ describe('Overview - Migrate system indices', () => {
 
     test('Handles errors when migrating', async () => {
       httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-        upgrade_status: 'UPGRADE_NEEDED',
+        migration_status: 'MIGRATION_NEEDED',
       });
       httpRequestsMockHelpers.setSystemIndicesMigrationResponse(undefined, {
         statusCode: 400,
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/mocks.ts b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/mocks.ts
index 298f537819507..a810799c434e0 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/mocks.ts
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/mocks.ts
@@ -8,12 +8,12 @@
 import { SystemIndicesMigrationStatus } from '../../../../common/types';
 
 export const systemIndicesMigrationStatus: SystemIndicesMigrationStatus = {
-  upgrade_status: 'UPGRADE_NEEDED',
+  migration_status: 'MIGRATION_NEEDED',
   features: [
     {
       feature_name: 'security',
       minimum_index_version: '7.1.1',
-      upgrade_status: 'ERROR',
+      migration_status: 'ERROR',
       indices: [
         {
           index: '.security-7',
@@ -24,7 +24,7 @@ export const systemIndicesMigrationStatus: SystemIndicesMigrationStatus = {
     {
       feature_name: 'machine_learning',
       minimum_index_version: '7.1.2',
-      upgrade_status: 'IN_PROGRESS',
+      migration_status: 'IN_PROGRESS',
       indices: [
         {
           index: '.ml-config',
@@ -35,7 +35,7 @@ export const systemIndicesMigrationStatus: SystemIndicesMigrationStatus = {
     {
       feature_name: 'kibana',
       minimum_index_version: '7.1.3',
-      upgrade_status: 'UPGRADE_NEEDED',
+      migration_status: 'MIGRATION_NEEDED',
       indices: [
         {
           index: '.kibana',
@@ -46,7 +46,7 @@ export const systemIndicesMigrationStatus: SystemIndicesMigrationStatus = {
     {
       feature_name: 'logstash',
       minimum_index_version: '7.1.4',
-      upgrade_status: 'NO_UPGRADE_NEEDED',
+      migration_status: 'NO_MIGRATION_NEEDED',
       indices: [
         {
           index: '.logstash-config',
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/step_completion.test.ts b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/step_completion.test.ts
index c5173481d8dac..9eb0831c3c7a0 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/step_completion.test.ts
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/migrate_system_indices/step_completion.test.ts
@@ -21,7 +21,7 @@ describe('Overview - Migrate system indices - Step completion', () => {
 
   test(`It's complete when no upgrade is needed`, async () => {
     httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-      upgrade_status: 'NO_UPGRADE_NEEDED',
+      migration_status: 'NO_MIGRATION_NEEDED',
     });
 
     await act(async () => {
@@ -37,7 +37,7 @@ describe('Overview - Migrate system indices - Step completion', () => {
 
   test(`It's incomplete when migration is needed`, async () => {
     httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-      upgrade_status: 'UPGRADE_NEEDED',
+      migration_status: 'MIGRATION_NEEDED',
     });
 
     await act(async () => {
@@ -57,7 +57,7 @@ describe('Overview - Migrate system indices - Step completion', () => {
 
       // First request should make the step be incomplete
       httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-        upgrade_status: 'IN_PROGRESS',
+        migration_status: 'IN_PROGRESS',
       });
 
       testBed = await setupOverviewPage();
@@ -73,7 +73,7 @@ describe('Overview - Migrate system indices - Step completion', () => {
       expect(exists('migrateSystemIndicesStep-incomplete')).toBe(true);
 
       httpRequestsMockHelpers.setLoadSystemIndicesMigrationStatus({
-        upgrade_status: 'NO_UPGRADE_NEEDED',
+        migration_status: 'NO_MIGRATION_NEEDED',
       });
 
       // Resolve the polling timeout.
diff --git a/x-pack/plugins/upgrade_assistant/common/types.ts b/x-pack/plugins/upgrade_assistant/common/types.ts
index e13af1f94d9c2..1cbcb78ccf1c4 100644
--- a/x-pack/plugins/upgrade_assistant/common/types.ts
+++ b/x-pack/plugins/upgrade_assistant/common/types.ts
@@ -233,12 +233,12 @@ export interface DeprecationLoggingStatus {
   isDeprecationLoggingEnabled: boolean;
 }
 
-export type UPGRADE_STATUS = 'UPGRADE_NEEDED' | 'NO_UPGRADE_NEEDED' | 'IN_PROGRESS' | 'ERROR';
+export type MIGRATION_STATUS = 'MIGRATION_NEEDED' | 'NO_MIGRATION_NEEDED' | 'IN_PROGRESS' | 'ERROR';
 export interface SystemIndicesMigrationFeature {
   id?: string;
   feature_name: string;
   minimum_index_version: string;
-  upgrade_status: UPGRADE_STATUS;
+  migration_status: MIGRATION_STATUS;
   indices: Array<{
     index: string;
     version: string;
@@ -246,7 +246,7 @@ export interface SystemIndicesMigrationFeature {
 }
 export interface SystemIndicesMigrationStatus {
   features: SystemIndicesMigrationFeature[];
-  upgrade_status: UPGRADE_STATUS;
+  migration_status: MIGRATION_STATUS;
 }
 export interface SystemIndicesMigrationStarted {
   features: SystemIndicesMigrationFeature[];
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/flyout.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/flyout.tsx
index 612fcdc2e4c03..0eac26fae2be3 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/flyout.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/flyout.tsx
@@ -27,7 +27,7 @@ import {
 import {
   SystemIndicesMigrationStatus,
   SystemIndicesMigrationFeature,
-  UPGRADE_STATUS,
+  MIGRATION_STATUS,
 } from '../../../../../common/types';
 
 export interface SystemIndicesFlyoutProps {
@@ -84,8 +84,8 @@ const i18nTexts = {
   ),
 };
 
-const renderMigrationStatus = (status: UPGRADE_STATUS) => {
-  if (status === 'NO_UPGRADE_NEEDED') {
+const renderMigrationStatus = (status: MIGRATION_STATUS) => {
+  if (status === 'NO_MIGRATION_NEEDED') {
     return (
       <EuiFlexGroup alignItems="center" gutterSize="s">
         <EuiFlexItem grow={false}>
@@ -100,7 +100,7 @@ const renderMigrationStatus = (status: UPGRADE_STATUS) => {
     );
   }
 
-  if (status === 'UPGRADE_NEEDED') {
+  if (status === 'MIGRATION_NEEDED') {
     return (
       <EuiText size="s" data-test-subj="featureUpgradeNeeded">
         <p>{i18nTexts.needsMigrationLabel}</p>
@@ -150,7 +150,7 @@ const columns = [
     render: (name: string) => startCase(name),
   },
   {
-    field: 'upgrade_status',
+    field: 'migration_status',
     name: i18nTexts.statusTableColumn,
     sortable: true,
     render: renderMigrationStatus,
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/migrate_system_indices.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/migrate_system_indices.tsx
index 75806f43bb19e..7d0405dbbb874 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/migrate_system_indices.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/migrate_system_indices.tsx
@@ -83,10 +83,10 @@ const MigrateSystemIndicesStep: FunctionComponent<Props> = ({ setIsComplete }) =
     useMigrateSystemIndices();
 
   useEffect(() => {
-    setIsComplete(migrationStatus.data?.upgrade_status === 'NO_UPGRADE_NEEDED');
+    setIsComplete(migrationStatus.data?.migration_status === 'NO_MIGRATION_NEEDED');
     // Depending upon setIsComplete would create an infinite loop.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [migrationStatus.data?.upgrade_status]);
+  }, [migrationStatus.data?.migration_status]);
 
   if (migrationStatus.error) {
     return (
@@ -111,7 +111,7 @@ const MigrateSystemIndicesStep: FunctionComponent<Props> = ({ setIsComplete }) =
     );
   }
 
-  if (migrationStatus.data?.upgrade_status === 'NO_UPGRADE_NEEDED') {
+  if (migrationStatus.data?.migration_status === 'NO_MIGRATION_NEEDED') {
     return (
       <EuiFlexGroup alignItems="center" gutterSize="s" data-test-subj="noMigrationNeededSection">
         <EuiFlexItem grow={false}>
@@ -127,7 +127,7 @@ const MigrateSystemIndicesStep: FunctionComponent<Props> = ({ setIsComplete }) =
   }
 
   const isButtonDisabled = migrationStatus.isInitialRequest && migrationStatus.isLoading;
-  const isMigrating = migrationStatus.data?.upgrade_status === 'IN_PROGRESS';
+  const isMigrating = migrationStatus.data?.migration_status === 'IN_PROGRESS';
 
   return (
     <>
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/use_migrate_system_indices.ts b/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/use_migrate_system_indices.ts
index 0d4ea9bfaf35c..d66b4009cd02f 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/use_migrate_system_indices.ts
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/overview/migrate_system_indices/use_migrate_system_indices.ts
@@ -37,7 +37,7 @@ export const useMigrateSystemIndices = () => {
 
   const { data, error, isLoading, resendRequest, isInitialRequest } =
     api.useLoadSystemIndicesMigrationStatus();
-  const isInProgress = data?.upgrade_status === 'IN_PROGRESS';
+  const isInProgress = data?.migration_status === 'IN_PROGRESS';
 
   // We only want to poll for the status while the migration process is in progress.
   useInterval(resendRequest, isInProgress ? SYSTEM_INDICES_MIGRATION_POLL_INTERVAL_MS : null);
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/es_deprecations_status.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/es_deprecations_status.test.ts
index f2c54c71e4e2b..6fafb54f31e5c 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/es_deprecations_status.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/es_deprecations_status.test.ts
@@ -46,7 +46,7 @@ describe('getESUpgradeStatus', () => {
         {
           feature_name: 'machine_learning',
           minimum_index_version: '7.1.1',
-          upgrade_status: 'UPGRADE_NEEDED',
+          migration_status: 'MIGRATION_NEEDED',
           indices: [
             {
               index: '.ml-config',
@@ -55,7 +55,7 @@ describe('getESUpgradeStatus', () => {
           ],
         },
       ],
-      upgrade_status: 'UPGRADE_NEEDED',
+      migration_status: 'MIGRATION_NEEDED',
     })
   );
 
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/es_system_indices_migration.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/es_system_indices_migration.test.ts
index 6f4ca5a341218..560d42712b5da 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/es_system_indices_migration.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/es_system_indices_migration.test.ts
@@ -13,7 +13,7 @@ const esUpgradeSystemIndicesStatusMock: SystemIndicesMigrationStatus = {
     {
       feature_name: 'machine_learning',
       minimum_index_version: '7.1.1',
-      upgrade_status: 'UPGRADE_NEEDED',
+      migration_status: 'MIGRATION_NEEDED',
       indices: [
         {
           index: '.ml-config',
@@ -28,7 +28,7 @@ const esUpgradeSystemIndicesStatusMock: SystemIndicesMigrationStatus = {
     {
       feature_name: 'security',
       minimum_index_version: '7.1.1',
-      upgrade_status: 'UPGRADE_NEEDED',
+      migration_status: 'MIGRATION_NEEDED',
       indices: [
         {
           index: '.ml-config',
@@ -37,7 +37,7 @@ const esUpgradeSystemIndicesStatusMock: SystemIndicesMigrationStatus = {
       ],
     },
   ],
-  upgrade_status: 'UPGRADE_NEEDED',
+  migration_status: 'MIGRATION_NEEDED',
 };
 
 describe('convertFeaturesToIndicesArray', () => {
diff --git a/x-pack/plugins/upgrade_assistant/server/routes/system_indices_migration.test.ts b/x-pack/plugins/upgrade_assistant/server/routes/system_indices_migration.test.ts
index 2d15bed7e29e3..8e928fb3bc7c9 100644
--- a/x-pack/plugins/upgrade_assistant/server/routes/system_indices_migration.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/routes/system_indices_migration.test.ts
@@ -21,7 +21,7 @@ const mockedResponse = {
     {
       feature_name: 'security',
       minimum_index_version: '7.1.1',
-      upgrade_status: 'NO_UPGRADE_NEEDED',
+      migration_status: 'NO_MIGRATION_NEEDED',
       indices: [
         {
           index: '.security-7',
@@ -30,7 +30,7 @@ const mockedResponse = {
       ],
     },
   ],
-  upgrade_status: 'UPGRADE_NEEDED',
+  migration_status: 'MIGRATION_NEEDED',
 };
 
 /**

From e36abb51f63b8cb0bd152753580ca6d41534daf3 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 13:06:07 -0400
Subject: [PATCH 31/36] [Discover] Improve doc viewer code in Discover
 (#114759) (#115578)

Co-authored-by: Dmitry Tomashevich <39378793+Dmitriynj@users.noreply.github.com>

Co-authored-by: Matthias Wilhelm <matthias.wilhelm@elastic.co>
Co-authored-by: Dmitry Tomashevich <39378793+Dmitriynj@users.noreply.github.com>
---
 .../public/__mocks__/index_patterns.ts        |  8 +++--
 .../apps/context/context_app_route.tsx        | 26 +++++++++++++-
 .../apps/doc/components/doc.test.tsx          | 21 ++---------
 .../application/apps/doc/components/doc.tsx   | 16 ++++-----
 .../application/apps/doc/single_doc_route.tsx | 35 ++++++++++++++-----
 .../doc_viewer/doc_viewer_tab.test.tsx        |  3 ++
 .../__snapshots__/source_viewer.test.tsx.snap | 18 ++++++++--
 .../source_viewer/source_viewer.test.tsx      | 14 ++++----
 .../source_viewer/source_viewer.tsx           | 17 ++++-----
 .../application/components/table/table.tsx    |  2 +-
 .../application/doc_views/doc_views_types.ts  |  2 +-
 .../helpers/use_index_pattern.test.tsx        | 20 ++++++++---
 .../application/helpers/use_index_pattern.tsx | 13 ++++---
 .../services/use_es_doc_search.test.tsx       | 24 ++++---------
 .../application/services/use_es_doc_search.ts | 15 +++-----
 src/plugins/discover/public/plugin.tsx        |  2 +-
 16 files changed, 135 insertions(+), 101 deletions(-)

diff --git a/src/plugins/discover/public/__mocks__/index_patterns.ts b/src/plugins/discover/public/__mocks__/index_patterns.ts
index 88447eacc884d..b90338e895623 100644
--- a/src/plugins/discover/public/__mocks__/index_patterns.ts
+++ b/src/plugins/discover/public/__mocks__/index_patterns.ts
@@ -10,12 +10,14 @@ import { IndexPatternsService } from '../../../data/common';
 import { indexPatternMock } from './index_pattern';
 
 export const indexPatternsMock = {
-  getCache: () => {
+  getCache: async () => {
     return [indexPatternMock];
   },
-  get: (id: string) => {
+  get: async (id: string) => {
     if (id === 'the-index-pattern-id') {
-      return indexPatternMock;
+      return Promise.resolve(indexPatternMock);
+    } else if (id === 'invalid-index-pattern-id') {
+      return Promise.reject('Invald');
     }
   },
   updateSavedObject: jest.fn(),
diff --git a/src/plugins/discover/public/application/apps/context/context_app_route.tsx b/src/plugins/discover/public/application/apps/context/context_app_route.tsx
index d124fd6cfa395..6c4722418be14 100644
--- a/src/plugins/discover/public/application/apps/context/context_app_route.tsx
+++ b/src/plugins/discover/public/application/apps/context/context_app_route.tsx
@@ -8,6 +8,8 @@
 import React, { useEffect } from 'react';
 import { useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
+import { EuiEmptyPrompt } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { DiscoverServices } from '../../../build_services';
 import { ContextApp } from './context_app';
 import { getRootBreadcrumbs } from '../../helpers/breadcrumbs';
@@ -43,7 +45,29 @@ export function ContextAppRoute(props: ContextAppProps) {
     ]);
   }, [chrome]);
 
-  const indexPattern = useIndexPattern(services.indexPatterns, indexPatternId);
+  const { indexPattern, error } = useIndexPattern(services.indexPatterns, indexPatternId);
+
+  if (error) {
+    return (
+      <EuiEmptyPrompt
+        iconType="alert"
+        iconColor="danger"
+        title={
+          <FormattedMessage
+            id="discover.singleDocRoute.errorTitle"
+            defaultMessage="An error occured"
+          />
+        }
+        body={
+          <FormattedMessage
+            id="discover.singleDocRoute.errorMessage"
+            defaultMessage="No matching index pattern for id {indexPatternId}"
+            values={{ indexPatternId }}
+          />
+        }
+      />
+    );
+  }
 
   if (!indexPattern) {
     return <LoadingIndicator />;
diff --git a/src/plugins/discover/public/application/apps/doc/components/doc.test.tsx b/src/plugins/discover/public/application/apps/doc/components/doc.test.tsx
index 31ff39ea6b577..68c012ddd92e9 100644
--- a/src/plugins/discover/public/application/apps/doc/components/doc.test.tsx
+++ b/src/plugins/discover/public/application/apps/doc/components/doc.test.tsx
@@ -14,6 +14,7 @@ import { ReactWrapper } from 'enzyme';
 import { findTestSubject } from '@elastic/eui/lib/test';
 import { Doc, DocProps } from './doc';
 import { SEARCH_FIELDS_FROM_SOURCE as mockSearchFieldsFromSource } from '../../../../../common';
+import { indexPatternMock } from '../../../../__mocks__/index_pattern';
 
 const mockSearchApi = jest.fn();
 
@@ -74,21 +75,11 @@ const waitForPromises = async () =>
  * this works but logs ugly error messages until we're using React 16.9
  * should be adapted when we upgrade
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function mountDoc(update = false, indexPatternGetter: any = null) {
-  const indexPattern = {
-    getComputedFields: () => [],
-  };
-  const indexPatternService = {
-    get: indexPatternGetter ? indexPatternGetter : jest.fn(() => Promise.resolve(indexPattern)),
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  } as any;
-
+async function mountDoc(update = false) {
   const props = {
     id: '1',
     index: 'index1',
-    indexPatternId: 'xyz',
-    indexPatternService,
+    indexPattern: indexPatternMock,
   } as DocProps;
   let comp!: ReactWrapper;
   await act(async () => {
@@ -108,12 +99,6 @@ describe('Test of <Doc /> of Discover', () => {
     expect(findTestSubject(comp, 'doc-msg-loading').length).toBe(1);
   });
 
-  test('renders IndexPattern notFound msg', async () => {
-    const indexPatternGetter = jest.fn(() => Promise.reject({ savedObjectId: '007' }));
-    const comp = await mountDoc(true, indexPatternGetter);
-    expect(findTestSubject(comp, 'doc-msg-notFoundIndexPattern').length).toBe(1);
-  });
-
   test('renders notFound msg', async () => {
     mockSearchApi.mockImplementation(() => throwError({ status: 404 }));
     const comp = await mountDoc(true);
diff --git a/src/plugins/discover/public/application/apps/doc/components/doc.tsx b/src/plugins/discover/public/application/apps/doc/components/doc.tsx
index f33ffe561e490..c6cfad3953e95 100644
--- a/src/plugins/discover/public/application/apps/doc/components/doc.tsx
+++ b/src/plugins/discover/public/application/apps/doc/components/doc.tsx
@@ -9,7 +9,7 @@
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiCallOut, EuiLink, EuiLoadingSpinner, EuiPageContent, EuiPage } from '@elastic/eui';
-import { IndexPatternsContract } from 'src/plugins/data/public';
+import { IndexPattern } from 'src/plugins/data/public';
 import { getServices } from '../../../../kibana_services';
 import { DocViewer } from '../../../components/doc_viewer/doc_viewer';
 import { ElasticRequestState } from '../types';
@@ -25,14 +25,9 @@ export interface DocProps {
    */
   index: string;
   /**
-   * IndexPattern ID used to get IndexPattern entity
-   * that's used for adding additional fields (stored_fields, script_fields, docvalue_fields)
+   * IndexPattern entity
    */
-  indexPatternId: string;
-  /**
-   * IndexPatternService to get a given index pattern by ID
-   */
-  indexPatternService: IndexPatternsContract;
+  indexPattern: IndexPattern;
   /**
    * If set, will always request source, regardless of the global `fieldsFromSource` setting
    */
@@ -40,7 +35,8 @@ export interface DocProps {
 }
 
 export function Doc(props: DocProps) {
-  const [reqState, hit, indexPattern] = useEsDocSearch(props);
+  const { indexPattern } = props;
+  const [reqState, hit] = useEsDocSearch(props);
   const indexExistsLink = getServices().docLinks.links.apis.indexExists;
   return (
     <EuiPage>
@@ -54,7 +50,7 @@ export function Doc(props: DocProps) {
               <FormattedMessage
                 id="discover.doc.failedToLocateIndexPattern"
                 defaultMessage="No index pattern matches ID {indexPatternId}."
-                values={{ indexPatternId: props.indexPatternId }}
+                values={{ indexPatternId: indexPattern.id }}
               />
             }
           />
diff --git a/src/plugins/discover/public/application/apps/doc/single_doc_route.tsx b/src/plugins/discover/public/application/apps/doc/single_doc_route.tsx
index 8398f6255e0f9..aef928d523515 100644
--- a/src/plugins/discover/public/application/apps/doc/single_doc_route.tsx
+++ b/src/plugins/discover/public/application/apps/doc/single_doc_route.tsx
@@ -7,6 +7,8 @@
  */
 import React, { useEffect } from 'react';
 import { useLocation, useParams } from 'react-router-dom';
+import { EuiEmptyPrompt } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { DiscoverServices } from '../../../build_services';
 import { getRootBreadcrumbs } from '../../helpers/breadcrumbs';
 import { Doc } from './components/doc';
@@ -31,7 +33,7 @@ function useQuery() {
 
 export function SingleDocRoute(props: SingleDocRouteProps) {
   const { services } = props;
-  const { chrome, timefilter, indexPatterns } = services;
+  const { chrome, timefilter } = services;
 
   const { indexPatternId, index } = useParams<DocUrlParams>();
 
@@ -52,7 +54,29 @@ export function SingleDocRoute(props: SingleDocRouteProps) {
     timefilter.disableTimeRangeSelector();
   });
 
-  const indexPattern = useIndexPattern(services.indexPatterns, indexPatternId);
+  const { indexPattern, error } = useIndexPattern(services.indexPatterns, indexPatternId);
+
+  if (error) {
+    return (
+      <EuiEmptyPrompt
+        iconType="alert"
+        iconColor="danger"
+        title={
+          <FormattedMessage
+            id="discover.singleDocRoute.errorTitle"
+            defaultMessage="An error occured"
+          />
+        }
+        body={
+          <FormattedMessage
+            id="discover.singleDocRoute.errorMessage"
+            defaultMessage="No matching index pattern for id {indexPatternId}"
+            values={{ indexPatternId }}
+          />
+        }
+      />
+    );
+  }
 
   if (!indexPattern) {
     return <LoadingIndicator />;
@@ -60,12 +84,7 @@ export function SingleDocRoute(props: SingleDocRouteProps) {
 
   return (
     <div className="app-container">
-      <Doc
-        id={docId}
-        index={index}
-        indexPatternId={indexPatternId}
-        indexPatternService={indexPatterns}
-      />
+      <Doc id={docId} index={index} indexPattern={indexPattern} />
     </div>
   );
 }
diff --git a/src/plugins/discover/public/application/components/doc_viewer/doc_viewer_tab.test.tsx b/src/plugins/discover/public/application/components/doc_viewer/doc_viewer_tab.test.tsx
index a2434170acdd7..188deba755445 100644
--- a/src/plugins/discover/public/application/components/doc_viewer/doc_viewer_tab.test.tsx
+++ b/src/plugins/discover/public/application/components/doc_viewer/doc_viewer_tab.test.tsx
@@ -10,6 +10,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { DocViewerTab } from './doc_viewer_tab';
 import { ElasticSearchHit } from '../../doc_views/doc_views_types';
+import { indexPatternMock } from '../../../__mocks__/index_pattern';
 
 describe('DocViewerTab', () => {
   test('changing columns triggers an update', () => {
@@ -21,6 +22,7 @@ describe('DocViewerTab', () => {
       renderProps: {
         hit: {} as ElasticSearchHit,
         columns: ['test'],
+        indexPattern: indexPatternMock,
       },
     };
 
@@ -31,6 +33,7 @@ describe('DocViewerTab', () => {
       renderProps: {
         hit: {} as ElasticSearchHit,
         columns: ['test2'],
+        indexPattern: indexPatternMock,
       },
     };
 
diff --git a/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap b/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
index 82d9183f3d394..761263ee861b9 100644
--- a/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
+++ b/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
@@ -5,7 +5,11 @@ exports[`Source Viewer component renders error state 1`] = `
   hasLineNumbers={true}
   id="1"
   index="index1"
-  indexPatternId="xyz"
+  indexPattern={
+    Object {
+      "getComputedFields": [Function],
+    }
+  }
   intl={
     Object {
       "defaultFormats": Object {},
@@ -264,7 +268,11 @@ exports[`Source Viewer component renders json code editor 1`] = `
   hasLineNumbers={true}
   id="1"
   index="index1"
-  indexPatternId="xyz"
+  indexPattern={
+    Object {
+      "getComputedFields": [Function],
+    }
+  }
   intl={
     Object {
       "defaultFormats": Object {},
@@ -619,7 +627,11 @@ exports[`Source Viewer component renders loading state 1`] = `
   hasLineNumbers={true}
   id="1"
   index="index1"
-  indexPatternId="xyz"
+  indexPattern={
+    Object {
+      "getComputedFields": [Function],
+    }
+  }
   intl={
     Object {
       "defaultFormats": Object {},
diff --git a/src/plugins/discover/public/application/components/source_viewer/source_viewer.test.tsx b/src/plugins/discover/public/application/components/source_viewer/source_viewer.test.tsx
index 7895c1025dda9..a98c2de6197d8 100644
--- a/src/plugins/discover/public/application/components/source_viewer/source_viewer.test.tsx
+++ b/src/plugins/discover/public/application/components/source_viewer/source_viewer.test.tsx
@@ -43,13 +43,13 @@ const mockIndexPatternService = {
 }));
 describe('Source Viewer component', () => {
   test('renders loading state', () => {
-    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [0, null, null, () => {}]);
+    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [0, null, () => {}]);
 
     const comp = mountWithIntl(
       <SourceViewer
         id={'1'}
         index={'index1'}
-        indexPatternId={'xyz'}
+        indexPattern={mockIndexPattern}
         width={123}
         hasLineNumbers={true}
       />
@@ -60,13 +60,13 @@ describe('Source Viewer component', () => {
   });
 
   test('renders error state', () => {
-    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [3, null, null, () => {}]);
+    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [3, null, () => {}]);
 
     const comp = mountWithIntl(
       <SourceViewer
         id={'1'}
         index={'index1'}
-        indexPatternId={'xyz'}
+        indexPattern={mockIndexPattern}
         width={123}
         hasLineNumbers={true}
       />
@@ -97,9 +97,7 @@ describe('Source Viewer component', () => {
         _underscore: 123,
       },
     } as never;
-    jest
-      .spyOn(hooks, 'useEsDocSearch')
-      .mockImplementation(() => [2, mockHit, mockIndexPattern, () => {}]);
+    jest.spyOn(hooks, 'useEsDocSearch').mockImplementation(() => [2, mockHit, () => {}]);
     jest.spyOn(useUiSettingHook, 'useUiSetting').mockImplementation(() => {
       return false;
     });
@@ -107,7 +105,7 @@ describe('Source Viewer component', () => {
       <SourceViewer
         id={'1'}
         index={'index1'}
-        indexPatternId={'xyz'}
+        indexPattern={mockIndexPattern}
         width={123}
         hasLineNumbers={true}
       />
diff --git a/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx b/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx
index 9e37ae8f8bf93..31d4d866df21e 100644
--- a/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx
+++ b/src/plugins/discover/public/application/components/source_viewer/source_viewer.tsx
@@ -17,11 +17,12 @@ import { getServices } from '../../../kibana_services';
 import { SEARCH_FIELDS_FROM_SOURCE } from '../../../../common';
 import { ElasticRequestState } from '../../apps/doc/types';
 import { useEsDocSearch } from '../../services/use_es_doc_search';
+import { IndexPattern } from '../../../../../data_views/common';
 
 interface SourceViewerProps {
   id: string;
   index: string;
-  indexPatternId: string;
+  indexPattern: IndexPattern;
   hasLineNumbers: boolean;
   width?: number;
 }
@@ -29,19 +30,17 @@ interface SourceViewerProps {
 export const SourceViewer = ({
   id,
   index,
-  indexPatternId,
+  indexPattern,
   width,
   hasLineNumbers,
 }: SourceViewerProps) => {
   const [editor, setEditor] = useState<monaco.editor.IStandaloneCodeEditor>();
   const [jsonValue, setJsonValue] = useState<string>('');
-  const indexPatternService = getServices().data.indexPatterns;
   const useNewFieldsApi = !getServices().uiSettings.get(SEARCH_FIELDS_FROM_SOURCE);
-  const [reqState, hit, , requestData] = useEsDocSearch({
+  const [reqState, hit, requestData] = useEsDocSearch({
     id,
     index,
-    indexPatternId,
-    indexPatternService,
+    indexPattern,
     requestSource: useNewFieldsApi,
   });
 
@@ -106,11 +105,7 @@ export const SourceViewer = ({
     <EuiEmptyPrompt iconType="alert" title={errorMessageTitle} body={errorMessage} />
   );
 
-  if (
-    reqState === ElasticRequestState.Error ||
-    reqState === ElasticRequestState.NotFound ||
-    reqState === ElasticRequestState.NotFoundIndexPattern
-  ) {
+  if (reqState === ElasticRequestState.Error || reqState === ElasticRequestState.NotFound) {
     return errorState;
   }
 
diff --git a/src/plugins/discover/public/application/components/table/table.tsx b/src/plugins/discover/public/application/components/table/table.tsx
index 7f597d846f88f..e64dbd10f7855 100644
--- a/src/plugins/discover/public/application/components/table/table.tsx
+++ b/src/plugins/discover/public/application/components/table/table.tsx
@@ -25,7 +25,7 @@ export interface DocViewerTableProps {
   columns?: string[];
   filter?: DocViewFilterFn;
   hit: ElasticSearchHit;
-  indexPattern?: IndexPattern;
+  indexPattern: IndexPattern;
   onAddColumn?: (columnName: string) => void;
   onRemoveColumn?: (columnName: string) => void;
 }
diff --git a/src/plugins/discover/public/application/doc_views/doc_views_types.ts b/src/plugins/discover/public/application/doc_views/doc_views_types.ts
index 48bebec22b9b5..d3e482c0f2e1d 100644
--- a/src/plugins/discover/public/application/doc_views/doc_views_types.ts
+++ b/src/plugins/discover/public/application/doc_views/doc_views_types.ts
@@ -32,7 +32,7 @@ export interface DocViewRenderProps {
   columns?: string[];
   filter?: DocViewFilterFn;
   hit: ElasticSearchHit;
-  indexPattern?: IndexPattern;
+  indexPattern: IndexPattern;
   onAddColumn?: (columnName: string) => void;
   onRemoveColumn?: (columnName: string) => void;
 }
diff --git a/src/plugins/discover/public/application/helpers/use_index_pattern.test.tsx b/src/plugins/discover/public/application/helpers/use_index_pattern.test.tsx
index 85282afb6fc37..dfc54d8630742 100644
--- a/src/plugins/discover/public/application/helpers/use_index_pattern.test.tsx
+++ b/src/plugins/discover/public/application/helpers/use_index_pattern.test.tsx
@@ -8,12 +8,24 @@
 import { useIndexPattern } from './use_index_pattern';
 import { indexPatternMock } from '../../__mocks__/index_pattern';
 import { indexPatternsMock } from '../../__mocks__/index_patterns';
-import { renderHook, act } from '@testing-library/react-hooks';
+import { renderHook } from '@testing-library/react-hooks';
 
 describe('Use Index Pattern', () => {
   test('returning a valid index pattern', async () => {
-    const { result } = renderHook(() => useIndexPattern(indexPatternsMock, 'the-index-pattern-id'));
-    await act(() => Promise.resolve());
-    expect(result.current).toBe(indexPatternMock);
+    const { result, waitForNextUpdate } = renderHook(() =>
+      useIndexPattern(indexPatternsMock, 'the-index-pattern-id')
+    );
+    await waitForNextUpdate();
+    expect(result.current.indexPattern).toBe(indexPatternMock);
+    expect(result.current.error).toBe(undefined);
+  });
+
+  test('returning an error', async () => {
+    const { result, waitForNextUpdate } = renderHook(() =>
+      useIndexPattern(indexPatternsMock, 'invalid-index-pattern-id')
+    );
+    await waitForNextUpdate();
+    expect(result.current.indexPattern).toBe(undefined);
+    expect(result.current.error).toBeTruthy();
   });
 });
diff --git a/src/plugins/discover/public/application/helpers/use_index_pattern.tsx b/src/plugins/discover/public/application/helpers/use_index_pattern.tsx
index f53d131920c5c..374f83cbbfe72 100644
--- a/src/plugins/discover/public/application/helpers/use_index_pattern.tsx
+++ b/src/plugins/discover/public/application/helpers/use_index_pattern.tsx
@@ -10,13 +10,18 @@ import { IndexPattern, IndexPatternsContract } from '../../../../data/common';
 
 export const useIndexPattern = (indexPatterns: IndexPatternsContract, indexPatternId: string) => {
   const [indexPattern, setIndexPattern] = useState<IndexPattern | undefined>(undefined);
+  const [error, setError] = useState();
 
   useEffect(() => {
     async function loadIndexPattern() {
-      const ip = await indexPatterns.get(indexPatternId);
-      setIndexPattern(ip);
+      try {
+        const item = await indexPatterns.get(indexPatternId);
+        setIndexPattern(item);
+      } catch (e) {
+        setError(e);
+      }
     }
     loadIndexPattern();
-  });
-  return indexPattern;
+  }, [indexPatternId, indexPatterns]);
+  return { indexPattern, error };
 };
diff --git a/src/plugins/discover/public/application/services/use_es_doc_search.test.tsx b/src/plugins/discover/public/application/services/use_es_doc_search.test.tsx
index af7d189e62882..ca57b470b471a 100644
--- a/src/plugins/discover/public/application/services/use_es_doc_search.test.tsx
+++ b/src/plugins/discover/public/application/services/use_es_doc_search.test.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { renderHook, act } from '@testing-library/react-hooks';
+import { renderHook } from '@testing-library/react-hooks';
 import { buildSearchBody, useEsDocSearch } from './use_es_doc_search';
 import { Observable } from 'rxjs';
 import { IndexPattern } from 'src/plugins/data/common';
@@ -175,26 +175,14 @@ describe('Test of <Doc /> helper / hook', () => {
     const indexPattern = {
       getComputedFields: () => [],
     };
-    const getMock = jest.fn(() => Promise.resolve(indexPattern));
-    const indexPatternService = {
-      get: getMock,
-    } as unknown as IndexPattern;
     const props = {
       id: '1',
       index: 'index1',
-      indexPatternId: 'xyz',
-      indexPatternService,
-    } as unknown as DocProps;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    let hook: any;
-    await act(async () => {
-      hook = renderHook((p: DocProps) => useEsDocSearch(p), { initialProps: props });
-    });
-    expect(hook.result.current.slice(0, 3)).toEqual([
-      ElasticRequestState.Loading,
-      null,
       indexPattern,
-    ]);
-    expect(getMock).toHaveBeenCalled();
+    } as unknown as DocProps;
+
+    const { result } = renderHook((p: DocProps) => useEsDocSearch(p), { initialProps: props });
+
+    expect(result.current.slice(0, 2)).toEqual([ElasticRequestState.Loading, null]);
   });
 });
diff --git a/src/plugins/discover/public/application/services/use_es_doc_search.ts b/src/plugins/discover/public/application/services/use_es_doc_search.ts
index a2f0cd6f8442b..16a24ff27292b 100644
--- a/src/plugins/discover/public/application/services/use_es_doc_search.ts
+++ b/src/plugins/discover/public/application/services/use_es_doc_search.ts
@@ -64,11 +64,9 @@ export function buildSearchBody(
 export function useEsDocSearch({
   id,
   index,
-  indexPatternId,
-  indexPatternService,
+  indexPattern,
   requestSource,
-}: DocProps): [ElasticRequestState, ElasticSearchHit | null, IndexPattern | null, () => void] {
-  const [indexPattern, setIndexPattern] = useState<IndexPattern | null>(null);
+}: DocProps): [ElasticRequestState, ElasticSearchHit | null | null, () => void] {
   const [status, setStatus] = useState(ElasticRequestState.Loading);
   const [hit, setHit] = useState<ElasticSearchHit | null>(null);
   const { data, uiSettings } = useMemo(() => getServices(), []);
@@ -76,14 +74,11 @@ export function useEsDocSearch({
 
   const requestData = useCallback(async () => {
     try {
-      const indexPatternEntity = await indexPatternService.get(indexPatternId);
-      setIndexPattern(indexPatternEntity);
-
       const { rawResponse } = await data.search
         .search({
           params: {
             index,
-            body: buildSearchBody(id, indexPatternEntity, useNewFieldsApi, requestSource)?.body,
+            body: buildSearchBody(id, indexPattern, useNewFieldsApi, requestSource)?.body,
           },
         })
         .toPromise();
@@ -105,11 +100,11 @@ export function useEsDocSearch({
         setStatus(ElasticRequestState.Error);
       }
     }
-  }, [id, index, indexPatternId, indexPatternService, data.search, useNewFieldsApi, requestSource]);
+  }, [id, index, indexPattern, data.search, useNewFieldsApi, requestSource]);
 
   useEffect(() => {
     requestData();
   }, [requestData]);
 
-  return [status, hit, indexPattern, requestData];
+  return [status, hit, requestData];
 }
diff --git a/src/plugins/discover/public/plugin.tsx b/src/plugins/discover/public/plugin.tsx
index e34e7644caa25..39b73d4213721 100644
--- a/src/plugins/discover/public/plugin.tsx
+++ b/src/plugins/discover/public/plugin.tsx
@@ -272,7 +272,7 @@ export class DiscoverPlugin
           <SourceViewer
             index={hit._index}
             id={hit._id}
-            indexPatternId={indexPattern?.id || ''}
+            indexPattern={indexPattern}
             hasLineNumbers
           />
         </React.Suspense>

From 660ed36354c51a1aaa75dfa139bc86ab087bded1 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 13:13:55 -0400
Subject: [PATCH 32/36] [ML] Stop reading the ml.max_open_jobs node attribute
 (#115524) (#115580)

The ml.max_open_jobs node attribute is going away in
version 8, as the maximum number of open jobs has been
defined by a dynamic cluster-wide setting during the 7
series and there is no chance of version 8 needing to
run in a mixed version cluster with version 6.

The ml.machine_memory attribute will still be available,
so this can be checked instead as a way of detecting ML
nodes.

Co-authored-by: David Roberts <dave.roberts@elastic.co>
---
 x-pack/plugins/ml/server/lib/node_utils.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/ml/server/lib/node_utils.ts b/x-pack/plugins/ml/server/lib/node_utils.ts
index 82e5d7f469849..a13e44b307a7b 100644
--- a/x-pack/plugins/ml/server/lib/node_utils.ts
+++ b/x-pack/plugins/ml/server/lib/node_utils.ts
@@ -17,8 +17,8 @@ export async function getMlNodeCount(client: IScopedClusterClient): Promise<MlNo
   if (typeof body.nodes === 'object') {
     Object.keys(body.nodes).forEach((k) => {
       if (body.nodes[k].attributes !== undefined) {
-        const maxOpenJobs = +body.nodes[k].attributes['ml.max_open_jobs'];
-        if (maxOpenJobs !== null && maxOpenJobs > 0) {
+        const machineMemory = +body.nodes[k].attributes['ml.machine_memory'];
+        if (machineMemory !== null && machineMemory > 0) {
           count++;
         }
       }

From 359d28d3c6c2ef0d2878c7e3d24d454db3cca823 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 13:25:11 -0400
Subject: [PATCH 33/36] [Unified Integrations] Remove and cleanup add data
 views (#115424) (#115581)

Co-authored-by: cchaos <caroline.horn@elastic.co>
Co-authored-by: Dave Snider <dave.snider@gmail.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Thomas Neirynck <thomas@elastic.co>

Co-authored-by: Josh Dover <1813008+joshdover@users.noreply.github.com>
Co-authored-by: cchaos <caroline.horn@elastic.co>
Co-authored-by: Dave Snider <dave.snider@gmail.com>
Co-authored-by: Thomas Neirynck <thomas@elastic.co>
---
 .../__snapshots__/home.test.tsx.snap          | 422 +++++-------------
 .../application/components/home.test.tsx      |  26 +-
 .../public/application/components/home.tsx    |   8 +-
 .../public/application/components/home_app.js |  12 +-
 .../components/tutorial/tutorial.js           |  13 +-
 .../components/tutorial_directory.js          |  24 +-
 .../elastic_agent_card.test.tsx.snap          | 246 ++++++----
 .../no_data_card/elastic_agent_card.tsx       |  39 +-
 .../apps/home/{_add_data.js => _add_data.ts}  |  13 +-
 .../translations/translations/ja-JP.json      |   1 -
 .../translations/translations/zh-CN.json      |   1 -
 11 files changed, 356 insertions(+), 449 deletions(-)
 rename test/functional/apps/home/{_add_data.js => _add_data.ts} (59%)

diff --git a/src/plugins/home/public/application/components/__snapshots__/home.test.tsx.snap b/src/plugins/home/public/application/components/__snapshots__/home.test.tsx.snap
index b6679dd7ba493..f38bdb9ac53f0 100644
--- a/src/plugins/home/public/application/components/__snapshots__/home.test.tsx.snap
+++ b/src/plugins/home/public/application/components/__snapshots__/home.test.tsx.snap
@@ -21,10 +21,28 @@ exports[`home change home route should render a link to change the default route
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -57,10 +75,28 @@ exports[`home directories should not render directory entry when showOnHomePage
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -93,10 +129,28 @@ exports[`home directories should render ADMIN directory entry in "Manage your da
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={
       Array [
         Object {
@@ -176,10 +230,28 @@ exports[`home directories should render solutions in the "solution section" 1`]
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -212,10 +284,28 @@ exports[`home isNewKibanaInstance should safely handle exceptions 1`] = `
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -248,10 +338,28 @@ exports[`home isNewKibanaInstance should set isNewKibanaInstance to false when t
   />
   <AddData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
+    }
     features={Array []}
   />
   <mockConstructor
@@ -480,314 +588,28 @@ exports[`home should render home component 1`] = `
   />
   <AddData
     addBasePath={[Function]}
-    isDarkMode={false}
-  />
-  <ManageData
-    addBasePath={[Function]}
-    features={Array []}
-  />
-  <mockConstructor
-    addBasePath={[Function]}
-    onChangeDefaultRoute={[Function]}
-    onSetDefaultRoute={[Function]}
-    path="/app/home"
-  />
-</mockConstructor>
-`;
-
-exports[`home welcome should show the normal home page if loading fails 1`] = `
-<mockConstructor
-  data-test-subj="homeApp"
-  pageHeader={
-    Object {
-      "bottomBorder": false,
-      "pageTitle": <FormattedMessage
-        defaultMessage="Welcome home"
-        id="home.header.title"
-        values={Object {}}
-      />,
-    }
-  }
-  template="empty"
->
-  <SolutionsSection
-    addBasePath={[Function]}
-    solutions={Array []}
-  />
-  <AddData
-    addBasePath={[Function]}
-    isDarkMode={false}
-  />
-  <ManageData
-    addBasePath={[Function]}
-    features={Array []}
-  />
-  <mockConstructor
-    addBasePath={[Function]}
-    onChangeDefaultRoute={[Function]}
-    onSetDefaultRoute={[Function]}
-    path="/app/home"
-  />
-</mockConstructor>
-`;
-
-exports[`home welcome should show the normal home page if welcome screen is disabled locally 1`] = `
-<mockConstructor
-  data-test-subj="homeApp"
-  pageHeader={
-    Object {
-      "bottomBorder": false,
-      "pageTitle": <FormattedMessage
-        defaultMessage="Welcome home"
-        id="home.header.title"
-        values={Object {}}
-      />,
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
+          },
+        },
+      }
     }
-  }
-  template="empty"
->
-  <SolutionsSection
-    addBasePath={[Function]}
-    solutions={Array []}
-  />
-  <AddData
-    addBasePath={[Function]}
     isDarkMode={false}
   />
   <ManageData
     addBasePath={[Function]}
-    features={Array []}
-  />
-  <mockConstructor
-    addBasePath={[Function]}
-    onChangeDefaultRoute={[Function]}
-    onSetDefaultRoute={[Function]}
-    path="/app/home"
-  />
-</mockConstructor>
-`;
-
-exports[`home welcome should show the welcome screen if enabled, and there are no index patterns defined 1`] = `
-<Welcome
-  onSkip={[Function]}
-  telemetry={
-    Object {
-      "telemetryConstants": Object {
-        "getPrivacyStatementUrl": [MockFunction],
-      },
-      "telemetryNotifications": TelemetryNotifications {
-        "http": Object {
-          "addLoadingCountSource": [MockFunction],
-          "anonymousPaths": Object {
-            "isAnonymous": [MockFunction],
-            "register": [MockFunction],
-          },
-          "basePath": BasePath {
-            "basePath": "",
-            "get": [Function],
-            "prepend": [Function],
-            "publicBaseUrl": undefined,
-            "remove": [Function],
-            "serverBasePath": "",
-          },
-          "delete": [MockFunction],
-          "externalUrl": Object {
-            "validateUrl": [MockFunction],
-          },
-          "fetch": [MockFunction],
-          "get": [MockFunction],
-          "getLoadingCount$": [MockFunction],
-          "head": [MockFunction],
-          "intercept": [MockFunction],
-          "options": [MockFunction],
-          "patch": [MockFunction],
-          "post": [MockFunction],
-          "put": [MockFunction],
-        },
-        "onSetOptInClick": [Function],
-        "optInBannerId": undefined,
-        "optedInNoticeBannerId": undefined,
-        "overlays": Object {
-          "banners": Object {
-            "add": [MockFunction],
-            "get$": [MockFunction],
-            "getComponent": [MockFunction],
-            "remove": [MockFunction],
-            "replace": [MockFunction],
-          },
-          "openConfirm": [MockFunction],
-          "openFlyout": [MockFunction],
-          "openModal": [MockFunction],
-        },
-        "renderOptInBanner": [Function],
-        "renderOptedInNoticeBanner": [Function],
-        "setOptedInNoticeSeen": [Function],
-        "shouldShowOptInBanner": [Function],
-        "shouldShowOptedInNoticeBanner": [Function],
-        "telemetryService": TelemetryService {
-          "canSendTelemetry": [Function],
-          "currentKibanaVersion": "mockKibanaVersion",
-          "defaultConfig": Object {
-            "allowChangingOptInStatus": true,
-            "banner": true,
-            "enabled": true,
-            "optIn": true,
-            "sendUsageFrom": "browser",
-            "sendUsageTo": "staging",
-            "telemetryNotifyUserAboutOptInDefault": true,
-            "userCanChangeSettings": true,
-          },
-          "fetchExample": [Function],
-          "fetchTelemetry": [Function],
-          "getCanChangeOptInStatus": [Function],
-          "getIsOptedIn": [Function],
-          "getOptInStatusUrl": [Function],
-          "getTelemetryUrl": [Function],
-          "http": Object {
-            "addLoadingCountSource": [MockFunction],
-            "anonymousPaths": Object {
-              "isAnonymous": [MockFunction],
-              "register": [MockFunction],
-            },
-            "basePath": BasePath {
-              "basePath": "",
-              "get": [Function],
-              "prepend": [Function],
-              "publicBaseUrl": undefined,
-              "remove": [Function],
-              "serverBasePath": "",
-            },
-            "delete": [MockFunction],
-            "externalUrl": Object {
-              "validateUrl": [MockFunction],
-            },
-            "fetch": [MockFunction],
-            "get": [MockFunction],
-            "getLoadingCount$": [MockFunction],
-            "head": [MockFunction],
-            "intercept": [MockFunction],
-            "options": [MockFunction],
-            "patch": [MockFunction],
-            "post": [MockFunction],
-            "put": [MockFunction],
-          },
-          "isScreenshotMode": false,
-          "notifications": Object {
-            "toasts": Object {
-              "add": [MockFunction],
-              "addDanger": [MockFunction],
-              "addError": [MockFunction],
-              "addInfo": [MockFunction],
-              "addSuccess": [MockFunction],
-              "addWarning": [MockFunction],
-              "get$": [MockFunction],
-              "remove": [MockFunction],
-            },
+    application={
+      Object {
+        "capabilities": Object {
+          "navLinks": Object {
+            "integrations": true,
           },
-          "reportOptInStatus": [MockFunction],
-          "reportOptInStatusChange": true,
-          "setOptIn": [Function],
-          "setUserHasSeenNotice": [Function],
-          "updatedConfig": undefined,
         },
-      },
-      "telemetryService": TelemetryService {
-        "canSendTelemetry": [Function],
-        "currentKibanaVersion": "mockKibanaVersion",
-        "defaultConfig": Object {
-          "allowChangingOptInStatus": true,
-          "banner": true,
-          "enabled": true,
-          "optIn": true,
-          "sendUsageFrom": "browser",
-          "sendUsageTo": "staging",
-          "telemetryNotifyUserAboutOptInDefault": true,
-          "userCanChangeSettings": true,
-        },
-        "fetchExample": [Function],
-        "fetchTelemetry": [Function],
-        "getCanChangeOptInStatus": [Function],
-        "getIsOptedIn": [Function],
-        "getOptInStatusUrl": [Function],
-        "getTelemetryUrl": [Function],
-        "http": Object {
-          "addLoadingCountSource": [MockFunction],
-          "anonymousPaths": Object {
-            "isAnonymous": [MockFunction],
-            "register": [MockFunction],
-          },
-          "basePath": BasePath {
-            "basePath": "",
-            "get": [Function],
-            "prepend": [Function],
-            "publicBaseUrl": undefined,
-            "remove": [Function],
-            "serverBasePath": "",
-          },
-          "delete": [MockFunction],
-          "externalUrl": Object {
-            "validateUrl": [MockFunction],
-          },
-          "fetch": [MockFunction],
-          "get": [MockFunction],
-          "getLoadingCount$": [MockFunction],
-          "head": [MockFunction],
-          "intercept": [MockFunction],
-          "options": [MockFunction],
-          "patch": [MockFunction],
-          "post": [MockFunction],
-          "put": [MockFunction],
-        },
-        "isScreenshotMode": false,
-        "notifications": Object {
-          "toasts": Object {
-            "add": [MockFunction],
-            "addDanger": [MockFunction],
-            "addError": [MockFunction],
-            "addInfo": [MockFunction],
-            "addSuccess": [MockFunction],
-            "addWarning": [MockFunction],
-            "get$": [MockFunction],
-            "remove": [MockFunction],
-          },
-        },
-        "reportOptInStatus": [MockFunction],
-        "reportOptInStatusChange": true,
-        "setOptIn": [Function],
-        "setUserHasSeenNotice": [Function],
-        "updatedConfig": undefined,
-      },
+      }
     }
-  }
-  urlBasePath="goober"
-/>
-`;
-
-exports[`home welcome stores skip welcome setting if skipped 1`] = `
-<mockConstructor
-  data-test-subj="homeApp"
-  pageHeader={
-    Object {
-      "bottomBorder": false,
-      "pageTitle": <FormattedMessage
-        defaultMessage="Welcome home"
-        id="home.header.title"
-        values={Object {}}
-      />,
-    }
-  }
-  template="empty"
->
-  <SolutionsSection
-    addBasePath={[Function]}
-    solutions={Array []}
-  />
-  <AddData
-    addBasePath={[Function]}
-    isDarkMode={false}
-  />
-  <ManageData
-    addBasePath={[Function]}
     features={Array []}
   />
   <mockConstructor
diff --git a/src/plugins/home/public/application/components/home.test.tsx b/src/plugins/home/public/application/components/home.test.tsx
index 83000ff0860b4..a3b4df157ace4 100644
--- a/src/plugins/home/public/application/components/home.test.tsx
+++ b/src/plugins/home/public/application/components/home.test.tsx
@@ -13,7 +13,9 @@ import { Home } from './home';
 
 import { FeatureCatalogueCategory } from '../../services';
 import { telemetryPluginMock } from '../../../../telemetry/public/mocks';
+import { Welcome } from './welcome';
 
+let mockHasIntegrationsPermission = true;
 jest.mock('../kibana_services', () => ({
   getServices: () => ({
     getBasePath: () => 'path',
@@ -22,6 +24,13 @@ jest.mock('../kibana_services', () => ({
     chrome: {
       setBreadcrumbs: () => {},
     },
+    application: {
+      capabilities: {
+        navLinks: {
+          integrations: mockHasIntegrationsPermission,
+        },
+      },
+    },
   }),
 }));
 
@@ -35,6 +44,7 @@ describe('home', () => {
   let defaultProps: HomeProps;
 
   beforeEach(() => {
+    mockHasIntegrationsPermission = true;
     defaultProps = {
       directories: [],
       solutions: [],
@@ -182,7 +192,7 @@ describe('home', () => {
 
       expect(defaultProps.localStorage.getItem).toHaveBeenCalledTimes(1);
 
-      expect(component).toMatchSnapshot();
+      expect(component.find(Welcome).exists()).toBe(true);
     });
 
     test('stores skip welcome setting if skipped', async () => {
@@ -196,7 +206,7 @@ describe('home', () => {
 
       expect(defaultProps.localStorage.setItem).toHaveBeenCalledWith('home:welcome:show', 'false');
 
-      expect(component).toMatchSnapshot();
+      expect(component.find(Welcome).exists()).toBe(false);
     });
 
     test('should show the normal home page if loading fails', async () => {
@@ -205,7 +215,7 @@ describe('home', () => {
       const hasUserIndexPattern = jest.fn(() => Promise.reject('Doh!'));
       const component = await renderHome({ hasUserIndexPattern });
 
-      expect(component).toMatchSnapshot();
+      expect(component.find(Welcome).exists()).toBe(false);
     });
 
     test('should show the normal home page if welcome screen is disabled locally', async () => {
@@ -213,7 +223,15 @@ describe('home', () => {
 
       const component = await renderHome();
 
-      expect(component).toMatchSnapshot();
+      expect(component.find(Welcome).exists()).toBe(false);
+    });
+
+    test("should show the normal home page if user doesn't have access to integrations", async () => {
+      mockHasIntegrationsPermission = false;
+
+      const component = await renderHome();
+
+      expect(component.find(Welcome).exists()).toBe(false);
     });
   });
 
diff --git a/src/plugins/home/public/application/components/home.tsx b/src/plugins/home/public/application/components/home.tsx
index d398311d30255..2a08754889c28 100644
--- a/src/plugins/home/public/application/components/home.tsx
+++ b/src/plugins/home/public/application/components/home.tsx
@@ -45,10 +45,10 @@ export class Home extends Component<HomeProps, State> {
   constructor(props: HomeProps) {
     super(props);
 
-    const isWelcomeEnabled = !(
-      getServices().homeConfig.disableWelcomeScreen ||
-      props.localStorage.getItem(KEY_ENABLE_WELCOME) === 'false'
-    );
+    const isWelcomeEnabled =
+      !getServices().homeConfig.disableWelcomeScreen &&
+      getServices().application.capabilities.navLinks.integrations &&
+      props.localStorage.getItem(KEY_ENABLE_WELCOME) !== 'false';
 
     const body = document.querySelector('body')!;
     body.classList.add('isHomPage');
diff --git a/src/plugins/home/public/application/components/home_app.js b/src/plugins/home/public/application/components/home_app.js
index 9e2d3f77b015b..c84e30304c80d 100644
--- a/src/plugins/home/public/application/components/home_app.js
+++ b/src/plugins/home/public/application/components/home_app.js
@@ -26,8 +26,11 @@ const RedirectToDefaultApp = () => {
   return null;
 };
 
+const REDIRECT_TO_INTEGRATIONS_TAB_IDS = ['all', 'logging', 'metrics', 'security'];
+
 export function HomeApp({ directories, solutions }) {
   const {
+    application,
     savedObjectsClient,
     getBasePath,
     addBasePath,
@@ -39,10 +42,17 @@ export function HomeApp({ directories, solutions }) {
   const isCloudEnabled = environment.cloud;
 
   const renderTutorialDirectory = (props) => {
+    // Redirect to integrations app unless a specific tab that is still supported was specified.
+    const tabId = props.match.params.tab;
+    if (!tabId || REDIRECT_TO_INTEGRATIONS_TAB_IDS.includes(tabId)) {
+      application.navigateToApp('integrations', { replace: true });
+      return null;
+    }
+
     return (
       <TutorialDirectory
         addBasePath={addBasePath}
-        openTab={props.match.params.tab}
+        openTab={tabId}
         isCloudEnabled={isCloudEnabled}
       />
     );
diff --git a/src/plugins/home/public/application/components/tutorial/tutorial.js b/src/plugins/home/public/application/components/tutorial/tutorial.js
index 508a236bf45d4..4af5e362baca9 100644
--- a/src/plugins/home/public/application/components/tutorial/tutorial.js
+++ b/src/plugins/home/public/application/components/tutorial/tutorial.js
@@ -26,9 +26,8 @@ const INSTRUCTIONS_TYPE = {
   ON_PREM_ELASTIC_CLOUD: 'onPremElasticCloud',
 };
 
-const homeTitle = i18n.translate('home.breadcrumbs.homeTitle', { defaultMessage: 'Home' });
-const addDataTitle = i18n.translate('home.breadcrumbs.addDataTitle', {
-  defaultMessage: 'Add data',
+const integrationsTitle = i18n.translate('home.breadcrumbs.integrationsAppTitle', {
+  defaultMessage: 'Integrations',
 });
 
 class TutorialUi extends React.Component {
@@ -80,12 +79,8 @@ class TutorialUi extends React.Component {
 
     getServices().chrome.setBreadcrumbs([
       {
-        text: homeTitle,
-        href: '#/',
-      },
-      {
-        text: addDataTitle,
-        href: '#/tutorial_directory',
+        text: integrationsTitle,
+        href: this.props.addBasePath('/app/integrations/browse'),
       },
       {
         text: tutorial ? tutorial.name : this.props.tutorialId,
diff --git a/src/plugins/home/public/application/components/tutorial_directory.js b/src/plugins/home/public/application/components/tutorial_directory.js
index 83e629a7c891e..ac0d1524145a1 100644
--- a/src/plugins/home/public/application/components/tutorial_directory.js
+++ b/src/plugins/home/public/application/components/tutorial_directory.js
@@ -18,12 +18,10 @@ import { getServices } from '../kibana_services';
 import { KibanaPageTemplate } from '../../../../kibana_react/public';
 import { getTutorials } from '../load_tutorials';
 
-const ALL_TAB_ID = 'all';
 const SAMPLE_DATA_TAB_ID = 'sampleData';
 
-const homeTitle = i18n.translate('home.breadcrumbs.homeTitle', { defaultMessage: 'Home' });
-const addDataTitle = i18n.translate('home.breadcrumbs.addDataTitle', {
-  defaultMessage: 'Add data',
+const integrationsTitle = i18n.translate('home.breadcrumbs.integrationsAppTitle', {
+  defaultMessage: 'Integrations',
 });
 
 class TutorialDirectoryUi extends React.Component {
@@ -48,7 +46,7 @@ class TutorialDirectoryUi extends React.Component {
       })),
     ];
 
-    let openTab = ALL_TAB_ID;
+    let openTab = SAMPLE_DATA_TAB_ID;
     if (
       props.openTab &&
       this.tabs.some((tab) => {
@@ -72,10 +70,9 @@ class TutorialDirectoryUi extends React.Component {
 
     getServices().chrome.setBreadcrumbs([
       {
-        text: homeTitle,
-        href: '#/',
+        text: integrationsTitle,
+        href: this.props.addBasePath(`/app/integrations/browse`),
       },
-      { text: addDataTitle },
     ]);
 
     const tutorialConfigs = await getTutorials();
@@ -155,6 +152,15 @@ class TutorialDirectoryUi extends React.Component {
   renderTabContent = () => {
     const tab = this.tabs.find(({ id }) => id === this.state.selectedTabId);
     if (tab?.content) {
+      getServices().chrome.setBreadcrumbs([
+        {
+          text: integrationsTitle,
+          href: this.props.addBasePath(`/app/integrations/browse`),
+        },
+        {
+          text: tab.name,
+        },
+      ]);
       return tab.content;
     }
 
@@ -163,7 +169,7 @@ class TutorialDirectoryUi extends React.Component {
         {this.state.tutorialCards
           .filter((tutorial) => {
             return (
-              this.state.selectedTabId === ALL_TAB_ID ||
+              this.state.selectedTabId === SAMPLE_DATA_TAB_ID ||
               this.state.selectedTabId === tutorial.category
             );
           })
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
index f66d05140b2e9..8e1d0cb92e006 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/__snapshots__/elastic_agent_card.test.tsx.snap
@@ -1,117 +1,177 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`ElasticAgentCard props button 1`] = `
-<EuiCard
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Button
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="/app/integrations/browse"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
-        Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+>
+  <EuiCard
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
+        Button
+      </EuiButton>
+    }
+    href="/app/integrations/browse"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
 
 exports[`ElasticAgentCard props category 1`] = `
-<EuiCard
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Add Elastic Agent
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="/app/integrations/browse/custom"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
+>
+  <EuiCard
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
         Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+      </EuiButton>
+    }
+    href="/app/integrations/browse/custom"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
 
 exports[`ElasticAgentCard props href 1`] = `
-<EuiCard
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Button
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="#"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
-        Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+>
+  <EuiCard
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
+        Button
+      </EuiButton>
+    }
+    href="#"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
 
 exports[`ElasticAgentCard props recommended 1`] = `
-<EuiCard
-  betaBadgeLabel="Recommended"
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Add Elastic Agent
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="/app/integrations/browse"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
+>
+  <EuiCard
+    betaBadgeLabel="Recommended"
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
         Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+      </EuiButton>
+    }
+    href="/app/integrations/browse"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
 
 exports[`ElasticAgentCard renders 1`] = `
-<EuiCard
-  description="Use Elastic Agent for a simple, unified way to collect data from your machines."
-  footer={
-    <EuiButton
-      fill={true}
-    >
-      Add Elastic Agent
-    </EuiButton>
+<RedirectAppLinks
+  application={
+    Object {
+      "capabilities": Object {
+        "navLinks": Object {
+          "integrations": true,
+        },
+      },
+    }
   }
-  href="/app/integrations/browse"
-  image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
-  paddingSize="l"
-  title={
-    <EuiScreenReaderOnly>
-      <span>
+>
+  <EuiCard
+    description="Use Elastic Agent for a simple, unified way to collect data from your machines."
+    footer={
+      <EuiButton
+        fill={true}
+      >
         Add Elastic Agent
-      </span>
-    </EuiScreenReaderOnly>
-  }
-/>
+      </EuiButton>
+    }
+    href="/app/integrations/browse"
+    image="/plugins/kibanaReact/assets/elastic_agent_card.svg"
+    paddingSize="l"
+    title={
+      <EuiScreenReaderOnly>
+        <span>
+          Add Elastic Agent
+        </span>
+      </EuiScreenReaderOnly>
+    }
+  />
+</RedirectAppLinks>
 `;
diff --git a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
index 5a91e568471d1..b9d412fe4df89 100644
--- a/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
+++ b/src/plugins/kibana_react/public/page_template/no_data_page/no_data_card/elastic_agent_card.tsx
@@ -12,6 +12,7 @@ import { CoreStart } from 'kibana/public';
 import { EuiButton, EuiCard, EuiTextColor, EuiScreenReaderOnly } from '@elastic/eui';
 import { useKibana } from '../../../context';
 import { NoDataPageActions, NO_DATA_RECOMMENDED } from '../no_data_page';
+import { RedirectAppLinks } from '../../../app_links';
 
 export type ElasticAgentCardProps = NoDataPageActions & {
   solution: string;
@@ -76,23 +77,25 @@ export const ElasticAgentCard: FunctionComponent<ElasticAgentCardProps> = ({
     );
 
   return (
-    <EuiCard
-      paddingSize="l"
-      image={image}
-      href={href ?? addBasePath(`/app/integrations/browse${hasCategory}`)}
-      // Bad hack to fix the need for an a11y title even though the button exists
-      title={
-        <EuiScreenReaderOnly>
-          <span>{defaultCTAtitle}</span>
-        </EuiScreenReaderOnly>
-      }
-      description={i18n.translate('kibana-react.noDataPage.elasticAgentCard.description', {
-        defaultMessage: `Use Elastic Agent for a simple, unified way to collect data from your machines.`,
-      })}
-      betaBadgeLabel={recommended ? NO_DATA_RECOMMENDED : undefined}
-      footer={footer}
-      layout={layout as 'vertical' | undefined}
-      {...cardRest}
-    />
+    <RedirectAppLinks application={application}>
+      <EuiCard
+        paddingSize="l"
+        image={image}
+        href={href ?? addBasePath(`/app/integrations/browse${hasCategory}`)}
+        // Bad hack to fix the need for an a11y title even though the button exists
+        title={
+          <EuiScreenReaderOnly>
+            <span>{defaultCTAtitle}</span>
+          </EuiScreenReaderOnly>
+        }
+        description={i18n.translate('kibana-react.noDataPage.elasticAgentCard.description', {
+          defaultMessage: `Use Elastic Agent for a simple, unified way to collect data from your machines.`,
+        })}
+        betaBadgeLabel={recommended ? NO_DATA_RECOMMENDED : undefined}
+        footer={footer}
+        layout={layout as 'vertical' | undefined}
+        {...cardRest}
+      />
+    </RedirectAppLinks>
   );
 };
diff --git a/test/functional/apps/home/_add_data.js b/test/functional/apps/home/_add_data.ts
similarity index 59%
rename from test/functional/apps/home/_add_data.js
rename to test/functional/apps/home/_add_data.ts
index c69e0a02c26e4..3fd69c1a488f4 100644
--- a/test/functional/apps/home/_add_data.js
+++ b/test/functional/apps/home/_add_data.ts
@@ -6,20 +6,15 @@
  * Side Public License, v 1.
  */
 
-import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../ftr_provider_context';
 
-export default function ({ getService, getPageObjects }) {
-  const retry = getService('retry');
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'header', 'home', 'dashboard']);
 
   describe('add data tutorials', function describeIndexTests() {
-    it('directory should display registered tutorials', async () => {
+    it('directory should redirect to integrations app', async () => {
       await PageObjects.common.navigateToUrl('home', 'tutorial_directory', { useActualUrl: true });
-      await PageObjects.header.waitUntilLoadingHasFinished();
-      await retry.try(async () => {
-        const tutorialExists = await PageObjects.home.doesSynopsisExist('netflowlogs');
-        expect(tutorialExists).to.be(true);
-      });
+      await PageObjects.common.waitUntilUrlIncludes('/app/integrations');
     });
   });
 }
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index ea98d0554d58b..f0fd864e190f4 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -2921,7 +2921,6 @@
     "home.addData.sampleDataButtonLabel": "サンプルデータを試す",
     "home.addData.sectionTitle": "データを追加して開始する",
     "home.addData.text": "データの操作を開始するには、多数の取り込みオプションのいずれかを使用します。アプリまたはサービスからデータを収集するか、ファイルをアップロードします。独自のデータを使用する準備ができていない場合は、サンプルデータセットを追加してください。",
-    "home.breadcrumbs.addDataTitle": "データの追加",
     "home.breadcrumbs.homeTitle": "ホーム",
     "home.dataManagementDisableCollection": " 収集を停止するには、",
     "home.dataManagementDisableCollectionLink": "ここで使用状況データを無効にします。",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 2c8bc37c32208..d4d327499ddf2 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -2950,7 +2950,6 @@
     "home.addData.sampleDataButtonLabel": "试用样例数据",
     "home.addData.sectionTitle": "首先添加您的数据",
     "home.addData.text": "要开始使用您的数据，请使用我们众多采集选项中的一个选项。从应用或服务收集数据，或上传文件。如果未准备好使用自己的数据，请添加示例数据集。",
-    "home.breadcrumbs.addDataTitle": "添加数据",
     "home.breadcrumbs.homeTitle": "主页",
     "home.dataManagementDisableCollection": " 要停止收集，",
     "home.dataManagementDisableCollectionLink": "请在此禁用使用情况数据。",

From 33de72445240405867d1cee5aa40f1b63fda5f57 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 13:25:49 -0400
Subject: [PATCH 34/36] [Security Solutions] Adds security detection rule
 actions as importable and exportable (#115243) (#115579)

## Summary

Adds the security detection rule actions as being exportable and importable.
* Adds exportable actions for legacy notification system
* Adds exportable actions for the new throttle notification system
* Adds importable but only imports into the new throttle notification system.
* Updates unit tests

In your `ndjson` file when you have actions exported you will see them like so:

```json
"actions": [
    {
      "group": "default",
      "id": "b55117e0-2df9-11ec-b789-7f03e3cdd668",
      "params": {
        "message": "Rule {{context.rule.name}} generated {{state.signals_count}} alerts"
      },
      "action_type_id": ".slack"
    }
  ]
```

where before it was `actions: []` and was not provided.

**Caveats**

If you delete your connector and have an invalid connector then the rule(s) that were referring to that invalid connector will not import and you will get an error like this:

<img width="802" alt="Screen Shot 2021-10-15 at 2 47 10 PM" src="https://user-images.githubusercontent.com/1151048/137554991-b3984be9-d2ad-488e-a309-29da656ca4ea.png">

This does _not_ export your connectors at this point in time. You have to export your connector through the Saved Object Management separate like so:
<img width="1545" alt="Screen Shot 2021-10-15 at 2 58 03 PM" src="https://user-images.githubusercontent.com/1151048/137555135-3f0bfd63-5d67-496b-8d5b-bdef01d6122f.png">

However, if remove everything and import your connector without changing its saved object ID and then go to import the rules everything should import ok and you will get your actions working.

**Manual Testing**:

* You can create normal actions on an alert and then do exports and you should see the actions in your ndjson file
* You can create legacy notifications from 7.14.0 and then upgrade and export and you should see the actions in your ndjson file
* You can manually create legacy notifications by:

By getting an alert id first and ensuring that your `legacy_notifications/one_action.json` contains a valid action then running this command:
```ts
./post_legacy_notification.sh 3403c0d0-2d44-11ec-b147-3b0c6d563a60
```

* You can export your connector and remove everything and then do an import and you will have everything imported and working with your actions and connector wired up correctly.

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added

Co-authored-by: Frank Hassanabad <frank.hassanabad@elastic.co>
---
 .../routes/rules/export_rules_route.ts        | 13 ++++-
 .../routes/rules/import_rules_route.ts        |  5 +-
 .../rules/perform_bulk_action_route.test.ts   |  5 +-
 .../routes/rules/perform_bulk_action_route.ts |  5 ++
 .../routes/rules/utils.test.ts                |  6 +--
 .../detection_engine/routes/rules/utils.ts    |  7 ++-
 .../rules/get_export_all.test.ts              | 26 +++++++++-
 .../detection_engine/rules/get_export_all.ts  | 17 ++++++-
 .../rules/get_export_by_object_ids.test.ts    | 49 +++++++++++++++++--
 .../rules/get_export_by_object_ids.ts         | 36 +++++++++++---
 .../security_solution/server/routes/index.ts  |  4 +-
 11 files changed, 145 insertions(+), 28 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/export_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/export_rules_route.ts
index e4b99e63cb6c6..c84dd8147ebcc 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/export_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/export_rules_route.ts
@@ -6,6 +6,7 @@
  */
 
 import { transformError } from '@kbn/securitysolution-es-utils';
+import { Logger } from 'src/core/server';
 import {
   exportRulesQuerySchema,
   ExportRulesQuerySchemaDecoded,
@@ -24,6 +25,7 @@ import { buildSiemResponse } from '../utils';
 export const exportRulesRoute = (
   router: SecuritySolutionPluginRouter,
   config: ConfigType,
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ) => {
   router.post(
@@ -44,6 +46,7 @@ export const exportRulesRoute = (
     async (context, request, response) => {
       const siemResponse = buildSiemResponse(response);
       const rulesClient = context.alerting?.getRulesClient();
+      const savedObjectsClient = context.core.savedObjects.client;
 
       if (!rulesClient) {
         return siemResponse.error({ statusCode: 404 });
@@ -71,8 +74,14 @@ export const exportRulesRoute = (
 
         const exported =
           request.body?.objects != null
-            ? await getExportByObjectIds(rulesClient, request.body.objects, isRuleRegistryEnabled)
-            : await getExportAll(rulesClient, isRuleRegistryEnabled);
+            ? await getExportByObjectIds(
+                rulesClient,
+                savedObjectsClient,
+                request.body.objects,
+                logger,
+                isRuleRegistryEnabled
+              )
+            : await getExportAll(rulesClient, savedObjectsClient, logger, isRuleRegistryEnabled);
 
         const responseBody = request.query.exclude_export_details
           ? exported.rulesNdjson
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
index b09ef1a215747..3752128d3daa3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -194,6 +194,7 @@ export const importRulesRoute = (
                       throttle,
                       version,
                       exceptions_list: exceptionsList,
+                      actions,
                     } = parsedRule;
 
                     try {
@@ -265,7 +266,7 @@ export const importRulesRoute = (
                           note,
                           version,
                           exceptionsList,
-                          actions: [], // Actions are not imported nor exported at this time
+                          actions,
                         });
                         resolve({
                           rule_id: ruleId,
@@ -328,7 +329,7 @@ export const importRulesRoute = (
                           exceptionsList,
                           anomalyThreshold,
                           machineLearningJobId,
-                          actions: undefined,
+                          actions,
                         });
                         resolve({
                           rule_id: ruleId,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.test.ts
index 41b909bd718c0..3e85b4898d01c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.test.ts
@@ -17,6 +17,7 @@ import {
 import { requestContextMock, serverMock, requestMock } from '../__mocks__';
 import { performBulkActionRoute } from './perform_bulk_action_route';
 import { getPerformBulkActionSchemaMock } from '../../../../../common/detection_engine/schemas/request/perform_bulk_action_schema.mock';
+import { loggingSystemMock } from 'src/core/server/mocks';
 
 jest.mock('../../../machine_learning/authz', () => mockMlAuthzFactory.create());
 
@@ -27,15 +28,17 @@ describe.each([
   let server: ReturnType<typeof serverMock.create>;
   let { clients, context } = requestContextMock.createTools();
   let ml: ReturnType<typeof mlServicesMock.createSetupContract>;
+  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
 
   beforeEach(() => {
     server = serverMock.create();
+    logger = loggingSystemMock.createLogger();
     ({ clients, context } = requestContextMock.createTools());
     ml = mlServicesMock.createSetupContract();
 
     clients.rulesClient.find.mockResolvedValue(getFindResultWithSingleHit(isRuleRegistryEnabled));
 
-    performBulkActionRoute(server.router, ml, isRuleRegistryEnabled);
+    performBulkActionRoute(server.router, ml, logger, isRuleRegistryEnabled);
   });
 
   describe('status codes', () => {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.ts
index 0eba5af4e063a..fb5a2315479da 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/perform_bulk_action_route.ts
@@ -6,6 +6,8 @@
  */
 
 import { transformError } from '@kbn/securitysolution-es-utils';
+import { Logger } from 'src/core/server';
+
 import { DETECTION_ENGINE_RULES_BULK_ACTION } from '../../../../../common/constants';
 import { BulkAction } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { performBulkActionSchema } from '../../../../../common/detection_engine/schemas/request/perform_bulk_action_schema';
@@ -26,6 +28,7 @@ const BULK_ACTION_RULES_LIMIT = 10000;
 export const performBulkActionRoute = (
   router: SecuritySolutionPluginRouter,
   ml: SetupPlugins['ml'],
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ) => {
   router.post(
@@ -133,7 +136,9 @@ export const performBulkActionRoute = (
           case BulkAction.export:
             const exported = await getExportByObjectIds(
               rulesClient,
+              savedObjectsClient,
               rules.data.map(({ params }) => ({ rule_id: params.ruleId })),
+              logger,
               isRuleRegistryEnabled
             );
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
index c5a30c349d497..366ae607f0ba8 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.test.ts
@@ -469,12 +469,12 @@ describe.each([
 
   describe('transformAlertsToRules', () => {
     test('given an empty array returns an empty array', () => {
-      expect(transformAlertsToRules([])).toEqual([]);
+      expect(transformAlertsToRules([], {})).toEqual([]);
     });
 
     test('given single alert will return the alert transformed', () => {
       const result1 = getAlertMock(isRuleRegistryEnabled, getQueryRuleParams());
-      const transformed = transformAlertsToRules([result1]);
+      const transformed = transformAlertsToRules([result1], {});
       const expected = getOutputRuleAlertForRest();
       expect(transformed).toEqual([expected]);
     });
@@ -485,7 +485,7 @@ describe.each([
       result2.id = 'some other id';
       result2.params.ruleId = 'some other id';
 
-      const transformed = transformAlertsToRules([result1, result2]);
+      const transformed = transformAlertsToRules([result1, result2], {});
       const expected1 = getOutputRuleAlertForRest();
       const expected2 = getOutputRuleAlertForRest();
       expected2.id = 'some other id';
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.ts
index afc48386a2986..bb2e35d189ca1 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/utils.ts
@@ -103,8 +103,11 @@ export const transformAlertToRule = (
   return internalRuleToAPIResponse(alert, ruleStatus?.attributes, legacyRuleActions);
 };
 
-export const transformAlertsToRules = (alerts: RuleAlertType[]): Array<Partial<RulesSchema>> => {
-  return alerts.map((alert) => transformAlertToRule(alert));
+export const transformAlertsToRules = (
+  alerts: RuleAlertType[],
+  legacyRuleActions: Record<string, LegacyRulesActionsSavedObject>
+): Array<Partial<RulesSchema>> => {
+  return alerts.map((alert) => transformAlertToRule(alert, undefined, legacyRuleActions[alert.id]));
 };
 
 export const transformFindAlerts = (
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
index 3ca5960d7d4e1..92e4f0bbb4a5e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
@@ -9,21 +9,33 @@ import {
   getAlertMock,
   getFindResultWithSingleHit,
   FindHit,
+  getEmptySavedObjectsResponse,
 } from '../routes/__mocks__/request_responses';
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
 import { getExportAll } from './get_export_all';
 import { getListArrayMock } from '../../../../common/detection_engine/schemas/types/lists.mock';
 import { getThreatMock } from '../../../../common/detection_engine/schemas/types/threat.mock';
+
 import { getQueryRuleParams } from '../schemas/rule_schemas.mock';
+import { loggingSystemMock } from 'src/core/server/mocks';
+import { requestContextMock } from '../routes/__mocks__/request_context';
 
 describe.each([
   ['Legacy', false],
   ['RAC', true],
 ])('getExportAll - %s', (_, isRuleRegistryEnabled) => {
+  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
+  const { clients } = requestContextMock.createTools();
+
+  beforeEach(async () => {
+    clients.savedObjectsClient.find.mockResolvedValue(getEmptySavedObjectsResponse());
+  });
+
   test('it exports everything from the alerts client', async () => {
     const rulesClient = rulesClientMock.create();
     const result = getFindResultWithSingleHit(isRuleRegistryEnabled);
     const alert = getAlertMock(isRuleRegistryEnabled, getQueryRuleParams());
+
     alert.params = {
       ...alert.params,
       filters: [{ query: { match_phrase: { 'host.name': 'some-host' } } }],
@@ -35,7 +47,12 @@ describe.each([
     result.data = [alert];
     rulesClient.find.mockResolvedValue(result);
 
-    const exports = await getExportAll(rulesClient, isRuleRegistryEnabled);
+    const exports = await getExportAll(
+      rulesClient,
+      clients.savedObjectsClient,
+      logger,
+      isRuleRegistryEnabled
+    );
     const rulesJson = JSON.parse(exports.rulesNdjson);
     const detailsJson = JSON.parse(exports.exportDetails);
     expect(rulesJson).toEqual({
@@ -97,7 +114,12 @@ describe.each([
 
     rulesClient.find.mockResolvedValue(findResult);
 
-    const exports = await getExportAll(rulesClient, isRuleRegistryEnabled);
+    const exports = await getExportAll(
+      rulesClient,
+      clients.savedObjectsClient,
+      logger,
+      isRuleRegistryEnabled
+    );
     expect(exports).toEqual({
       rulesNdjson: '',
       exportDetails: '{"exported_count":0,"missing_rules":[],"missing_rules_count":0}\n',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
index 71079ccefc97a..cbbda5df7e2bf 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.ts
@@ -7,20 +7,33 @@
 
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
-import { RulesClient } from '../../../../../alerting/server';
+import { Logger } from 'src/core/server';
+import { RulesClient, AlertServices } from '../../../../../alerting/server';
 import { getNonPackagedRules } from './get_existing_prepackaged_rules';
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
 import { transformAlertsToRules } from '../routes/rules/utils';
 
+// eslint-disable-next-line no-restricted-imports
+import { legacyGetBulkRuleActionsSavedObject } from '../rule_actions/legacy_get_bulk_rule_actions_saved_object';
+
 export const getExportAll = async (
   rulesClient: RulesClient,
+  savedObjectsClient: AlertServices['savedObjectsClient'],
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
 }> => {
   const ruleAlertTypes = await getNonPackagedRules({ rulesClient, isRuleRegistryEnabled });
-  const rules = transformAlertsToRules(ruleAlertTypes);
+  const alertIds = ruleAlertTypes.map((rule) => rule.id);
+  const legacyActions = await legacyGetBulkRuleActionsSavedObject({
+    alertIds,
+    savedObjectsClient,
+    logger,
+  });
+
+  const rules = transformAlertsToRules(ruleAlertTypes, legacyActions);
   // We do not support importing/exporting actions. When we do, delete this line of code
   const rulesWithoutActions = rules.map((rule) => ({ ...rule, actions: [] }));
   const rulesNdjson = transformDataToNdjson(rulesWithoutActions);
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
index 740427e44b560..961f2c6a41866 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
@@ -10,28 +10,43 @@ import {
   getAlertMock,
   getFindResultWithSingleHit,
   FindHit,
+  getEmptySavedObjectsResponse,
 } from '../routes/__mocks__/request_responses';
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
 import { getListArrayMock } from '../../../../common/detection_engine/schemas/types/lists.mock';
 import { getThreatMock } from '../../../../common/detection_engine/schemas/types/threat.mock';
 import { getQueryRuleParams } from '../schemas/rule_schemas.mock';
+import { loggingSystemMock } from 'src/core/server/mocks';
+import { requestContextMock } from '../routes/__mocks__/request_context';
 
 describe.each([
   ['Legacy', false],
   ['RAC', true],
 ])('get_export_by_object_ids - %s', (_, isRuleRegistryEnabled) => {
+  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
+  const { clients } = requestContextMock.createTools();
+
   beforeEach(() => {
     jest.resetAllMocks();
     jest.restoreAllMocks();
     jest.clearAllMocks();
+
+    clients.savedObjectsClient.find.mockResolvedValue(getEmptySavedObjectsResponse());
   });
+
   describe('getExportByObjectIds', () => {
     test('it exports object ids into an expected string with new line characters', async () => {
       const rulesClient = rulesClientMock.create();
       rulesClient.find.mockResolvedValue(getFindResultWithSingleHit(isRuleRegistryEnabled));
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getExportByObjectIds(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getExportByObjectIds(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       const exportsObj = {
         rulesNdjson: JSON.parse(exports.rulesNdjson),
         exportDetails: JSON.parse(exports.exportDetails),
@@ -102,7 +117,13 @@ describe.each([
       rulesClient.find.mockResolvedValue(findResult);
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getExportByObjectIds(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getExportByObjectIds(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       expect(exports).toEqual({
         rulesNdjson: '',
         exportDetails:
@@ -117,7 +138,13 @@ describe.each([
       rulesClient.find.mockResolvedValue(getFindResultWithSingleHit(isRuleRegistryEnabled));
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getRulesFromObjects(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getRulesFromObjects(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       const expected: RulesErrors = {
         exportedCount: 1,
         missingRules: [],
@@ -192,7 +219,13 @@ describe.each([
       rulesClient.find.mockResolvedValue(findResult);
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getRulesFromObjects(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getRulesFromObjects(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       const expected: RulesErrors = {
         exportedCount: 0,
         missingRules: [{ rule_id: 'rule-1' }],
@@ -215,7 +248,13 @@ describe.each([
       rulesClient.find.mockResolvedValue(findResult);
 
       const objects = [{ rule_id: 'rule-1' }];
-      const exports = await getRulesFromObjects(rulesClient, objects, isRuleRegistryEnabled);
+      const exports = await getRulesFromObjects(
+        rulesClient,
+        clients.savedObjectsClient,
+        objects,
+        logger,
+        isRuleRegistryEnabled
+      );
       const expected: RulesErrors = {
         exportedCount: 0,
         missingRules: [{ rule_id: 'rule-1' }],
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
index 4cf3ad9133a71..8233fe6d4948c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
@@ -8,14 +8,20 @@
 import { chunk } from 'lodash';
 import { transformDataToNdjson } from '@kbn/securitysolution-utils';
 
+import { Logger } from 'src/core/server';
 import { RulesSchema } from '../../../../common/detection_engine/schemas/response/rules_schema';
-import { RulesClient } from '../../../../../alerting/server';
+import { RulesClient, AlertServices } from '../../../../../alerting/server';
+
 import { getExportDetailsNdjson } from './get_export_details_ndjson';
+
 import { isAlertType } from '../rules/types';
 import { transformAlertToRule } from '../routes/rules/utils';
 import { INTERNAL_RULE_ID_KEY } from '../../../../common/constants';
 import { findRules } from './find_rules';
 
+// eslint-disable-next-line no-restricted-imports
+import { legacyGetBulkRuleActionsSavedObject } from '../rule_actions/legacy_get_bulk_rule_actions_saved_object';
+
 interface ExportSuccessRule {
   statusCode: 200;
   rule: Partial<RulesSchema>;
@@ -34,23 +40,32 @@ export interface RulesErrors {
 
 export const getExportByObjectIds = async (
   rulesClient: RulesClient,
+  savedObjectsClient: AlertServices['savedObjectsClient'],
   objects: Array<{ rule_id: string }>,
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ): Promise<{
   rulesNdjson: string;
   exportDetails: string;
 }> => {
-  const rulesAndErrors = await getRulesFromObjects(rulesClient, objects, isRuleRegistryEnabled);
-  // We do not support importing/exporting actions. When we do, delete this line of code
-  const rulesWithoutActions = rulesAndErrors.rules.map((rule) => ({ ...rule, actions: [] }));
-  const rulesNdjson = transformDataToNdjson(rulesWithoutActions);
-  const exportDetails = getExportDetailsNdjson(rulesWithoutActions, rulesAndErrors.missingRules);
+  const rulesAndErrors = await getRulesFromObjects(
+    rulesClient,
+    savedObjectsClient,
+    objects,
+    logger,
+    isRuleRegistryEnabled
+  );
+
+  const rulesNdjson = transformDataToNdjson(rulesAndErrors.rules);
+  const exportDetails = getExportDetailsNdjson(rulesAndErrors.rules, rulesAndErrors.missingRules);
   return { rulesNdjson, exportDetails };
 };
 
 export const getRulesFromObjects = async (
   rulesClient: RulesClient,
+  savedObjectsClient: AlertServices['savedObjectsClient'],
   objects: Array<{ rule_id: string }>,
+  logger: Logger,
   isRuleRegistryEnabled: boolean
 ): Promise<RulesErrors> => {
   // If we put more than 1024 ids in one block like "alert.attributes.tags: (id1 OR id2 OR ... OR id1100)"
@@ -78,6 +93,13 @@ export const getRulesFromObjects = async (
     sortField: undefined,
     sortOrder: undefined,
   });
+  const alertIds = rules.data.map((rule) => rule.id);
+  const legacyActions = await legacyGetBulkRuleActionsSavedObject({
+    alertIds,
+    savedObjectsClient,
+    logger,
+  });
+
   const alertsAndErrors = objects.map(({ rule_id: ruleId }) => {
     const matchingRule = rules.data.find((rule) => rule.params.ruleId === ruleId);
     if (
@@ -87,7 +109,7 @@ export const getRulesFromObjects = async (
     ) {
       return {
         statusCode: 200,
-        rule: transformAlertToRule(matchingRule),
+        rule: transformAlertToRule(matchingRule, undefined, legacyActions[matchingRule.id]),
       };
     } else {
       return {
diff --git a/x-pack/plugins/security_solution/server/routes/index.ts b/x-pack/plugins/security_solution/server/routes/index.ts
index d045c6b129e43..148580d5c4477 100644
--- a/x-pack/plugins/security_solution/server/routes/index.ts
+++ b/x-pack/plugins/security_solution/server/routes/index.ts
@@ -91,12 +91,12 @@ export const initRoutes = (
   updateRulesBulkRoute(router, ml, isRuleRegistryEnabled);
   patchRulesBulkRoute(router, ml, isRuleRegistryEnabled);
   deleteRulesBulkRoute(router, isRuleRegistryEnabled);
-  performBulkActionRoute(router, ml, isRuleRegistryEnabled);
+  performBulkActionRoute(router, ml, logger, isRuleRegistryEnabled);
 
   createTimelinesRoute(router, config, security);
   patchTimelinesRoute(router, config, security);
   importRulesRoute(router, config, ml, isRuleRegistryEnabled);
-  exportRulesRoute(router, config, isRuleRegistryEnabled);
+  exportRulesRoute(router, config, logger, isRuleRegistryEnabled);
 
   importTimelinesRoute(router, config, security);
   exportTimelinesRoute(router, config, security);

From a50fb5ad878663a40fc40cb3f3d716055f40d0c2 Mon Sep 17 00:00:00 2001
From: Tim Roes <tim.roes@elastic.co>
Date: Tue, 19 Oct 2021 19:26:46 +0200
Subject: [PATCH 35/36] [Discover] Show ignored field values (#115040)
 (#115584)

* WIP replacing indexPattern.flattenHit by tabify

* Fix jest tests

* Read metaFields from index pattern

* Remove old test code

* remove unnecessary changes

* Remove flattenHitWrapper APIs

* Fix imports

* Fix missing metaFields

* Add all meta fields to allowlist

* Improve inline comments

* Move flattenHit test to new implementation

* Add deprecation comment to implementation

* WIP - Show ignored field values

* Disable filters in doc_table

* remove redundant comments

* No, it wasn't

* start warning message

* Enable ignored values in CSV reports

* Add help tooltip

* Better styling with warning plus collapsible button

* Disable filtering within table for ignored values

* Fix jest tests

* Fix types in tests

* Add more tests and documentation

* Remove comment

* Move dangerouslySetInnerHTML into helper method

* Extract document formatting into common utility

* Remove HTML source field formatter

* Move formatHit to Discover

* Change wording of ignored warning

* Add cache for formatted hits

* Remove dead type

* Fix row_formatter for objects

* Improve mobile layout

* Fix jest tests

* Fix typo

* Remove additional span again

* Change mock to revert test

* Improve tests

* More jest tests

* Fix typo

* Change wording

* Remove dead comment

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
# Conflicts:
#	src/plugins/data_views/public/index.ts
---
 .../common/search/tabify/tabify_docs.test.ts  |  49 ++++++++
 .../data/common/search/tabify/tabify_docs.ts  |  38 ++++++-
 .../data_views/common/data_views/data_view.ts |  13 ---
 .../common/data_views/format_hit.ts           |  74 ------------
 .../data_views/common/data_views/index.ts     |   1 -
 src/plugins/data_views/public/index.ts        |   6 +-
 src/plugins/discover/kibana.json              |   3 +-
 .../public/__mocks__/index_pattern.ts         |  18 ++-
 .../__mocks__/index_pattern_with_timefield.ts |  12 +-
 .../discover/public/__mocks__/services.ts     |  11 +-
 .../apps/context/context_app.test.tsx         |   4 +
 .../doc_table/components/table_row.tsx        |  42 +++++--
 .../doc_table/lib/row_formatter.test.ts       |  86 ++++++++------
 .../doc_table/lib/row_formatter.tsx           |  36 ++----
 .../layout/discover_documents.test.tsx        |   5 +
 .../layout/discover_layout.test.tsx           |  13 +++
 ...ver_index_pattern_management.test.tsx.snap |  39 +------
 .../sidebar/lib/field_calculator.js           |   2 +-
 .../apps/main/utils/calc_field_counts.ts      |   2 +-
 .../discover_grid/discover_grid.test.tsx      |   5 +
 .../discover_grid/discover_grid.tsx           |   6 +-
 .../get_render_cell_value.test.tsx            |  98 ++++++++++++++--
 .../discover_grid/get_render_cell_value.tsx   |  55 ++++-----
 .../components/table/table.test.tsx           |  34 +-----
 .../application/components/table/table.tsx    |  12 +-
 .../components/table/table_cell_actions.tsx   |   6 +-
 .../components/table/table_cell_value.tsx     | 107 ++++++++++++++++--
 .../components/table/table_columns.tsx        |  17 ++-
 .../table/table_row_btn_filter_add.tsx        |   2 +-
 .../table/table_row_btn_filter_remove.tsx     |   2 +-
 .../application/helpers/format_hit.test.ts    |  96 ++++++++++++++++
 .../public/application/helpers/format_hit.ts  |  67 +++++++++++
 .../application/helpers/format_value.test.ts  |  69 +++++++++++
 .../application/helpers/format_value.ts       |  39 +++++++
 .../helpers/get_ignored_reason.test.ts        |  54 +++++++++
 .../application/helpers/get_ignored_reason.ts |  52 +++++++++
 src/plugins/discover/public/build_services.ts |   3 +
 src/plugins/discover/public/plugin.tsx        |   2 +
 .../common/converters/source.test.ts          |  21 +---
 .../common/converters/source.tsx              |  55 +--------
 src/plugins/field_formats/common/types.ts     |   4 -
 .../generate_csv/generate_csv.ts              |   2 +-
 .../translations/translations/ja-JP.json      |   1 -
 .../translations/translations/zh-CN.json      |   1 -
 44 files changed, 858 insertions(+), 406 deletions(-)
 delete mode 100644 src/plugins/data_views/common/data_views/format_hit.ts
 create mode 100644 src/plugins/discover/public/application/helpers/format_hit.test.ts
 create mode 100644 src/plugins/discover/public/application/helpers/format_hit.ts
 create mode 100644 src/plugins/discover/public/application/helpers/format_value.test.ts
 create mode 100644 src/plugins/discover/public/application/helpers/format_value.ts
 create mode 100644 src/plugins/discover/public/application/helpers/get_ignored_reason.test.ts
 create mode 100644 src/plugins/discover/public/application/helpers/get_ignored_reason.ts

diff --git a/src/plugins/data/common/search/tabify/tabify_docs.test.ts b/src/plugins/data/common/search/tabify/tabify_docs.test.ts
index a2910a1be4a9a..1964247b09585 100644
--- a/src/plugins/data/common/search/tabify/tabify_docs.test.ts
+++ b/src/plugins/data/common/search/tabify/tabify_docs.test.ts
@@ -41,6 +41,11 @@ function create(id: string) {
   });
 }
 
+const meta = {
+  _index: 'index-name',
+  _id: '1',
+};
+
 describe('tabify_docs', () => {
   describe('flattenHit', () => {
     let indexPattern: DataView;
@@ -70,6 +75,50 @@ describe('tabify_docs', () => {
       expect(Object.keys(response)).toEqual(expectedOrder);
       expect(Object.entries(response).map(([key]) => key)).toEqual(expectedOrder);
     });
+
+    it('does merge values from ignored_field_values and fields correctly', () => {
+      const flatten = flattenHit(
+        {
+          ...meta,
+          fields: { 'extension.keyword': ['foo'], extension: ['foo', 'ignored'] },
+          ignored_field_values: {
+            'extension.keyword': ['ignored'],
+            fully_ignored: ['some', 'value'],
+          },
+        },
+        indexPattern,
+        { includeIgnoredValues: true }
+      );
+      expect(flatten).toHaveProperty(['extension.keyword'], ['foo', 'ignored']);
+      expect(flatten).toHaveProperty('extension', ['foo', 'ignored']);
+      expect(flatten).toHaveProperty('fully_ignored', ['some', 'value']);
+    });
+
+    it('does not merge values from ignored_field_values into _source', () => {
+      const flatten = flattenHit(
+        {
+          ...meta,
+          _source: { 'extension.keyword': ['foo', 'ignored'] },
+          ignored_field_values: { 'extension.keyword': ['ignored'] },
+        },
+        indexPattern,
+        { includeIgnoredValues: true, source: true }
+      );
+      expect(flatten).toHaveProperty(['extension.keyword'], ['foo', 'ignored']);
+    });
+
+    it('does merge ignored_field_values when no _source was present, even when parameter was on', () => {
+      const flatten = flattenHit(
+        {
+          ...meta,
+          fields: { 'extension.keyword': ['foo'] },
+          ignored_field_values: { 'extension.keyword': ['ignored'] },
+        },
+        indexPattern,
+        { includeIgnoredValues: true, source: true }
+      );
+      expect(flatten).toHaveProperty(['extension.keyword'], ['foo', 'ignored']);
+    });
   });
 
   describe('tabifyDocs', () => {
diff --git a/src/plugins/data/common/search/tabify/tabify_docs.ts b/src/plugins/data/common/search/tabify/tabify_docs.ts
index 4259488771761..353a0c10ba12a 100644
--- a/src/plugins/data/common/search/tabify/tabify_docs.ts
+++ b/src/plugins/data/common/search/tabify/tabify_docs.ts
@@ -55,8 +55,18 @@ export interface TabifyDocsOptions {
    * merged into the flattened document.
    */
   source?: boolean;
+  /**
+   * If set to `true` values that have been ignored in ES (ignored_field_values)
+   * will be merged into the flattened document. This will only have an effect if
+   * the `hit` has been retrieved using the `fields` option.
+   */
+  includeIgnoredValues?: boolean;
 }
 
+// This is an overwrite of the SearchHit type to add the ignored_field_values.
+// Can be removed once the estypes.SearchHit knows about ignored_field_values
+type Hit<T = unknown> = estypes.SearchHit<T> & { ignored_field_values?: Record<string, unknown[]> };
+
 /**
  * Flattens an individual hit (from an ES response) into an object. This will
  * create flattened field names, like `user.name`.
@@ -65,11 +75,7 @@ export interface TabifyDocsOptions {
  * @param indexPattern The index pattern for the requested index if available.
  * @param params Parameters how to flatten the hit
  */
-export function flattenHit(
-  hit: estypes.SearchHit,
-  indexPattern?: IndexPattern,
-  params?: TabifyDocsOptions
-) {
+export function flattenHit(hit: Hit, indexPattern?: IndexPattern, params?: TabifyDocsOptions) {
   const flat = {} as Record<string, any>;
 
   function flatten(obj: Record<string, any>, keyPrefix: string = '') {
@@ -109,6 +115,28 @@ export function flattenHit(
   flatten(hit.fields || {});
   if (params?.source !== false && hit._source) {
     flatten(hit._source as Record<string, any>);
+  } else if (params?.includeIgnoredValues && hit.ignored_field_values) {
+    // If enabled merge the ignored_field_values into the flattened hit. This will
+    // merge values that are not actually indexed by ES (i.e. ignored), e.g. because
+    // they were above the `ignore_above` limit or malformed for specific types.
+    // This API will only contain the values that were actually ignored, i.e. for the same
+    // field there might exist another value in the `fields` response, why this logic
+    // merged them both together. We do not merge this (even if enabled) in case source has been
+    // merged, since we would otherwise duplicate values, since ignore_field_values and _source
+    // contain the same values.
+    Object.entries(hit.ignored_field_values).forEach(([fieldName, fieldValue]) => {
+      if (flat[fieldName]) {
+        // If there was already a value from the fields API, make sure we're merging both together
+        if (Array.isArray(flat[fieldName])) {
+          flat[fieldName] = [...flat[fieldName], ...fieldValue];
+        } else {
+          flat[fieldName] = [flat[fieldName], ...fieldValue];
+        }
+      } else {
+        // If no previous value was assigned we can simply use the value from `ignored_field_values` as it is
+        flat[fieldName] = fieldValue;
+      }
+    });
   }
 
   // Merge all valid meta fields into the flattened object
diff --git a/src/plugins/data_views/common/data_views/data_view.ts b/src/plugins/data_views/common/data_views/data_view.ts
index a1b6d4d731bca..e6533a8f9fb1e 100644
--- a/src/plugins/data_views/common/data_views/data_view.ts
+++ b/src/plugins/data_views/common/data_views/data_view.ts
@@ -17,7 +17,6 @@ import { DuplicateField } from '../../../kibana_utils/common';
 
 import { IIndexPattern, IFieldType } from '../../common';
 import { DataViewField, IIndexPatternFieldList, fieldList } from '../fields';
-import { formatHitProvider } from './format_hit';
 import { flattenHitWrapper } from './flatten_hit';
 import {
   FieldFormatsStartCommon,
@@ -45,8 +44,6 @@ interface SavedObjectBody {
   type?: string;
 }
 
-type FormatFieldFn = (hit: Record<string, any>, fieldName: string) => any;
-
 export class DataView implements IIndexPattern {
   public id?: string;
   public title: string = '';
@@ -67,11 +64,6 @@ export class DataView implements IIndexPattern {
    * Type is used to identify rollup index patterns
    */
   public type: string | undefined;
-  public formatHit: {
-    (hit: Record<string, any>, type?: string): any;
-    formatField: FormatFieldFn;
-  };
-  public formatField: FormatFieldFn;
   /**
    * @deprecated Use `flattenHit` utility method exported from data plugin instead.
    */
@@ -103,11 +95,6 @@ export class DataView implements IIndexPattern {
     this.fields = fieldList([], this.shortDotsEnable);
 
     this.flattenHit = flattenHitWrapper(this, metaFields);
-    this.formatHit = formatHitProvider(
-      this,
-      fieldFormats.getDefaultInstance(KBN_FIELD_TYPES.STRING)
-    );
-    this.formatField = this.formatHit.formatField;
 
     // set values
     this.id = spec.id;
diff --git a/src/plugins/data_views/common/data_views/format_hit.ts b/src/plugins/data_views/common/data_views/format_hit.ts
deleted file mode 100644
index c8e6e8e337155..0000000000000
--- a/src/plugins/data_views/common/data_views/format_hit.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import _ from 'lodash';
-import { DataView } from './data_view';
-import { FieldFormatsContentType } from '../../../field_formats/common';
-
-const formattedCache = new WeakMap();
-const partialFormattedCache = new WeakMap();
-
-// Takes a hit, merges it with any stored/scripted fields, and with the metaFields
-// returns a formatted version
-export function formatHitProvider(dataView: DataView, defaultFormat: any) {
-  function convert(
-    hit: Record<string, any>,
-    val: any,
-    fieldName: string,
-    type: FieldFormatsContentType = 'html'
-  ) {
-    const field = dataView.fields.getByName(fieldName);
-    const format = field ? dataView.getFormatterForField(field) : defaultFormat;
-
-    return format.convert(val, type, { field, hit, indexPattern: dataView });
-  }
-
-  function formatHit(hit: Record<string, any>, type: string = 'html') {
-    const cached = formattedCache.get(hit);
-    if (cached) {
-      return cached;
-    }
-
-    // use and update the partial cache, but don't rewrite it.
-    // _source is stored in partialFormattedCache but not formattedCache
-    const partials = partialFormattedCache.get(hit) || {};
-    partialFormattedCache.set(hit, partials);
-
-    const cache: Record<string, any> = {};
-    formattedCache.set(hit, cache);
-
-    _.forOwn(dataView.flattenHit(hit), function (val: any, fieldName?: string) {
-      // sync the formatted and partial cache
-      if (!fieldName) {
-        return;
-      }
-      const formatted =
-        partials[fieldName] == null ? convert(hit, val, fieldName) : partials[fieldName];
-      cache[fieldName] = partials[fieldName] = formatted;
-    });
-
-    return cache;
-  }
-
-  formatHit.formatField = function (hit: Record<string, any>, fieldName: string) {
-    let partials = partialFormattedCache.get(hit);
-    if (partials && partials[fieldName] != null) {
-      return partials[fieldName];
-    }
-
-    if (!partials) {
-      partials = {};
-      partialFormattedCache.set(hit, partials);
-    }
-
-    const val = fieldName === '_source' ? hit._source : dataView.flattenHit(hit)[fieldName];
-    return convert(hit, val, fieldName);
-  };
-
-  return formatHit;
-}
diff --git a/src/plugins/data_views/common/data_views/index.ts b/src/plugins/data_views/common/data_views/index.ts
index 7c94dff961c9c..d925d42fbea0d 100644
--- a/src/plugins/data_views/common/data_views/index.ts
+++ b/src/plugins/data_views/common/data_views/index.ts
@@ -8,6 +8,5 @@
 
 export * from './_pattern_cache';
 export * from './flatten_hit';
-export * from './format_hit';
 export * from './data_view';
 export * from './data_views';
diff --git a/src/plugins/data_views/public/index.ts b/src/plugins/data_views/public/index.ts
index d8814e886fb0e..b220aea6f392c 100644
--- a/src/plugins/data_views/public/index.ts
+++ b/src/plugins/data_views/public/index.ts
@@ -13,11 +13,7 @@ export {
   ILLEGAL_CHARACTERS,
   validateDataView,
 } from '../common/lib';
-export {
-  formatHitProvider,
-  onRedirectNoIndexPattern,
-  onUnsupportedTimePattern,
-} from './data_views';
+export { onRedirectNoIndexPattern, onUnsupportedTimePattern } from './data_views';
 
 export { IndexPatternField, IIndexPatternFieldList, TypeMeta } from '../common';
 
diff --git a/src/plugins/discover/kibana.json b/src/plugins/discover/kibana.json
index 3d5fdefd276d3..791ce54a0cb1b 100644
--- a/src/plugins/discover/kibana.json
+++ b/src/plugins/discover/kibana.json
@@ -8,6 +8,7 @@
     "data",
     "embeddable",
     "inspector",
+    "fieldFormats",
     "kibanaLegacy",
     "urlForwarding",
     "navigation",
@@ -16,7 +17,7 @@
     "indexPatternFieldEditor"
   ],
   "optionalPlugins": ["home", "share", "usageCollection", "spaces"],
-  "requiredBundles": ["kibanaUtils", "home", "kibanaReact", "fieldFormats", "dataViews"],
+  "requiredBundles": ["kibanaUtils", "home", "kibanaReact", "dataViews"],
   "extraPublicDirs": ["common"],
   "owner": {
     "name": "Data Discovery",
diff --git a/src/plugins/discover/public/__mocks__/index_pattern.ts b/src/plugins/discover/public/__mocks__/index_pattern.ts
index 2acb512617a6b..d33445baa0a2b 100644
--- a/src/plugins/discover/public/__mocks__/index_pattern.ts
+++ b/src/plugins/discover/public/__mocks__/index_pattern.ts
@@ -6,8 +6,7 @@
  * Side Public License, v 1.
  */
 
-import type { estypes } from '@elastic/elasticsearch';
-import { flattenHit, IIndexPatternFieldList } from '../../../data/common';
+import { IIndexPatternFieldList } from '../../../data/common';
 import { IndexPattern } from '../../../data/common';
 
 const fields = [
@@ -28,6 +27,7 @@ const fields = [
   {
     name: 'message',
     type: 'string',
+    displayName: 'message',
     scripted: false,
     filterable: false,
     aggregatable: false,
@@ -35,6 +35,7 @@ const fields = [
   {
     name: 'extension',
     type: 'string',
+    displayName: 'extension',
     scripted: false,
     filterable: true,
     aggregatable: true,
@@ -42,6 +43,7 @@ const fields = [
   {
     name: 'bytes',
     type: 'number',
+    displayName: 'bytesDisplayName',
     scripted: false,
     filterable: true,
     aggregatable: true,
@@ -49,12 +51,14 @@ const fields = [
   {
     name: 'scripted',
     type: 'number',
+    displayName: 'scripted',
     scripted: true,
     filterable: false,
   },
   {
     name: 'object.value',
     type: 'number',
+    displayName: 'object.value',
     scripted: false,
     filterable: true,
     aggregatable: true,
@@ -73,23 +77,15 @@ const indexPattern = {
   id: 'the-index-pattern-id',
   title: 'the-index-pattern-title',
   metaFields: ['_index', '_score'],
-  formatField: jest.fn(),
-  flattenHit: undefined,
-  formatHit: jest.fn((hit) => (hit.fields ? hit.fields : hit._source)),
   fields,
   getComputedFields: () => ({ docvalueFields: [], scriptFields: {}, storedFields: ['*'] }),
   getSourceFiltering: () => ({}),
   getFieldByName: jest.fn(() => ({})),
   timeFieldName: '',
   docvalueFields: [],
-  getFormatterForField: () => ({ convert: () => 'formatted' }),
+  getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
 } as unknown as IndexPattern;
 
 indexPattern.isTimeBased = () => !!indexPattern.timeFieldName;
-indexPattern.formatField = (hit: Record<string, unknown>, fieldName: string) => {
-  return fieldName === '_source'
-    ? hit._source
-    : flattenHit(hit as unknown as estypes.SearchHit, indexPattern)[fieldName];
-};
 
 export const indexPatternMock = indexPattern;
diff --git a/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts b/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
index 6cf8e8b3485ff..906ebdebdd06a 100644
--- a/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
+++ b/src/plugins/discover/public/__mocks__/index_pattern_with_timefield.ts
@@ -6,9 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { flattenHit, IIndexPatternFieldList } from '../../../data/common';
+import { IIndexPatternFieldList } from '../../../data/common';
 import { IndexPattern } from '../../../data/common';
-import type { estypes } from '@elastic/elasticsearch';
 
 const fields = [
   {
@@ -64,23 +63,16 @@ const indexPattern = {
   id: 'index-pattern-with-timefield-id',
   title: 'index-pattern-with-timefield',
   metaFields: ['_index', '_score'],
-  flattenHit: undefined,
-  formatHit: jest.fn((hit) => hit._source),
   fields,
   getComputedFields: () => ({}),
   getSourceFiltering: () => ({}),
   getFieldByName: (name: string) => fields.getByName(name),
   timeFieldName: 'timestamp',
-  getFormatterForField: () => ({ convert: () => 'formatted' }),
+  getFormatterForField: () => ({ convert: (value: unknown) => value }),
   isTimeNanosBased: () => false,
   popularizeField: () => {},
 } as unknown as IndexPattern;
 
 indexPattern.isTimeBased = () => !!indexPattern.timeFieldName;
-indexPattern.formatField = (hit: Record<string, unknown>, fieldName: string) => {
-  return fieldName === '_source'
-    ? hit._source
-    : flattenHit(hit as unknown as estypes.SearchHit, indexPattern)[fieldName];
-};
 
 export const indexPatternWithTimefieldMock = indexPattern;
diff --git a/src/plugins/discover/public/__mocks__/services.ts b/src/plugins/discover/public/__mocks__/services.ts
index 8cc5ccf5aa121..6a90ed42417e6 100644
--- a/src/plugins/discover/public/__mocks__/services.ts
+++ b/src/plugins/discover/public/__mocks__/services.ts
@@ -13,6 +13,7 @@ import {
   CONTEXT_STEP_SETTING,
   DEFAULT_COLUMNS_SETTING,
   DOC_HIDE_TIME_COLUMN_SETTING,
+  MAX_DOC_FIELDS_DISPLAYED,
   SAMPLE_SIZE_SETTING,
   SORT_DEFAULT_ORDER_SETTING,
 } from '../../common';
@@ -43,9 +44,13 @@ export const discoverServiceMock = {
       save: true,
     },
   },
+  fieldFormats: {
+    getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+    getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+  },
   filterManager: dataPlugin.query.filterManager,
   uiSettings: {
-    get: (key: string) => {
+    get: jest.fn((key: string) => {
       if (key === 'fields:popularLimit') {
         return 5;
       } else if (key === DEFAULT_COLUMNS_SETTING) {
@@ -62,8 +67,10 @@ export const discoverServiceMock = {
         return false;
       } else if (key === SAMPLE_SIZE_SETTING) {
         return 250;
+      } else if (key === MAX_DOC_FIELDS_DISPLAYED) {
+        return 50;
       }
-    },
+    }),
     isDefault: (key: string) => {
       return true;
     },
diff --git a/src/plugins/discover/public/application/apps/context/context_app.test.tsx b/src/plugins/discover/public/application/apps/context/context_app.test.tsx
index 0e50f8f714a2c..d1c557f2839bc 100644
--- a/src/plugins/discover/public/application/apps/context/context_app.test.tsx
+++ b/src/plugins/discover/public/application/apps/context/context_app.test.tsx
@@ -62,6 +62,10 @@ describe('ContextApp test', () => {
       navigation: mockNavigationPlugin,
       core: { notifications: { toasts: [] } },
       history: () => {},
+      fieldFormats: {
+        getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+        getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+      },
       filterManager: mockFilterManager,
       uiSettings: uiSettingsMock,
     } as unknown as DiscoverServices);
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx b/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
index d91735460af08..0bf4a36555d16 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
@@ -10,6 +10,7 @@ import React, { Fragment, useCallback, useMemo, useState } from 'react';
 import classNames from 'classnames';
 import { i18n } from '@kbn/i18n';
 import { EuiButtonEmpty, EuiIcon } from '@elastic/eui';
+import { formatFieldValue } from '../../../../../helpers/format_value';
 import { flattenHit } from '../../../../../../../../data/common';
 import { DocViewer } from '../../../../../components/doc_viewer/doc_viewer';
 import { FilterManager, IndexPattern } from '../../../../../../../../data/public';
@@ -58,7 +59,10 @@ export const TableRow = ({
   });
   const anchorDocTableRowSubj = row.isAnchor ? ' docTableAnchorRow' : '';
 
-  const flattenedRow = useMemo(() => flattenHit(row, indexPattern), [indexPattern, row]);
+  const flattenedRow = useMemo(
+    () => flattenHit(row, indexPattern, { includeIgnoredValues: true }),
+    [indexPattern, row]
+  );
   const mapping = useMemo(() => indexPattern.fields.getByName, [indexPattern]);
 
   // toggle display of the rows details, a full list of the fields from each row
@@ -68,13 +72,24 @@ export const TableRow = ({
    * Fill an element with the value of a field
    */
   const displayField = (fieldName: string) => {
-    const formattedField = indexPattern.formatField(row, fieldName);
-
-    // field formatters take care of escaping
-    // eslint-disable-next-line react/no-danger
-    const fieldElement = <span dangerouslySetInnerHTML={{ __html: formattedField }} />;
+    // If we're formatting the _source column, don't use the regular field formatter,
+    // but our Discover mechanism to format a hit in a better human-readable way.
+    if (fieldName === '_source') {
+      return formatRow(row, indexPattern, fieldsToShow);
+    }
+
+    const formattedField = formatFieldValue(
+      flattenedRow[fieldName],
+      row,
+      indexPattern,
+      mapping(fieldName)
+    );
 
-    return <div className="truncate-by-height">{fieldElement}</div>;
+    return (
+      // formatFieldValue always returns sanitized HTML
+      // eslint-disable-next-line react/no-danger
+      <div className="truncate-by-height" dangerouslySetInnerHTML={{ __html: formattedField }} />
+    );
   };
   const inlineFilter = useCallback(
     (column: string, type: '+' | '-') => {
@@ -141,10 +156,9 @@ export const TableRow = ({
     );
   } else {
     columns.forEach(function (column: string) {
-      // when useNewFieldsApi is true, addressing to the fields property is safe
-      if (useNewFieldsApi && !mapping(column) && !row.fields![column]) {
+      if (useNewFieldsApi && !mapping(column) && row.fields && !row.fields[column]) {
         const innerColumns = Object.fromEntries(
-          Object.entries(row.fields!).filter(([key]) => {
+          Object.entries(row.fields).filter(([key]) => {
             return key.indexOf(`${column}.`) === 0;
           })
         );
@@ -161,7 +175,13 @@ export const TableRow = ({
           />
         );
       } else {
-        const isFilterable = Boolean(mapping(column)?.filterable && filter);
+        // Check whether the field is defined as filterable in the mapping and does
+        // NOT have ignored values in it to determine whether we want to allow filtering.
+        // We should improve this and show a helpful tooltip why the filter buttons are not
+        // there/disabled when there are ignored values.
+        const isFilterable = Boolean(
+          mapping(column)?.filterable && filter && !row._ignored?.includes(column)
+        );
         rowCells.push(
           <TableCell
             key={column}
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.test.ts b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.test.ts
index 9cd2959f5d72a..2e777a18ce906 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.test.ts
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.test.ts
@@ -17,6 +17,7 @@ import { stubbedSavedObjectIndexPattern } from '../../../../../../../../data/com
 describe('Row formatter', () => {
   const hit = {
     _id: 'a',
+    _index: 'foo',
     _type: 'doc',
     _score: 1,
     _source: {
@@ -39,7 +40,7 @@ describe('Row formatter', () => {
       spec: { id, type, version, timeFieldName, fields: JSON.parse(fields), title },
       fieldFormats: fieldFormatsMock,
       shortDotsEnable: false,
-      metaFields: [],
+      metaFields: ['_id', '_type', '_score'],
     });
   };
 
@@ -47,26 +48,15 @@ describe('Row formatter', () => {
 
   const fieldsToShow = indexPattern.fields.getAll().map((fld) => fld.name);
 
-  // Realistic response with alphabetical insertion order
-  const formatHitReturnValue = {
-    also: 'with \\&quot;quotes\\&quot; or &#39;single qoutes&#39;',
-    foo: 'bar',
-    number: '42',
-    hello: '&lt;h1&gt;World&lt;/h1&gt;',
-    _id: 'a',
-    _type: 'doc',
-    _score: 1,
-  };
-
-  const formatHitMock = jest.fn().mockReturnValue(formatHitReturnValue);
-
   beforeEach(() => {
-    // @ts-expect-error
-    indexPattern.formatHit = formatHitMock;
     setServices({
       uiSettings: {
         get: () => 100,
       },
+      fieldFormats: {
+        getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+        getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+      },
     } as unknown as DiscoverServices);
   });
 
@@ -77,32 +67,32 @@ describe('Row formatter', () => {
           Array [
             Array [
               "also",
-              "with \\\\&quot;quotes\\\\&quot; or &#39;single qoutes&#39;",
+              "with \\"quotes\\" or 'single quotes'",
             ],
             Array [
               "foo",
               "bar",
             ],
             Array [
-              "number",
-              "42",
+              "hello",
+              "<h1>World</h1>",
             ],
             Array [
-              "hello",
-              "&lt;h1&gt;World&lt;/h1&gt;",
+              "number",
+              42,
             ],
             Array [
               "_id",
               "a",
             ],
-            Array [
-              "_type",
-              "doc",
-            ],
             Array [
               "_score",
               1,
             ],
+            Array [
+              "_type",
+              "doc",
+            ],
           ]
         }
       />
@@ -114,6 +104,10 @@ describe('Row formatter', () => {
       uiSettings: {
         get: () => 1,
       },
+      fieldFormats: {
+        getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+        getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+      },
     } as unknown as DiscoverServices);
     expect(formatRow(hit, indexPattern, [])).toMatchInlineSnapshot(`
       <TemplateComponent
@@ -121,7 +115,31 @@ describe('Row formatter', () => {
           Array [
             Array [
               "also",
-              "with \\\\&quot;quotes\\\\&quot; or &#39;single qoutes&#39;",
+              "with \\"quotes\\" or 'single quotes'",
+            ],
+            Array [
+              "foo",
+              "bar",
+            ],
+            Array [
+              "hello",
+              "<h1>World</h1>",
+            ],
+            Array [
+              "number",
+              42,
+            ],
+            Array [
+              "_id",
+              "a",
+            ],
+            Array [
+              "_score",
+              1,
+            ],
+            Array [
+              "_type",
+              "doc",
             ],
           ]
         }
@@ -130,18 +148,18 @@ describe('Row formatter', () => {
   });
 
   it('formats document with highlighted fields first', () => {
-    expect(formatRow({ ...hit, highlight: { number: '42' } }, indexPattern, fieldsToShow))
+    expect(formatRow({ ...hit, highlight: { number: ['42'] } }, indexPattern, fieldsToShow))
       .toMatchInlineSnapshot(`
       <TemplateComponent
         defPairs={
           Array [
             Array [
               "number",
-              "42",
+              42,
             ],
             Array [
               "also",
-              "with \\\\&quot;quotes\\\\&quot; or &#39;single qoutes&#39;",
+              "with \\"quotes\\" or 'single quotes'",
             ],
             Array [
               "foo",
@@ -149,20 +167,20 @@ describe('Row formatter', () => {
             ],
             Array [
               "hello",
-              "&lt;h1&gt;World&lt;/h1&gt;",
+              "<h1>World</h1>",
             ],
             Array [
               "_id",
               "a",
             ],
-            Array [
-              "_type",
-              "doc",
-            ],
             Array [
               "_score",
               1,
             ],
+            Array [
+              "_type",
+              "doc",
+            ],
           ]
         }
       />
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
index 14cf1839107e7..2702a232f21ef 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
@@ -6,15 +6,17 @@
  * Side Public License, v 1.
  */
 
+import { estypes } from '@elastic/elasticsearch';
 import React, { Fragment } from 'react';
 import type { IndexPattern } from 'src/plugins/data/common';
 import { MAX_DOC_FIELDS_DISPLAYED } from '../../../../../../../common';
 import { getServices } from '../../../../../../kibana_services';
+import { formatHit } from '../../../../../helpers/format_hit';
 
 import './row_formatter.scss';
 
 interface Props {
-  defPairs: Array<[string, unknown]>;
+  defPairs: Array<[string, string]>;
 }
 const TemplateComponent = ({ defPairs }: Props) => {
   return (
@@ -24,8 +26,8 @@ const TemplateComponent = ({ defPairs }: Props) => {
           <dt>{pair[0]}:</dt>
           <dd
             className="rowFormatter__value"
-            // We  can dangerously set HTML here because this content is guaranteed to have been run through a valid field formatter first.
-            dangerouslySetInnerHTML={{ __html: `${pair[1]}` }} // eslint-disable-line react/no-danger
+            // eslint-disable-next-line react/no-danger
+            dangerouslySetInnerHTML={{ __html: pair[1] }}
           />{' '}
         </Fragment>
       ))}
@@ -34,30 +36,12 @@ const TemplateComponent = ({ defPairs }: Props) => {
 };
 
 export const formatRow = (
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  hit: Record<string, any>,
+  hit: estypes.SearchHit,
   indexPattern: IndexPattern,
   fieldsToShow: string[]
 ) => {
-  const highlights = hit?.highlight ?? {};
-  // Keys are sorted in the hits object
-  const formatted = indexPattern.formatHit(hit);
-  const fields = indexPattern.fields;
-  const highlightPairs: Array<[string, unknown]> = [];
-  const sourcePairs: Array<[string, unknown]> = [];
-  Object.entries(formatted).forEach(([key, val]) => {
-    const displayKey = fields.getByName ? fields.getByName(key)?.displayName : undefined;
-    const pairs = highlights[key] ? highlightPairs : sourcePairs;
-    if (displayKey) {
-      if (fieldsToShow.includes(displayKey)) {
-        pairs.push([displayKey, val]);
-      }
-    } else {
-      pairs.push([key, val]);
-    }
-  });
-  const maxEntries = getServices().uiSettings.get(MAX_DOC_FIELDS_DISPLAYED);
-  return <TemplateComponent defPairs={[...highlightPairs, ...sourcePairs].slice(0, maxEntries)} />;
+  const pairs = formatHit(hit, indexPattern, fieldsToShow);
+  return <TemplateComponent defPairs={pairs} />;
 };
 
 export const formatTopLevelObject = (
@@ -68,8 +52,8 @@ export const formatTopLevelObject = (
   indexPattern: IndexPattern
 ) => {
   const highlights = row.highlight ?? {};
-  const highlightPairs: Array<[string, unknown]> = [];
-  const sourcePairs: Array<[string, unknown]> = [];
+  const highlightPairs: Array<[string, string]> = [];
+  const sourcePairs: Array<[string, string]> = [];
   const sorted = Object.entries(fields).sort(([keyA], [keyB]) => keyA.localeCompare(keyB));
   sorted.forEach(([key, values]) => {
     const field = indexPattern.getFieldByName(key);
diff --git a/src/plugins/discover/public/application/apps/main/components/layout/discover_documents.test.tsx b/src/plugins/discover/public/application/apps/main/components/layout/discover_documents.test.tsx
index e5212e877e8ba..60540268dcd7f 100644
--- a/src/plugins/discover/public/application/apps/main/components/layout/discover_documents.test.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/layout/discover_documents.test.tsx
@@ -20,6 +20,11 @@ import { DiscoverDocuments } from './discover_documents';
 import { ElasticSearchHit } from '../../../../doc_views/doc_views_types';
 import { indexPatternMock } from '../../../../../__mocks__/index_pattern';
 
+jest.mock('../../../../../kibana_services', () => ({
+  ...jest.requireActual('../../../../../kibana_services'),
+  getServices: () => jest.requireActual('../../../../../__mocks__/services').discoverServiceMock,
+}));
+
 setHeaderActionMenuMounter(jest.fn());
 
 function getProps(fetchStatus: FetchStatus, hits: ElasticSearchHit[]) {
diff --git a/src/plugins/discover/public/application/apps/main/components/layout/discover_layout.test.tsx b/src/plugins/discover/public/application/apps/main/components/layout/discover_layout.test.tsx
index 6ebed3185e2f1..7e3252dce1ef5 100644
--- a/src/plugins/discover/public/application/apps/main/components/layout/discover_layout.test.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/layout/discover_layout.test.tsx
@@ -33,6 +33,19 @@ import { RequestAdapter } from '../../../../../../../inspector';
 import { Chart } from '../chart/point_series';
 import { DiscoverSidebar } from '../sidebar/discover_sidebar';
 
+jest.mock('../../../../../kibana_services', () => ({
+  ...jest.requireActual('../../../../../kibana_services'),
+  getServices: () => ({
+    fieldFormats: {
+      getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+      getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+    },
+    uiSettings: {
+      get: jest.fn((key: string) => key === 'discover:maxDocFieldsDisplayed' && 50),
+    },
+  }),
+}));
+
 setHeaderActionMenuMounter(jest.fn());
 
 function getProps(indexPattern: IndexPattern, wasSidebarClosed?: boolean): DiscoverLayoutProps {
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/__snapshots__/discover_index_pattern_management.test.tsx.snap b/src/plugins/discover/public/application/apps/main/components/sidebar/__snapshots__/discover_index_pattern_management.test.tsx.snap
index ebb06e0b2ecd3..02e2879476a5e 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/__snapshots__/discover_index_pattern_management.test.tsx.snap
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/__snapshots__/discover_index_pattern_management.test.tsx.snap
@@ -115,42 +115,7 @@ exports[`Discover IndexPattern Management renders correctly 1`] = `
         "deserialize": [MockFunction],
         "getByFieldType": [MockFunction],
         "getDefaultConfig": [MockFunction],
-        "getDefaultInstance": [MockFunction] {
-          "calls": Array [
-            Array [
-              "string",
-            ],
-            Array [
-              "string",
-            ],
-            Array [
-              "string",
-            ],
-          ],
-          "results": Array [
-            Object {
-              "type": "return",
-              "value": Object {
-                "convert": [MockFunction],
-                "getConverterFor": [MockFunction],
-              },
-            },
-            Object {
-              "type": "return",
-              "value": Object {
-                "convert": [MockFunction],
-                "getConverterFor": [MockFunction],
-              },
-            },
-            Object {
-              "type": "return",
-              "value": Object {
-                "convert": [MockFunction],
-                "getConverterFor": [MockFunction],
-              },
-            },
-          ],
-        },
+        "getDefaultInstance": [MockFunction],
         "getDefaultInstanceCacheResolver": [MockFunction],
         "getDefaultInstancePlain": [MockFunction],
         "getDefaultType": [MockFunction],
@@ -651,8 +616,6 @@ exports[`Discover IndexPattern Management renders correctly 1`] = `
         },
       ],
       "flattenHit": [Function],
-      "formatField": [Function],
-      "formatHit": [Function],
       "getFieldAttrs": [Function],
       "getOriginalSavedObjectBody": [Function],
       "id": "logstash-*",
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js b/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
index be7e9c616273d..c709f3311105d 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/lib/field_calculator.js
@@ -13,7 +13,7 @@ import { flattenHit } from '../../../../../../../../data/common';
 function getFieldValues(hits, field, indexPattern) {
   const name = field.name;
   return map(hits, function (hit) {
-    return flattenHit(hit, indexPattern)[name];
+    return flattenHit(hit, indexPattern, { includeIgnoredValues: true })[name];
   });
 }
 
diff --git a/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts b/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
index 211c4e5c8b069..2198d2f66b6b4 100644
--- a/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
+++ b/src/plugins/discover/public/application/apps/main/utils/calc_field_counts.ts
@@ -22,7 +22,7 @@ export function calcFieldCounts(
     return {};
   }
   for (const hit of rows) {
-    const fields = Object.keys(flattenHit(hit, indexPattern));
+    const fields = Object.keys(flattenHit(hit, indexPattern, { includeIgnoredValues: true }));
     for (const fieldName of fields) {
       counts[fieldName] = (counts[fieldName] || 0) + 1;
     }
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid.test.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid.test.tsx
index b2be40c008200..22284480afc05 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid.test.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid.test.tsx
@@ -19,6 +19,11 @@ import { DiscoverServices } from '../../../build_services';
 import { ElasticSearchHit } from '../../doc_views/doc_views_types';
 import { getDocId } from './discover_grid_document_selection';
 
+jest.mock('../../../kibana_services', () => ({
+  ...jest.requireActual('../../../kibana_services'),
+  getServices: () => jest.requireActual('../../../__mocks__/services').discoverServiceMock,
+}));
+
 function getProps() {
   const servicesMock = {
     uiSettings: uiSettingsMock,
diff --git a/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx b/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
index 11323080274a9..ca403c813010b 100644
--- a/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/discover_grid.tsx
@@ -271,7 +271,11 @@ export const DiscoverGrid = ({
       getRenderCellValueFn(
         indexPattern,
         displayedRows,
-        displayedRows ? displayedRows.map((hit) => flattenHit(hit, indexPattern)) : [],
+        displayedRows
+          ? displayedRows.map((hit) =>
+              flattenHit(hit, indexPattern, { includeIgnoredValues: true })
+            )
+          : [],
         useNewFieldsApi,
         fieldsToShow,
         services.uiSettings.get(MAX_DOC_FIELDS_DISPLAYED)
diff --git a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
index 6556876217953..3fb96ba9e9daa 100644
--- a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.test.tsx
@@ -25,6 +25,9 @@ jest.mock('../../../kibana_services', () => ({
     uiSettings: {
       get: jest.fn(),
     },
+    fieldFormats: {
+      getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => (value ? value : '-') })),
+    },
   }),
 }));
 
@@ -102,7 +105,7 @@ describe('Discover grid cell rendering', function () {
       rowsSource,
       rowsSource.map(flatten),
       false,
-      [],
+      ['extension', 'bytes'],
       100
     );
     const component = shallow(
@@ -133,7 +136,7 @@ describe('Discover grid cell rendering', function () {
           }
         />
         <EuiDescriptionListTitle>
-          bytes
+          bytesDisplayName
         </EuiDescriptionListTitle>
         <EuiDescriptionListDescription
           className="dscDiscoverGrid__descriptionListDescription"
@@ -143,6 +146,28 @@ describe('Discover grid cell rendering', function () {
             }
           }
         />
+        <EuiDescriptionListTitle>
+          _index
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": "test",
+            }
+          }
+        />
+        <EuiDescriptionListTitle>
+          _score
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": 1,
+            }
+          }
+        />
       </EuiDescriptionList>
     `);
   });
@@ -196,7 +221,7 @@ describe('Discover grid cell rendering', function () {
       rowsFields,
       rowsFields.map(flatten),
       true,
-      [],
+      ['extension', 'bytes'],
       100
     );
     const component = shallow(
@@ -229,7 +254,7 @@ describe('Discover grid cell rendering', function () {
           }
         />
         <EuiDescriptionListTitle>
-          bytes
+          bytesDisplayName
         </EuiDescriptionListTitle>
         <EuiDescriptionListDescription
           className="dscDiscoverGrid__descriptionListDescription"
@@ -241,6 +266,28 @@ describe('Discover grid cell rendering', function () {
             }
           }
         />
+        <EuiDescriptionListTitle>
+          _index
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": "test",
+            }
+          }
+        />
+        <EuiDescriptionListTitle>
+          _score
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": 1,
+            }
+          }
+        />
       </EuiDescriptionList>
     `);
   });
@@ -251,7 +298,7 @@ describe('Discover grid cell rendering', function () {
       rowsFields,
       rowsFields.map(flatten),
       true,
-      [],
+      ['extension', 'bytes'],
       // this is the number of rendered items
       1
     );
@@ -284,6 +331,41 @@ describe('Discover grid cell rendering', function () {
             }
           }
         />
+        <EuiDescriptionListTitle>
+          bytesDisplayName
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": Array [
+                100,
+              ],
+            }
+          }
+        />
+        <EuiDescriptionListTitle>
+          _index
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": "test",
+            }
+          }
+        />
+        <EuiDescriptionListTitle>
+          _score
+        </EuiDescriptionListTitle>
+        <EuiDescriptionListDescription
+          className="dscDiscoverGrid__descriptionListDescription"
+          dangerouslySetInnerHTML={
+            Object {
+              "__html": 1,
+            }
+          }
+        />
       </EuiDescriptionList>
     `);
   });
@@ -342,7 +424,7 @@ describe('Discover grid cell rendering', function () {
       rowsFieldsWithTopLevelObject,
       rowsFieldsWithTopLevelObject.map(flatten),
       true,
-      [],
+      ['object.value', 'extension', 'bytes'],
       100
     );
     const component = shallow(
@@ -368,7 +450,7 @@ describe('Discover grid cell rendering', function () {
           className="dscDiscoverGrid__descriptionListDescription"
           dangerouslySetInnerHTML={
             Object {
-              "__html": "formatted",
+              "__html": "100",
             }
           }
         />
@@ -383,7 +465,7 @@ describe('Discover grid cell rendering', function () {
       rowsFieldsWithTopLevelObject,
       rowsFieldsWithTopLevelObject.map(flatten),
       true,
-      [],
+      ['extension', 'bytes', 'object.value'],
       100
     );
     const component = shallow(
diff --git a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx
index a052971580666..4066c13f6391e 100644
--- a/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx
+++ b/src/plugins/discover/public/application/components/discover_grid/get_render_cell_value.tsx
@@ -22,6 +22,8 @@ import { DiscoverGridContext } from './discover_grid_context';
 import { JsonCodeEditor } from '../json_code_editor/json_code_editor';
 import { defaultMonacoEditorWidth } from './constants';
 import { EsHitRecord } from '../../types';
+import { formatFieldValue } from '../../helpers/format_value';
+import { formatHit } from '../../helpers/format_hit';
 
 export const getRenderCellValueFn =
   (
@@ -145,39 +147,19 @@ export const getRenderCellValueFn =
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         return <JsonCodeEditor json={row as any} width={defaultMonacoEditorWidth} />;
       }
-      const formatted = indexPattern.formatHit(row);
-
-      // Put the most important fields first
-      const highlights: Record<string, unknown> = (row.highlight as Record<string, unknown>) ?? {};
-      const highlightPairs: Array<[string, string]> = [];
-      const sourcePairs: Array<[string, string]> = [];
-      Object.entries(formatted).forEach(([key, val]) => {
-        const pairs = highlights[key] ? highlightPairs : sourcePairs;
-        const displayKey = indexPattern.fields.getByName
-          ? indexPattern.fields.getByName(key)?.displayName
-          : undefined;
-        if (displayKey) {
-          if (fieldsToShow.includes(displayKey)) {
-            pairs.push([displayKey, val as string]);
-          }
-        } else {
-          pairs.push([key, val as string]);
-        }
-      });
+      const pairs = formatHit(row, indexPattern, fieldsToShow);
 
       return (
         <EuiDescriptionList type="inline" compressed className="dscDiscoverGrid__descriptionList">
-          {[...highlightPairs, ...sourcePairs]
-            .slice(0, maxDocFieldsDisplayed)
-            .map(([key, value]) => (
-              <Fragment key={key}>
-                <EuiDescriptionListTitle>{key}</EuiDescriptionListTitle>
-                <EuiDescriptionListDescription
-                  dangerouslySetInnerHTML={{ __html: value }}
-                  className="dscDiscoverGrid__descriptionListDescription"
-                />
-              </Fragment>
-            ))}
+          {pairs.map(([key, value]) => (
+            <Fragment key={key}>
+              <EuiDescriptionListTitle>{key}</EuiDescriptionListTitle>
+              <EuiDescriptionListDescription
+                className="dscDiscoverGrid__descriptionListDescription"
+                dangerouslySetInnerHTML={{ __html: value }}
+              />
+            </Fragment>
+          ))}
         </EuiDescriptionList>
       );
     }
@@ -191,12 +173,13 @@ export const getRenderCellValueFn =
       return <span>{JSON.stringify(rowFlattened[columnId])}</span>;
     }
 
-    const valueFormatted = indexPattern.formatField(row, columnId);
-    if (typeof valueFormatted === 'undefined') {
-      return <span>-</span>;
-    }
     return (
-      // eslint-disable-next-line react/no-danger
-      <span dangerouslySetInnerHTML={{ __html: indexPattern.formatField(row, columnId) }} />
+      <span
+        // formatFieldValue guarantees sanitized values
+        // eslint-disable-next-line react/no-danger
+        dangerouslySetInnerHTML={{
+          __html: formatFieldValue(rowFlattened[columnId], row, indexPattern, field),
+        }}
+      />
     );
   };
diff --git a/src/plugins/discover/public/application/components/table/table.test.tsx b/src/plugins/discover/public/application/components/table/table.test.tsx
index ce914edcec703..e61333cce1166 100644
--- a/src/plugins/discover/public/application/components/table/table.test.tsx
+++ b/src/plugins/discover/public/application/components/table/table.test.tsx
@@ -27,6 +27,10 @@ import { getServices } from '../../../kibana_services';
       }
     },
   },
+  fieldFormats: {
+    getDefaultInstance: jest.fn(() => ({ convert: (value: unknown) => value })),
+    getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
+  },
 }));
 
 const indexPattern = {
@@ -65,8 +69,7 @@ const indexPattern = {
     ],
   },
   metaFields: ['_index', '_score'],
-  flattenHit: jest.fn(),
-  formatHit: jest.fn((hit) => hit._source),
+  getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
 } as unknown as IndexPattern;
 
 indexPattern.fields.getByName = (name: string) => {
@@ -359,32 +362,7 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
       ],
     },
     metaFields: ['_index', '_type', '_score', '_id'],
-    flattenHit: jest.fn((hit) => {
-      const result = {} as Record<string, unknown>;
-      Object.keys(hit).forEach((key) => {
-        if (key !== 'fields') {
-          result[key] = hit[key];
-        } else {
-          Object.keys(hit.fields).forEach((field) => {
-            result[field] = hit.fields[field];
-          });
-        }
-      });
-      return result;
-    }),
-    formatHit: jest.fn((hit) => {
-      const result = {} as Record<string, unknown>;
-      Object.keys(hit).forEach((key) => {
-        if (key !== 'fields') {
-          result[key] = hit[key];
-        } else {
-          Object.keys(hit.fields).forEach((field) => {
-            result[field] = hit.fields[field];
-          });
-        }
-      });
-      return result;
-    }),
+    getFormatterForField: jest.fn(() => ({ convert: (value: unknown) => value })),
   } as unknown as IndexPattern;
 
   indexPatterneCommerce.fields.getByName = (name: string) => {
diff --git a/src/plugins/discover/public/application/components/table/table.tsx b/src/plugins/discover/public/application/components/table/table.tsx
index e64dbd10f7855..78a6d9ddd3237 100644
--- a/src/plugins/discover/public/application/components/table/table.tsx
+++ b/src/plugins/discover/public/application/components/table/table.tsx
@@ -20,6 +20,8 @@ import {
 } from '../../doc_views/doc_views_types';
 import { ACTIONS_COLUMN, MAIN_COLUMNS } from './table_columns';
 import { getFieldsToShow } from '../../helpers/get_fields_to_show';
+import { getIgnoredReason, IgnoredReason } from '../../helpers/get_ignored_reason';
+import { formatFieldValue } from '../../helpers/format_value';
 
 export interface DocViewerTableProps {
   columns?: string[];
@@ -46,6 +48,7 @@ export interface FieldRecord {
   };
   value: {
     formattedValue: string;
+    ignored?: IgnoredReason;
   };
 }
 
@@ -64,8 +67,6 @@ export const DocViewerTable = ({
     [indexPattern?.fields]
   );
 
-  const formattedHit = useMemo(() => indexPattern?.formatHit(hit, 'html'), [hit, indexPattern]);
-
   const tableColumns = useMemo(() => {
     return filter ? [ACTIONS_COLUMN, ...MAIN_COLUMNS] : MAIN_COLUMNS;
   }, [filter]);
@@ -96,7 +97,7 @@ export const DocViewerTable = ({
     return null;
   }
 
-  const flattened = flattenHit(hit, indexPattern, { source: true });
+  const flattened = flattenHit(hit, indexPattern, { source: true, includeIgnoredValues: true });
   const fieldsToShow = getFieldsToShow(Object.keys(flattened), indexPattern, showMultiFields);
 
   const items: FieldRecord[] = Object.keys(flattened)
@@ -115,6 +116,8 @@ export const DocViewerTable = ({
       const displayName = fieldMapping?.displayName ?? field;
       const fieldType = isNestedFieldParent(field, indexPattern) ? 'nested' : fieldMapping?.type;
 
+      const ignored = getIgnoredReason(fieldMapping ?? field, hit._ignored);
+
       return {
         action: {
           onToggleColumn,
@@ -130,7 +133,8 @@ export const DocViewerTable = ({
           scripted: Boolean(fieldMapping?.scripted),
         },
         value: {
-          formattedValue: formattedHit[field],
+          formattedValue: formatFieldValue(flattened[field], hit, indexPattern, fieldMapping),
+          ignored,
         },
       };
     });
diff --git a/src/plugins/discover/public/application/components/table/table_cell_actions.tsx b/src/plugins/discover/public/application/components/table/table_cell_actions.tsx
index 7f2f87e7c296c..e43a17448de2e 100644
--- a/src/plugins/discover/public/application/components/table/table_cell_actions.tsx
+++ b/src/plugins/discover/public/application/components/table/table_cell_actions.tsx
@@ -21,6 +21,7 @@ interface TableActionsProps {
   fieldMapping?: IndexPatternField;
   onFilter: DocViewFilterFn;
   onToggleColumn: (field: string) => void;
+  ignoredValue: boolean;
 }
 
 export const TableActions = ({
@@ -30,15 +31,16 @@ export const TableActions = ({
   flattenedField,
   onToggleColumn,
   onFilter,
+  ignoredValue,
 }: TableActionsProps) => {
   return (
     <div className="kbnDocViewer__buttons">
       <DocViewTableRowBtnFilterAdd
-        disabled={!fieldMapping || !fieldMapping.filterable}
+        disabled={!fieldMapping || !fieldMapping.filterable || ignoredValue}
         onClick={() => onFilter(fieldMapping, flattenedField, '+')}
       />
       <DocViewTableRowBtnFilterRemove
-        disabled={!fieldMapping || !fieldMapping.filterable}
+        disabled={!fieldMapping || !fieldMapping.filterable || ignoredValue}
         onClick={() => onFilter(fieldMapping, flattenedField, '-')}
       />
       <DocViewTableRowBtnToggleColumn
diff --git a/src/plugins/discover/public/application/components/table/table_cell_value.tsx b/src/plugins/discover/public/application/components/table/table_cell_value.tsx
index 22c84b23949e1..e006de1cd7aeb 100644
--- a/src/plugins/discover/public/application/components/table/table_cell_value.tsx
+++ b/src/plugins/discover/public/application/components/table/table_cell_value.tsx
@@ -6,19 +6,98 @@
  * Side Public License, v 1.
  */
 
+import { css } from '@emotion/react';
+import { EuiFlexGroup, EuiFlexItem, EuiIcon, EuiTextColor, EuiToolTip } from '@elastic/eui';
 import classNames from 'classnames';
 import React, { Fragment, useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { IgnoredReason } from '../../helpers/get_ignored_reason';
 import { FieldRecord } from './table';
 import { DocViewTableRowBtnCollapse } from './table_row_btn_collapse';
 
 const COLLAPSE_LINE_LENGTH = 350;
 
-type TableFieldValueProps = FieldRecord['value'] & Pick<FieldRecord['field'], 'field'>;
+interface IgnoreWarningProps {
+  reason: IgnoredReason;
+  rawValue: unknown;
+}
 
-export const TableFieldValue = ({ formattedValue, field }: TableFieldValueProps) => {
+const IgnoreWarning: React.FC<IgnoreWarningProps> = React.memo(({ rawValue, reason }) => {
+  const multiValue = Array.isArray(rawValue) && rawValue.length > 1;
+
+  const getToolTipContent = (): string => {
+    switch (reason) {
+      case IgnoredReason.IGNORE_ABOVE:
+        return multiValue
+          ? i18n.translate('discover.docView.table.ignored.multiAboveTooltip', {
+              defaultMessage: `One or more values in this field are too long and can't be searched or filtered.`,
+            })
+          : i18n.translate('discover.docView.table.ignored.singleAboveTooltip', {
+              defaultMessage: `The value in this field is too long and can't be searched or filtered.`,
+            });
+      case IgnoredReason.MALFORMED:
+        return multiValue
+          ? i18n.translate('discover.docView.table.ignored.multiMalformedTooltip', {
+              defaultMessage: `This field has one or more malformed values that can't be searched or filtered.`,
+            })
+          : i18n.translate('discover.docView.table.ignored.singleMalformedTooltip', {
+              defaultMessage: `The value in this field is malformed and can't be searched or filtered.`,
+            });
+      case IgnoredReason.UNKNOWN:
+        return multiValue
+          ? i18n.translate('discover.docView.table.ignored.multiUnknownTooltip', {
+              defaultMessage: `One or more values in this field were ignored by Elasticsearch and can't be searched or filtered.`,
+            })
+          : i18n.translate('discover.docView.table.ignored.singleUnknownTooltip', {
+              defaultMessage: `The value in this field was ignored by Elasticsearch and can't be searched or filtered.`,
+            });
+    }
+  };
+
+  return (
+    <EuiToolTip content={getToolTipContent()}>
+      <EuiFlexGroup
+        gutterSize="xs"
+        responsive={false}
+        alignItems="center"
+        css={css`
+          cursor: help;
+        `}
+      >
+        <EuiFlexItem grow={false}>
+          <EuiIcon type="alert" color="warning" />
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiTextColor color="warning">
+            {multiValue
+              ? i18n.translate('discover.docViews.table.ignored.multiValueLabel', {
+                  defaultMessage: 'Contains ignored values',
+                })
+              : i18n.translate('discover.docViews.table.ignored.singleValueLabel', {
+                  defaultMessage: 'Ignored value',
+                })}
+          </EuiTextColor>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiToolTip>
+  );
+});
+
+type TableFieldValueProps = Pick<FieldRecord['field'], 'field'> & {
+  formattedValue: FieldRecord['value']['formattedValue'];
+  rawValue: unknown;
+  ignoreReason?: IgnoredReason;
+};
+
+export const TableFieldValue = ({
+  formattedValue,
+  field,
+  rawValue,
+  ignoreReason,
+}: TableFieldValueProps) => {
   const [fieldOpen, setFieldOpen] = useState(false);
 
-  const value = String(formattedValue);
+  const value = String(rawValue);
   const isCollapsible = value.length > COLLAPSE_LINE_LENGTH;
   const isCollapsed = isCollapsible && !fieldOpen;
 
@@ -32,18 +111,26 @@ export const TableFieldValue = ({ formattedValue, field }: TableFieldValueProps)
 
   return (
     <Fragment>
-      {isCollapsible && (
-        <DocViewTableRowBtnCollapse onClick={onToggleCollapse} isCollapsed={isCollapsed} />
+      {(isCollapsible || ignoreReason) && (
+        <EuiFlexGroup gutterSize="s">
+          {isCollapsible && (
+            <EuiFlexItem grow={false}>
+              <DocViewTableRowBtnCollapse onClick={onToggleCollapse} isCollapsed={isCollapsed} />
+            </EuiFlexItem>
+          )}
+          {ignoreReason && (
+            <EuiFlexItem grow={false}>
+              <IgnoreWarning reason={ignoreReason} rawValue={rawValue} />
+            </EuiFlexItem>
+          )}
+        </EuiFlexGroup>
       )}
       <div
         className={valueClassName}
         data-test-subj={`tableDocViewRow-${field}-value`}
-        /*
-         * Justification for dangerouslySetInnerHTML:
-         * We just use values encoded by our field formatters
-         */
+        // Value returned from formatFieldValue is always sanitized
         // eslint-disable-next-line react/no-danger
-        dangerouslySetInnerHTML={{ __html: value }}
+        dangerouslySetInnerHTML={{ __html: formattedValue }}
       />
     </Fragment>
   );
diff --git a/src/plugins/discover/public/application/components/table/table_columns.tsx b/src/plugins/discover/public/application/components/table/table_columns.tsx
index 5bd92fe9166e9..5944f9bede646 100644
--- a/src/plugins/discover/public/application/components/table/table_columns.tsx
+++ b/src/plugins/discover/public/application/components/table/table_columns.tsx
@@ -31,7 +31,7 @@ export const ACTIONS_COLUMN: EuiBasicTableColumn<FieldRecord> = {
   ),
   render: (
     { flattenedField, isActive, onFilter, onToggleColumn }: FieldRecord['action'],
-    { field: { field, fieldMapping } }: FieldRecord
+    { field: { field, fieldMapping }, value: { ignored } }: FieldRecord
   ) => {
     return (
       <TableActions
@@ -41,6 +41,7 @@ export const ACTIONS_COLUMN: EuiBasicTableColumn<FieldRecord> = {
         flattenedField={flattenedField}
         onFilter={onFilter!}
         onToggleColumn={onToggleColumn}
+        ignoredValue={!!ignored}
       />
     );
   },
@@ -82,8 +83,18 @@ export const MAIN_COLUMNS: Array<EuiBasicTableColumn<FieldRecord>> = [
         </strong>
       </EuiText>
     ),
-    render: ({ formattedValue }: FieldRecord['value'], { field: { field } }: FieldRecord) => {
-      return <TableFieldValue field={field} formattedValue={formattedValue} />;
+    render: (
+      { formattedValue, ignored }: FieldRecord['value'],
+      { field: { field }, action: { flattenedField } }: FieldRecord
+    ) => {
+      return (
+        <TableFieldValue
+          field={field}
+          formattedValue={formattedValue}
+          rawValue={flattenedField}
+          ignoreReason={ignored}
+        />
+      );
     },
   },
 ];
diff --git a/src/plugins/discover/public/application/components/table/table_row_btn_filter_add.tsx b/src/plugins/discover/public/application/components/table/table_row_btn_filter_add.tsx
index 5fe1b4dc33342..de56d733442d6 100644
--- a/src/plugins/discover/public/application/components/table/table_row_btn_filter_add.tsx
+++ b/src/plugins/discover/public/application/components/table/table_row_btn_filter_add.tsx
@@ -20,7 +20,7 @@ export function DocViewTableRowBtnFilterAdd({ onClick, disabled = false }: Props
   const tooltipContent = disabled ? (
     <FormattedMessage
       id="discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip"
-      defaultMessage="Unindexed fields can not be searched"
+      defaultMessage="Unindexed fields or ignored values cannot be searched"
     />
   ) : (
     <FormattedMessage
diff --git a/src/plugins/discover/public/application/components/table/table_row_btn_filter_remove.tsx b/src/plugins/discover/public/application/components/table/table_row_btn_filter_remove.tsx
index 6dc1af968bba9..4a14c269901d4 100644
--- a/src/plugins/discover/public/application/components/table/table_row_btn_filter_remove.tsx
+++ b/src/plugins/discover/public/application/components/table/table_row_btn_filter_remove.tsx
@@ -20,7 +20,7 @@ export function DocViewTableRowBtnFilterRemove({ onClick, disabled = false }: Pr
   const tooltipContent = disabled ? (
     <FormattedMessage
       id="discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip"
-      defaultMessage="Unindexed fields can not be searched"
+      defaultMessage="Unindexed fields or ignored values cannot be searched"
     />
   ) : (
     <FormattedMessage
diff --git a/src/plugins/discover/public/application/helpers/format_hit.test.ts b/src/plugins/discover/public/application/helpers/format_hit.test.ts
new file mode 100644
index 0000000000000..2cb46f28dd397
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/format_hit.test.ts
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+import { indexPatternMock as dataViewMock } from '../../__mocks__/index_pattern';
+import { formatHit } from './format_hit';
+import { discoverServiceMock } from '../../__mocks__/services';
+import { MAX_DOC_FIELDS_DISPLAYED } from '../../../common';
+
+jest.mock('../../kibana_services', () => ({
+  getServices: () => jest.requireActual('../../__mocks__/services').discoverServiceMock,
+}));
+
+describe('formatHit', () => {
+  let hit: estypes.SearchHit;
+  beforeEach(() => {
+    hit = {
+      _id: '1',
+      _index: 'logs',
+      fields: {
+        message: ['foobar'],
+        extension: ['png'],
+        'object.value': [42, 13],
+        bytes: [123],
+      },
+    };
+    (dataViewMock.getFormatterForField as jest.Mock).mockReturnValue({
+      convert: (value: unknown) => `formatted:${value}`,
+    });
+  });
+
+  afterEach(() => {
+    (discoverServiceMock.uiSettings.get as jest.Mock).mockReset();
+  });
+
+  it('formats a document as expected', () => {
+    const formatted = formatHit(hit, dataViewMock, ['message', 'extension', 'object.value']);
+    expect(formatted).toEqual([
+      ['extension', 'formatted:png'],
+      ['message', 'formatted:foobar'],
+      ['object.value', 'formatted:42,13'],
+      ['_index', 'formatted:logs'],
+      ['_score', undefined],
+    ]);
+  });
+
+  it('orders highlighted fields first', () => {
+    const formatted = formatHit({ ...hit, highlight: { message: ['%%'] } }, dataViewMock, [
+      'message',
+      'extension',
+      'object.value',
+    ]);
+    expect(formatted.map(([fieldName]) => fieldName)).toEqual([
+      'message',
+      'extension',
+      'object.value',
+      '_index',
+      '_score',
+    ]);
+  });
+
+  it('only limits count of pairs based on advanced setting', () => {
+    (discoverServiceMock.uiSettings.get as jest.Mock).mockImplementation(
+      (key) => key === MAX_DOC_FIELDS_DISPLAYED && 2
+    );
+    const formatted = formatHit(hit, dataViewMock, ['message', 'extension', 'object.value']);
+    expect(formatted).toEqual([
+      ['extension', 'formatted:png'],
+      ['message', 'formatted:foobar'],
+    ]);
+  });
+
+  it('should not include fields not mentioned in fieldsToShow', () => {
+    const formatted = formatHit(hit, dataViewMock, ['message', 'object.value']);
+    expect(formatted).toEqual([
+      ['message', 'formatted:foobar'],
+      ['object.value', 'formatted:42,13'],
+      ['_index', 'formatted:logs'],
+      ['_score', undefined],
+    ]);
+  });
+
+  it('should filter fields based on their real name not displayName', () => {
+    const formatted = formatHit(hit, dataViewMock, ['bytes']);
+    expect(formatted).toEqual([
+      ['bytesDisplayName', 'formatted:123'],
+      ['_index', 'formatted:logs'],
+      ['_score', undefined],
+    ]);
+  });
+});
diff --git a/src/plugins/discover/public/application/helpers/format_hit.ts b/src/plugins/discover/public/application/helpers/format_hit.ts
new file mode 100644
index 0000000000000..3890973a3f3e4
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/format_hit.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+import { DataView, flattenHit } from '../../../../data/common';
+import { MAX_DOC_FIELDS_DISPLAYED } from '../../../common';
+import { getServices } from '../../kibana_services';
+import { formatFieldValue } from './format_value';
+
+const formattedHitCache = new WeakMap<estypes.SearchHit, FormattedHit>();
+
+type FormattedHit = Array<[fieldName: string, formattedValue: string]>;
+
+/**
+ * Returns a formatted document in form of key/value pairs of the fields name and a formatted value.
+ * The value returned in each pair is an HTML string which is safe to be applied to the DOM, since
+ * it's formatted using field formatters.
+ * @param hit The hit to format
+ * @param dataView The corresponding data view
+ * @param fieldsToShow A list of fields that should be included in the document summary.
+ */
+export function formatHit(
+  hit: estypes.SearchHit,
+  dataView: DataView,
+  fieldsToShow: string[]
+): FormattedHit {
+  const cached = formattedHitCache.get(hit);
+  if (cached) {
+    return cached;
+  }
+
+  const highlights = hit.highlight ?? {};
+  // Flatten the object using the flattenHit implementation we use across Discover for flattening documents.
+  const flattened = flattenHit(hit, dataView, { includeIgnoredValues: true, source: true });
+
+  const highlightPairs: Array<[fieldName: string, formattedValue: string]> = [];
+  const sourcePairs: Array<[fieldName: string, formattedValue: string]> = [];
+
+  // Add each flattened field into the corresponding array for highlighted or other fields,
+  // depending on whether the original hit had a highlight for it. That way we can later
+  // put highlighted fields first in the document summary.
+  Object.entries(flattened).forEach(([key, val]) => {
+    // Retrieve the (display) name of the fields, if it's a mapped field on the data view
+    const displayKey = dataView.fields.getByName(key)?.displayName;
+    const pairs = highlights[key] ? highlightPairs : sourcePairs;
+    // Format the raw value using the regular field formatters for that field
+    const formattedValue = formatFieldValue(val, hit, dataView, dataView.fields.getByName(key));
+    // If the field was a mapped field, we validate it against the fieldsToShow list, if not
+    // we always include it into the result.
+    if (displayKey) {
+      if (fieldsToShow.includes(key)) {
+        pairs.push([displayKey, formattedValue]);
+      }
+    } else {
+      pairs.push([key, formattedValue]);
+    }
+  });
+  const maxEntries = getServices().uiSettings.get<number>(MAX_DOC_FIELDS_DISPLAYED);
+  const formatted = [...highlightPairs, ...sourcePairs].slice(0, maxEntries);
+  formattedHitCache.set(hit, formatted);
+  return formatted;
+}
diff --git a/src/plugins/discover/public/application/helpers/format_value.test.ts b/src/plugins/discover/public/application/helpers/format_value.test.ts
new file mode 100644
index 0000000000000..76d95c08e4a19
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/format_value.test.ts
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { FieldFormat } from '../../../../field_formats/common';
+import { indexPatternMock } from '../../__mocks__/index_pattern';
+import { formatFieldValue } from './format_value';
+
+import { getServices } from '../../kibana_services';
+
+jest.mock('../../kibana_services', () => {
+  const services = {
+    fieldFormats: {
+      getDefaultInstance: jest.fn<FieldFormat, [string]>(
+        () => ({ convert: (value: unknown) => value } as FieldFormat)
+      ),
+    },
+  };
+  return { getServices: () => services };
+});
+
+const hit = {
+  _id: '1',
+  _index: 'index',
+  fields: {
+    message: 'foo',
+  },
+};
+
+describe('formatFieldValue', () => {
+  afterEach(() => {
+    (indexPatternMock.getFormatterForField as jest.Mock).mockReset();
+    (getServices().fieldFormats.getDefaultInstance as jest.Mock).mockReset();
+  });
+
+  it('should call correct fieldFormatter for field', () => {
+    const formatterForFieldMock = indexPatternMock.getFormatterForField as jest.Mock;
+    const convertMock = jest.fn((value: unknown) => `formatted:${value}`);
+    formatterForFieldMock.mockReturnValue({ convert: convertMock });
+    const field = indexPatternMock.fields.getByName('message');
+    expect(formatFieldValue('foo', hit, indexPatternMock, field)).toBe('formatted:foo');
+    expect(indexPatternMock.getFormatterForField).toHaveBeenCalledWith(field);
+    expect(convertMock).toHaveBeenCalledWith('foo', 'html', { field, hit });
+  });
+
+  it('should call default string formatter if no field specified', () => {
+    const convertMock = jest.fn((value: unknown) => `formatted:${value}`);
+    (getServices().fieldFormats.getDefaultInstance as jest.Mock).mockReturnValue({
+      convert: convertMock,
+    });
+    expect(formatFieldValue('foo', hit, indexPatternMock)).toBe('formatted:foo');
+    expect(getServices().fieldFormats.getDefaultInstance).toHaveBeenCalledWith('string');
+    expect(convertMock).toHaveBeenCalledWith('foo', 'html', { field: undefined, hit });
+  });
+
+  it('should call default string formatter if no indexPattern is specified', () => {
+    const convertMock = jest.fn((value: unknown) => `formatted:${value}`);
+    (getServices().fieldFormats.getDefaultInstance as jest.Mock).mockReturnValue({
+      convert: convertMock,
+    });
+    expect(formatFieldValue('foo', hit)).toBe('formatted:foo');
+    expect(getServices().fieldFormats.getDefaultInstance).toHaveBeenCalledWith('string');
+    expect(convertMock).toHaveBeenCalledWith('foo', 'html', { field: undefined, hit });
+  });
+});
diff --git a/src/plugins/discover/public/application/helpers/format_value.ts b/src/plugins/discover/public/application/helpers/format_value.ts
new file mode 100644
index 0000000000000..cc33276790372
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/format_value.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+import { DataView, DataViewField, KBN_FIELD_TYPES } from '../../../../data/common';
+import { getServices } from '../../kibana_services';
+
+/**
+ * Formats the value of a specific field using the appropriate field formatter if available
+ * or the default string field formatter otherwise.
+ *
+ * @param value The value to format
+ * @param hit The actual search hit (required to get highlight information from)
+ * @param dataView The data view if available
+ * @param field The field that value was from if available
+ * @returns An sanitized HTML string, that is safe to be applied via dangerouslySetInnerHTML
+ */
+export function formatFieldValue(
+  value: unknown,
+  hit: estypes.SearchHit,
+  dataView?: DataView,
+  field?: DataViewField
+): string {
+  if (!dataView || !field) {
+    // If either no field is available or no data view, we'll use the default
+    // string formatter to format that field.
+    return getServices()
+      .fieldFormats.getDefaultInstance(KBN_FIELD_TYPES.STRING)
+      .convert(value, 'html', { hit, field });
+  }
+
+  // If we have a data view and field we use that fields field formatter
+  return dataView.getFormatterForField(field).convert(value, 'html', { hit, field });
+}
diff --git a/src/plugins/discover/public/application/helpers/get_ignored_reason.test.ts b/src/plugins/discover/public/application/helpers/get_ignored_reason.test.ts
new file mode 100644
index 0000000000000..13632ca5ed901
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/get_ignored_reason.test.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { getIgnoredReason, IgnoredReason } from './get_ignored_reason';
+import { DataViewField, KBN_FIELD_TYPES } from '../../../../data/common';
+
+function field(params: Partial<DataViewField>): DataViewField {
+  return {
+    name: 'text',
+    type: 'keyword',
+    ...params,
+  } as unknown as DataViewField;
+}
+
+describe('getIgnoredReason', () => {
+  it('will correctly return undefined when no value was ignored', () => {
+    expect(getIgnoredReason(field({ name: 'foo' }), undefined)).toBeUndefined();
+    expect(getIgnoredReason(field({ name: 'foo' }), ['bar', 'baz'])).toBeUndefined();
+  });
+
+  it('will return UNKNOWN if the field passed in was only a name, and thus no type information is present', () => {
+    expect(getIgnoredReason('foo', ['foo'])).toBe(IgnoredReason.UNKNOWN);
+  });
+
+  it('will return IGNORE_ABOVE for string types', () => {
+    expect(getIgnoredReason(field({ name: 'foo', type: KBN_FIELD_TYPES.STRING }), ['foo'])).toBe(
+      IgnoredReason.IGNORE_ABOVE
+    );
+  });
+
+  // Each type that can have malformed values
+  [
+    KBN_FIELD_TYPES.DATE,
+    KBN_FIELD_TYPES.IP,
+    KBN_FIELD_TYPES.GEO_POINT,
+    KBN_FIELD_TYPES.GEO_SHAPE,
+    KBN_FIELD_TYPES.NUMBER,
+  ].forEach((type) => {
+    it(`will return MALFORMED for ${type} fields`, () => {
+      expect(getIgnoredReason(field({ name: 'foo', type }), ['foo'])).toBe(IgnoredReason.MALFORMED);
+    });
+  });
+
+  it('will return unknown reasons if it does not know what the reason was', () => {
+    expect(getIgnoredReason(field({ name: 'foo', type: 'range' }), ['foo'])).toBe(
+      IgnoredReason.UNKNOWN
+    );
+  });
+});
diff --git a/src/plugins/discover/public/application/helpers/get_ignored_reason.ts b/src/plugins/discover/public/application/helpers/get_ignored_reason.ts
new file mode 100644
index 0000000000000..4d2fb85bdb2c4
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/get_ignored_reason.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+import { DataViewField, KBN_FIELD_TYPES } from '../../../../data/common';
+
+export enum IgnoredReason {
+  IGNORE_ABOVE = 'ignore_above',
+  MALFORMED = 'malformed',
+  UNKNOWN = 'unknown',
+}
+
+/**
+ * Returns the reason why a specific field was ignored in the response.
+ * Will return undefined if the field had no ignored values in it.
+ * This implementation will make some assumptions based on specific types
+ * of ignored values can only happen with specific field types in Elasticsearch.
+ *
+ * @param field Either the data view field or the string name of it.
+ * @param ignoredFields The hit._ignored value of the hit to validate.
+ */
+export function getIgnoredReason(
+  field: DataViewField | string,
+  ignoredFields: estypes.SearchHit['_ignored']
+): IgnoredReason | undefined {
+  const fieldName = typeof field === 'string' ? field : field.name;
+  if (!ignoredFields?.includes(fieldName)) {
+    return undefined;
+  }
+
+  if (typeof field === 'string') {
+    return IgnoredReason.UNKNOWN;
+  }
+
+  switch (field.type) {
+    case KBN_FIELD_TYPES.STRING:
+      return IgnoredReason.IGNORE_ABOVE;
+    case KBN_FIELD_TYPES.NUMBER:
+    case KBN_FIELD_TYPES.DATE:
+    case KBN_FIELD_TYPES.GEO_POINT:
+    case KBN_FIELD_TYPES.GEO_SHAPE:
+    case KBN_FIELD_TYPES.IP:
+      return IgnoredReason.MALFORMED;
+    default:
+      return IgnoredReason.UNKNOWN;
+  }
+}
diff --git a/src/plugins/discover/public/build_services.ts b/src/plugins/discover/public/build_services.ts
index ab2484abee892..ac16b6b3cc2ba 100644
--- a/src/plugins/discover/public/build_services.ts
+++ b/src/plugins/discover/public/build_services.ts
@@ -36,6 +36,7 @@ import { KibanaLegacyStart } from '../../kibana_legacy/public';
 import { UrlForwardingStart } from '../../url_forwarding/public';
 import { NavigationPublicPluginStart } from '../../navigation/public';
 import { IndexPatternFieldEditorStart } from '../../index_pattern_field_editor/public';
+import { FieldFormatsStart } from '../../field_formats/public';
 
 import type { SpacesApi } from '../../../../x-pack/plugins/spaces/public';
 
@@ -49,6 +50,7 @@ export interface DiscoverServices {
   history: () => History;
   theme: ChartsPluginStart['theme'];
   filterManager: FilterManager;
+  fieldFormats: FieldFormatsStart;
   indexPatterns: IndexPatternsContract;
   inspector: InspectorPublicPluginStart;
   metadata: { branch: string };
@@ -82,6 +84,7 @@ export function buildServices(
     data: plugins.data,
     docLinks: core.docLinks,
     theme: plugins.charts.theme,
+    fieldFormats: plugins.fieldFormats,
     filterManager: plugins.data.query.filterManager,
     history: getHistory,
     indexPatterns: plugins.data.indexPatterns,
diff --git a/src/plugins/discover/public/plugin.tsx b/src/plugins/discover/public/plugin.tsx
index 39b73d4213721..eee4b8f599b94 100644
--- a/src/plugins/discover/public/plugin.tsx
+++ b/src/plugins/discover/public/plugin.tsx
@@ -62,6 +62,7 @@ import { IndexPatternFieldEditorStart } from '../../../plugins/index_pattern_fie
 import { DeferredSpinner } from './shared';
 import { ViewSavedSearchAction } from './application/embeddable/view_saved_search_action';
 import type { SpacesPluginStart } from '../../../../x-pack/plugins/spaces/public';
+import { FieldFormatsStart } from '../../field_formats/public';
 
 declare module '../../share/public' {
   export interface UrlGeneratorStateMapping {
@@ -185,6 +186,7 @@ export interface DiscoverStartPlugins {
   navigation: NavigationStart;
   charts: ChartsPluginStart;
   data: DataPublicPluginStart;
+  fieldFormats: FieldFormatsStart;
   share?: SharePluginStart;
   kibanaLegacy: KibanaLegacyStart;
   urlForwarding: UrlForwardingStart;
diff --git a/src/plugins/field_formats/common/converters/source.test.ts b/src/plugins/field_formats/common/converters/source.test.ts
index 298c93dac8c4e..6f9e96a136d0b 100644
--- a/src/plugins/field_formats/common/converters/source.test.ts
+++ b/src/plugins/field_formats/common/converters/source.test.ts
@@ -19,7 +19,7 @@ describe('Source Format', () => {
     convertHtml = source.getConverterFor(HTML_CONTEXT_TYPE) as HtmlContextTypeConvert;
   });
 
-  test('should use the text content type if a field is not passed', () => {
+  test('should render stringified object', () => {
     const hit = {
       foo: 'bar',
       number: 42,
@@ -27,23 +27,8 @@ describe('Source Format', () => {
       also: 'with "quotes" or \'single quotes\'',
     };
 
-    expect(convertHtml(hit)).toBe(
-      '{&quot;foo&quot;:&quot;bar&quot;,&quot;number&quot;:42,&quot;hello&quot;:&quot;&lt;h1&gt;World&lt;/h1&gt;&quot;,&quot;also&quot;:&quot;with \\&quot;quotes\\&quot; or &#39;single quotes&#39;&quot;}'
-    );
-  });
-
-  test('should render a description list if a field is passed', () => {
-    const hit = {
-      foo: 'bar',
-      number: 42,
-      hello: '<h1>World</h1>',
-      also: 'with "quotes" or \'single quotes\'',
-    };
-
-    expect(
-      convertHtml(hit, { field: 'field', indexPattern: { formatHit: (h: string) => h }, hit })
-    ).toMatchInlineSnapshot(
-      `"<dl class=\\"source truncate-by-height\\"><dt>foo:</dt><dd>bar</dd> <dt>number:</dt><dd>42</dd> <dt>hello:</dt><dd><h1>World</h1></dd> <dt>also:</dt><dd>with \\"quotes\\" or 'single quotes'</dd> </dl>"`
+    expect(convertHtml(hit, { field: 'field', hit })).toMatchInlineSnapshot(
+      `"{&quot;foo&quot;:&quot;bar&quot;,&quot;number&quot;:42,&quot;hello&quot;:&quot;&lt;h1&gt;World&lt;/h1&gt;&quot;,&quot;also&quot;:&quot;with \\\\&quot;quotes\\\\&quot; or &#39;single quotes&#39;&quot;}"`
     );
   });
 });
diff --git a/src/plugins/field_formats/common/converters/source.tsx b/src/plugins/field_formats/common/converters/source.tsx
index 1caffb5bfb9a8..f92027ec07451 100644
--- a/src/plugins/field_formats/common/converters/source.tsx
+++ b/src/plugins/field_formats/common/converters/source.tsx
@@ -7,33 +7,8 @@
  */
 
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
-import React, { Fragment } from 'react';
-import ReactDOM from 'react-dom/server';
-import { escape, keys } from 'lodash';
-import { shortenDottedString } from '../utils';
 import { FieldFormat } from '../field_format';
-import { TextContextTypeConvert, HtmlContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
-import { FORMATS_UI_SETTINGS } from '../constants/ui_settings';
-
-interface Props {
-  defPairs: Array<[string, string]>;
-}
-const TemplateComponent = ({ defPairs }: Props) => {
-  return (
-    <dl className={'source truncate-by-height'}>
-      {defPairs.map((pair, idx) => (
-        <Fragment key={idx}>
-          <dt
-            dangerouslySetInnerHTML={{ __html: `${escape(pair[0])}:` }} // eslint-disable-line react/no-danger
-          />
-          <dd
-            dangerouslySetInnerHTML={{ __html: `${pair[1]}` }} // eslint-disable-line react/no-danger
-          />{' '}
-        </Fragment>
-      ))}
-    </dl>
-  );
-};
+import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
 /** @public */
 export class SourceFormat extends FieldFormat {
@@ -42,32 +17,4 @@ export class SourceFormat extends FieldFormat {
   static fieldType = KBN_FIELD_TYPES._SOURCE;
 
   textConvert: TextContextTypeConvert = (value: string) => JSON.stringify(value);
-
-  htmlConvert: HtmlContextTypeConvert = (value: string, options = {}) => {
-    const { field, hit, indexPattern } = options;
-
-    if (!field) {
-      const converter = this.getConverterFor('text') as Function;
-
-      return escape(converter(value));
-    }
-
-    const highlights: Record<string, string[]> = (hit && hit.highlight) || {};
-    // TODO: remove index pattern dependency
-    const formatted = hit ? indexPattern!.formatHit(hit) : {};
-    const highlightPairs: Array<[string, string]> = [];
-    const sourcePairs: Array<[string, string]> = [];
-    const isShortDots = this.getConfig!(FORMATS_UI_SETTINGS.SHORT_DOTS_ENABLE);
-
-    keys(formatted).forEach((key) => {
-      const pairs = highlights[key] ? highlightPairs : sourcePairs;
-      const newField = isShortDots ? shortenDottedString(key) : key;
-      const val = formatted![key];
-      pairs.push([newField as string, val]);
-    }, []);
-
-    return ReactDOM.renderToStaticMarkup(
-      <TemplateComponent defPairs={highlightPairs.concat(sourcePairs)} />
-    );
-  };
 }
diff --git a/src/plugins/field_formats/common/types.ts b/src/plugins/field_formats/common/types.ts
index 00f9f5d707e89..6f0efebe389a1 100644
--- a/src/plugins/field_formats/common/types.ts
+++ b/src/plugins/field_formats/common/types.ts
@@ -17,10 +17,6 @@ export type FieldFormatsContentType = 'html' | 'text';
  */
 export interface HtmlContextTypeOptions {
   field?: { name: string };
-  // TODO: get rid of indexPattern dep completely
-  indexPattern?: {
-    formatHit: (hit: { highlight: Record<string, string[]> }) => Record<string, string>;
-  };
   hit?: { highlight: Record<string, string[]> };
 }
 
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
index 6c2989d54309d..77ad4fba1ab60 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
@@ -356,7 +356,7 @@ export class CsvGenerator {
 
         let table: Datatable | undefined;
         try {
-          table = tabifyDocs(results, index, { shallow: true });
+          table = tabifyDocs(results, index, { shallow: true, includeIgnoredValues: true });
         } catch (err) {
           this.logger.error(err);
         }
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index f0fd864e190f4..3685e6c0b8cfe 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -2428,7 +2428,6 @@
     "discover.docViews.table.toggleFieldDetails": "フィールド詳細を切り替える",
     "discover.docViews.table.unableToFilterForPresenceOfMetaFieldsTooltip": "メタフィールドの有無でフィルタリングできません",
     "discover.docViews.table.unableToFilterForPresenceOfScriptedFieldsTooltip": "スクリプトフィールドの有無でフィルタリングできません",
-    "discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip": "インデックスされていないフィールドは検索できません",
     "discover.embeddable.inspectorRequestDataTitle": "データ",
     "discover.embeddable.inspectorRequestDescription": "このリクエストはElasticsearchにクエリをかけ、検索データを取得します。",
     "discover.embeddable.search.displayName": "検索",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index d4d327499ddf2..3af347375946a 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -2453,7 +2453,6 @@
     "discover.docViews.table.toggleFieldDetails": "切换字段详细信息",
     "discover.docViews.table.unableToFilterForPresenceOfMetaFieldsTooltip": "无法筛选元数据字段是否存在",
     "discover.docViews.table.unableToFilterForPresenceOfScriptedFieldsTooltip": "无法筛选脚本字段是否存在",
-    "discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip": "无法搜索未索引字段",
     "discover.embeddable.inspectorRequestDataTitle": "数据",
     "discover.embeddable.inspectorRequestDescription": "此请求将查询 Elasticsearch 以获取搜索的数据。",
     "discover.embeddable.search.displayName": "搜索",

From 6e64940117458766d98d648cb6666c9f90e9b7dc Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 19 Oct 2021 13:27:10 -0400
Subject: [PATCH 36/36] [ML] Adding ability to change data view in advanced job
 wizard (#115191) (#115585)

* [ML] Adding ability to change data view in advanced job wizard

* updating translation ids

* type and text changes

* code clean up

* route id change

* text changes

* text change

* changing data view to index pattern

* adding api tests

* text updates

* removing first step

* renaming temp variable

* adding permission checks

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: James Gowdy <jgowdy@elastic.co>
---
 .../plugins/ml/common/types/job_validation.ts |  14 +
 .../plugins/ml/common/types/saved_objects.ts  |   2 +-
 .../contexts/kibana/use_navigate_to_path.ts   |   2 +-
 .../new_job/common/job_creator/job_creator.ts |   4 +
 .../common/job_creator/util/general.ts        |   8 +-
 .../json_editor_flyout/json_editor_flyout.tsx |   2 +-
 .../components/data_view/change_data_view.tsx | 326 ++++++++++++++++++
 .../data_view/change_data_view_button.tsx     |  36 ++
 .../components/data_view/description.tsx      |  32 ++
 .../components/data_view/index.ts             |   8 +
 .../components/datafeed_step/datafeed.tsx     |   2 +
 .../services/ml_api_service/index.ts          |  12 +-
 .../ml/server/models/job_validation/index.ts  |   4 +
 .../models/job_validation/job_validation.ts   |   6 +-
 .../validate_datafeed_preview.ts              |  29 +-
 x-pack/plugins/ml/server/routes/apidoc.json   |   2 +
 .../ml/server/routes/job_validation.ts        |  44 ++-
 .../routes/schemas/job_validation_schema.ts   |   7 +
 .../apis/ml/data_frame_analytics/delete.ts    |   4 +-
 .../datafeed_preview_validation.ts            | 175 ++++++++++
 .../apis/ml/job_validation/index.ts           |   1 +
 x-pack/test/functional/services/ml/api.ts     |  10 +-
 22 files changed, 711 insertions(+), 19 deletions(-)
 create mode 100644 x-pack/plugins/ml/common/types/job_validation.ts
 create mode 100644 x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx
 create mode 100644 x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view_button.tsx
 create mode 100644 x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/description.tsx
 create mode 100644 x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/index.ts
 create mode 100644 x-pack/test/api_integration/apis/ml/job_validation/datafeed_preview_validation.ts

diff --git a/x-pack/plugins/ml/common/types/job_validation.ts b/x-pack/plugins/ml/common/types/job_validation.ts
new file mode 100644
index 0000000000000..0c1db63ff3762
--- /dev/null
+++ b/x-pack/plugins/ml/common/types/job_validation.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ErrorType } from '../util/errors';
+
+export interface DatafeedValidationResponse {
+  valid: boolean;
+  documentsFound: boolean;
+  error?: ErrorType;
+}
diff --git a/x-pack/plugins/ml/common/types/saved_objects.ts b/x-pack/plugins/ml/common/types/saved_objects.ts
index 0e48800dd845d..e376fddbe6272 100644
--- a/x-pack/plugins/ml/common/types/saved_objects.ts
+++ b/x-pack/plugins/ml/common/types/saved_objects.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { ErrorType } from '../util/errors';
+import type { ErrorType } from '../util/errors';
 export type JobType = 'anomaly-detector' | 'data-frame-analytics';
 export const ML_SAVED_OBJECT_TYPE = 'ml-job';
 export const ML_MODULE_SAVED_OBJECT_TYPE = 'ml-module';
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts b/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
index 951d9d6dfded9..00050803b97c6 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/use_navigate_to_path.ts
@@ -23,7 +23,7 @@ export const useNavigateToPath = () => {
   const location = useLocation();
 
   return useCallback(
-    async (path: string | undefined, preserveSearch = false) => {
+    async (path: string | undefined, preserveSearch: boolean = false) => {
       if (path === undefined) return;
       const modifiedPath = `${path}${preserveSearch === true ? location.search : ''}`;
       /**
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
index a44b4bdef60c4..607a4fcf9a73c 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
@@ -502,6 +502,10 @@ export class JobCreator {
     return this._datafeed_config.indices;
   }
 
+  public set indices(indics: string[]) {
+    this._datafeed_config.indices = indics;
+  }
+
   public get scriptFields(): Field[] {
     return this._scriptFields;
   }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
index 78903e64686f5..46315ac3b02d8 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
@@ -258,17 +258,21 @@ export function convertToMultiMetricJob(
   jobCreator.createdBy = CREATED_BY_LABEL.MULTI_METRIC;
   jobCreator.modelPlot = false;
   stashJobForCloning(jobCreator, true, true);
-
   navigateToPath(`jobs/new_job/${JOB_TYPE.MULTI_METRIC}`, true);
 }
 
 export function convertToAdvancedJob(jobCreator: JobCreatorType, navigateToPath: NavigateToPath) {
   jobCreator.createdBy = null;
   stashJobForCloning(jobCreator, true, true);
-
   navigateToPath(`jobs/new_job/${JOB_TYPE.ADVANCED}`, true);
 }
 
+export function resetAdvancedJob(jobCreator: JobCreatorType, navigateToPath: NavigateToPath) {
+  jobCreator.createdBy = null;
+  stashJobForCloning(jobCreator, true, false);
+  navigateToPath('/jobs/new_job');
+}
+
 export function resetJob(jobCreator: JobCreatorType, navigateToPath: NavigateToPath) {
   jobCreator.jobId = '';
   stashJobForCloning(jobCreator, true, true);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/common/json_editor_flyout/json_editor_flyout.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/common/json_editor_flyout/json_editor_flyout.tsx
index ce71cd80e45c0..9e5d1ac5eef6f 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/common/json_editor_flyout/json_editor_flyout.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/common/json_editor_flyout/json_editor_flyout.tsx
@@ -204,7 +204,7 @@ export const JsonEditorFlyout: FC<Props> = ({ isDisabled, jobEditorMode, datafee
                 >
                   <FormattedMessage
                     id="xpack.ml.newJob.wizard.jsonFlyout.indicesChange.calloutText"
-                    defaultMessage="It is not possible to alter the indices being used by the datafeed here. If you wish to select a different index pattern or saved search, please start the job creation again, selecting a different index pattern."
+                    defaultMessage="You cannot alter the indices being used by the datafeed here. To select a different index pattern or saved search, go to step 1 of the wizard and select the Change index pattern option."
                   />
                 </EuiCallOut>
               </>
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx
new file mode 100644
index 0000000000000..c402ee4bf9799
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx
@@ -0,0 +1,326 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useState, useEffect, useCallback, useContext } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { i18n } from '@kbn/i18n';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiModal,
+  EuiButton,
+  EuiCallOut,
+  EuiSpacer,
+  EuiModalHeader,
+  EuiLoadingSpinner,
+  EuiModalHeaderTitle,
+  EuiModalBody,
+} from '@elastic/eui';
+
+import { JobCreatorContext } from '../../../job_creator_context';
+import { AdvancedJobCreator } from '../../../../../common/job_creator';
+import { resetAdvancedJob } from '../../../../../common/job_creator/util/general';
+import {
+  CombinedJob,
+  Datafeed,
+} from '../../../../../../../../../common/types/anomaly_detection_jobs';
+import { extractErrorMessage } from '../../../../../../../../../common/util/errors';
+import type { DatafeedValidationResponse } from '../../../../../../../../../common/types/job_validation';
+
+import { SavedObjectFinderUi } from '../../../../../../../../../../../../src/plugins/saved_objects/public';
+import {
+  useMlKibana,
+  useMlApiContext,
+  useNavigateToPath,
+} from '../../../../../../../contexts/kibana';
+
+const fixedPageSize: number = 8;
+
+enum STEP {
+  PICK_DATA_VIEW,
+  VALIDATE,
+}
+
+interface Props {
+  onClose: () => void;
+}
+
+export const ChangeDataViewModal: FC<Props> = ({ onClose }) => {
+  const {
+    services: {
+      savedObjects,
+      uiSettings,
+      data: { dataViews },
+    },
+  } = useMlKibana();
+  const navigateToPath = useNavigateToPath();
+  const { validateDatafeedPreview } = useMlApiContext();
+
+  const { jobCreator: jc } = useContext(JobCreatorContext);
+  const jobCreator = jc as AdvancedJobCreator;
+
+  const [validating, setValidating] = useState(false);
+  const [step, setStep] = useState(STEP.PICK_DATA_VIEW);
+
+  const [currentDataViewTitle, setCurrentDataViewTitle] = useState<string>('');
+  const [newDataViewTitle, setNewDataViewTitle] = useState<string>('');
+  const [validationResponse, setValidationResponse] = useState<DatafeedValidationResponse | null>(
+    null
+  );
+
+  useEffect(function initialPageLoad() {
+    setCurrentDataViewTitle(jobCreator.indexPatternTitle);
+  }, []);
+
+  useEffect(
+    function stepChange() {
+      if (step === STEP.PICK_DATA_VIEW) {
+        setValidationResponse(null);
+      }
+    },
+    [step]
+  );
+
+  function onDataViewSelected(dataViewId: string) {
+    if (validating === false) {
+      setStep(STEP.VALIDATE);
+      validate(dataViewId);
+    }
+  }
+
+  const validate = useCallback(
+    async (dataViewId: string) => {
+      setValidating(true);
+
+      const { title } = await dataViews.get(dataViewId);
+      setNewDataViewTitle(title);
+
+      const indices = title.split(',');
+      if (jobCreator.detectors.length) {
+        const datafeed: Datafeed = { ...jobCreator.datafeedConfig, indices };
+        const resp = await validateDatafeedPreview({
+          job: {
+            ...jobCreator.jobConfig,
+            datafeed_config: datafeed,
+          } as CombinedJob,
+        });
+        setValidationResponse(resp);
+      }
+      setValidating(false);
+    },
+    [dataViews, validateDatafeedPreview, jobCreator]
+  );
+
+  const applyDataView = useCallback(() => {
+    const newIndices = newDataViewTitle.split(',');
+    jobCreator.indices = newIndices;
+    resetAdvancedJob(jobCreator, navigateToPath);
+  }, [jobCreator, newDataViewTitle, navigateToPath]);
+
+  return (
+    <>
+      <EuiModal onClose={onClose} data-test-subj="mlJobMgmtImportJobsFlyout">
+        <EuiModalHeader>
+          <EuiModalHeaderTitle>
+            <FormattedMessage
+              id="xpack.ml.newJob.wizard.datafeedStep.dataView.step0.title"
+              defaultMessage="Change index pattern"
+            />
+          </EuiModalHeaderTitle>
+        </EuiModalHeader>
+
+        <EuiModalBody>
+          {step === STEP.PICK_DATA_VIEW && (
+            <>
+              <FormattedMessage
+                id="xpack.ml.newJob.wizard.datafeedStep.dataView.step1.title"
+                defaultMessage="Select new index pattern for the job"
+              />
+
+              <EuiSpacer size="s" />
+
+              <SavedObjectFinderUi
+                key="searchSavedObjectFinder"
+                onChoose={onDataViewSelected}
+                showFilter
+                noItemsMessage={i18n.translate(
+                  'xpack.ml.newJob.wizard.datafeedStep.dataView.step1.noMatchingError',
+                  {
+                    defaultMessage: 'No matching indices or saved searches found.',
+                  }
+                )}
+                savedObjectMetaData={[
+                  {
+                    type: 'index-pattern',
+                    getIconForSavedObject: () => 'indexPatternApp',
+                    name: i18n.translate(
+                      'xpack.ml.newJob.wizard.datafeedStep.dataView.step1.dataView',
+                      {
+                        defaultMessage: 'Index pattern',
+                      }
+                    ),
+                  },
+                ]}
+                fixedPageSize={fixedPageSize}
+                uiSettings={uiSettings}
+                savedObjects={savedObjects}
+              />
+            </>
+          )}
+          {step === STEP.VALIDATE && (
+            <>
+              <FormattedMessage
+                id="xpack.ml.newJob.wizard.datafeedStep.dataView.step2.title"
+                defaultMessage="Changing {dv1} for {dv2}"
+                values={{ dv1: currentDataViewTitle, dv2: newDataViewTitle }}
+              />
+
+              <EuiSpacer size="s" />
+
+              {validating === true ? (
+                <>
+                  <EuiLoadingSpinner />
+                  <FormattedMessage
+                    id="xpack.ml.newJob.wizard.datafeedStep.dataView.step2.validatingText"
+                    defaultMessage="Checking index pattern and job compatibility"
+                  />
+                </>
+              ) : (
+                <ValidationMessage
+                  validationResponse={validationResponse}
+                  dataViewTitle={newDataViewTitle}
+                />
+              )}
+
+              <EuiSpacer size="s" />
+
+              <EuiFlexGroup justifyContent="spaceBetween">
+                <EuiFlexItem grow={false}>
+                  <EuiButtonEmpty
+                    onClick={setStep.bind(null, STEP.PICK_DATA_VIEW)}
+                    isDisabled={validating}
+                    flush="left"
+                  >
+                    <FormattedMessage
+                      id="xpack.ml.newJob.wizard.datafeedStep.dataView.step2.backButton"
+                      defaultMessage="Back"
+                    />
+                  </EuiButtonEmpty>
+                </EuiFlexItem>
+                <EuiFlexItem grow={false}>
+                  <EuiButton
+                    onClick={() => applyDataView()}
+                    isDisabled={validating}
+                    data-test-subj="mlJobsImportButton"
+                  >
+                    <FormattedMessage
+                      id="xpack.ml.newJob.wizard.datafeedStep.dataView.step2.ApplyButton"
+                      defaultMessage="Apply"
+                    />
+                  </EuiButton>
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            </>
+          )}
+        </EuiModalBody>
+      </EuiModal>
+    </>
+  );
+};
+
+const ValidationMessage: FC<{
+  validationResponse: DatafeedValidationResponse | null;
+  dataViewTitle: string;
+}> = ({ validationResponse, dataViewTitle }) => {
+  if (validationResponse === null) {
+    return (
+      <EuiCallOut
+        title={i18n.translate(
+          'xpack.ml.newJob.wizard.datafeedStep.dataView.validation.noDetectors.title',
+          {
+            defaultMessage: 'Index pattern valid',
+          }
+        )}
+        color="primary"
+      >
+        <FormattedMessage
+          id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.noDetectors.message"
+          defaultMessage="No detectors have been configured; this index pattern can be applied to the job."
+        />
+      </EuiCallOut>
+    );
+  }
+  if (validationResponse.valid === true) {
+    if (validationResponse.documentsFound === true) {
+      return (
+        <EuiCallOut
+          title={i18n.translate(
+            'xpack.ml.newJob.wizard.datafeedStep.dataView.validation.valid.title',
+            {
+              defaultMessage: 'Index pattern valid',
+            }
+          )}
+          color="primary"
+        >
+          <FormattedMessage
+            id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.valid.message"
+            defaultMessage="This index pattern can be applied to this job."
+          />
+        </EuiCallOut>
+      );
+    } else {
+      return (
+        <EuiCallOut
+          title={i18n.translate(
+            'xpack.ml.newJob.wizard.datafeedStep.dataView.validation.possiblyInvalid.title',
+            {
+              defaultMessage: 'Index pattern possibly invalid',
+            }
+          )}
+          color="warning"
+        >
+          <FormattedMessage
+            id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.possiblyInvalid.message"
+            defaultMessage="This index pattern produced no results when previewing the datafeed. There may be no documents in {dataViewTitle}."
+            values={{ dataViewTitle }}
+          />
+        </EuiCallOut>
+      );
+    }
+  } else {
+    return (
+      <EuiCallOut
+        title={i18n.translate(
+          'xpack.ml.newJob.wizard.datafeedStep.dataView.validation.invalid.title',
+          {
+            defaultMessage: 'Index pattern invalid',
+          }
+        )}
+        color="danger"
+      >
+        <FormattedMessage
+          id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.invalid.message"
+          defaultMessage="This index pattern produced an error when attempting to preview the datafeed. The fields selected for this job might not exist in {dataViewTitle}."
+          values={{ dataViewTitle }}
+        />
+
+        <EuiSpacer size="s" />
+
+        <FormattedMessage
+          id="xpack.ml.newJob.wizard.datafeedStep.dataView.validation.invalid.reason"
+          defaultMessage="Reason:"
+        />
+
+        <EuiSpacer size="s" />
+
+        {validationResponse.error ? extractErrorMessage(validationResponse.error) : null}
+      </EuiCallOut>
+    );
+  }
+};
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view_button.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view_button.tsx
new file mode 100644
index 0000000000000..dc9af26236d8c
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view_button.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useState } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { EuiButtonEmpty } from '@elastic/eui';
+import { Description } from './description';
+import { ChangeDataViewModal } from './change_data_view';
+
+export const ChangeDataView: FC<{ isDisabled: boolean }> = ({ isDisabled }) => {
+  const [showFlyout, setShowFlyout] = useState(false);
+
+  return (
+    <>
+      {showFlyout && <ChangeDataViewModal onClose={setShowFlyout.bind(null, false)} />}
+
+      <Description>
+        <EuiButtonEmpty
+          onClick={setShowFlyout.bind(null, true)}
+          isDisabled={isDisabled}
+          data-test-subj="mlJobsImportButton"
+        >
+          <FormattedMessage
+            id="xpack.ml.newJob.wizard.datafeedStep.dataView.changeDataView.button"
+            defaultMessage="Change index pattern"
+          />
+        </EuiButtonEmpty>
+      </Description>
+    </>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/description.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/description.tsx
new file mode 100644
index 0000000000000..2632660738a58
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/description.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, FC } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiDescribedFormGroup, EuiFormRow } from '@elastic/eui';
+
+export const Description: FC = memo(({ children }) => {
+  const title = i18n.translate('xpack.ml.newJob.wizard.datafeedStep.dataView.title', {
+    defaultMessage: 'Index pattern',
+  });
+  return (
+    <EuiDescribedFormGroup
+      title={<h3>{title}</h3>}
+      description={
+        <FormattedMessage
+          id="xpack.ml.newJob.wizard.datafeedStep.dataView.description"
+          defaultMessage="The index pattern that is currently used for this job."
+        />
+      }
+    >
+      <EuiFormRow>
+        <>{children}</>
+      </EuiFormRow>
+    </EuiDescribedFormGroup>
+  );
+});
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/index.ts
new file mode 100644
index 0000000000000..ef7c451b4889c
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { ChangeDataView } from './change_data_view_button';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/datafeed.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/datafeed.tsx
index 77db2eb2419cd..47e488ab201ec 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/datafeed.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/datafeed.tsx
@@ -14,6 +14,7 @@ import { FrequencyInput } from './components/frequency';
 import { ScrollSizeInput } from './components/scroll_size';
 import { ResetQueryButton } from './components/reset_query';
 import { TimeField } from './components/time_field';
+import { ChangeDataView } from './components/data_view';
 import { WIZARD_STEPS, StepProps } from '../step_types';
 import { JobCreatorContext } from '../job_creator_context';
 import { JsonEditorFlyout, EDITOR_MODE } from '../common/json_editor_flyout';
@@ -46,6 +47,7 @@ export const DatafeedStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =
               <FrequencyInput />
               <ScrollSizeInput />
               <TimeField />
+              <ChangeDataView isDisabled={false} />
             </EuiFlexItem>
           </EuiFlexGroup>
           <ResetQueryButton />
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
index 883e5d499c3d4..720e54e386cbc 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
@@ -43,6 +43,7 @@ import type { FieldHistogramRequestConfig } from '../../datavisualizer/index_bas
 import type { DataRecognizerConfigResponse, Module } from '../../../../common/types/modules';
 import { getHttp } from '../../util/dependency_cache';
 import type { RuntimeMappings } from '../../../../common/types/fields';
+import type { DatafeedValidationResponse } from '../../../../common/types/job_validation';
 
 export interface MlInfoResponse {
   defaults: MlServerDefaults;
@@ -194,7 +195,7 @@ export function mlApiServicesProvider(httpService: HttpService) {
     },
 
     validateJob(payload: {
-      job: Job;
+      job: CombinedJob;
       duration: {
         start?: number;
         end?: number;
@@ -209,6 +210,15 @@ export function mlApiServicesProvider(httpService: HttpService) {
       });
     },
 
+    validateDatafeedPreview(payload: { job: CombinedJob }) {
+      const body = JSON.stringify(payload);
+      return httpService.http<DatafeedValidationResponse>({
+        path: `${basePath()}/validate/datafeed_preview`,
+        method: 'POST',
+        body,
+      });
+    },
+
     validateCardinality$(job: CombinedJob): Observable<CardinalityValidationResults> {
       const body = JSON.stringify(job);
       return httpService.http$({
diff --git a/x-pack/plugins/ml/server/models/job_validation/index.ts b/x-pack/plugins/ml/server/models/job_validation/index.ts
index 92d3e7d613efc..a527b9dcf3d4b 100644
--- a/x-pack/plugins/ml/server/models/job_validation/index.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/index.ts
@@ -7,3 +7,7 @@
 
 export { validateJob } from './job_validation';
 export { validateCardinality } from './validate_cardinality';
+export {
+  validateDatafeedPreviewWithMessages,
+  validateDatafeedPreview,
+} from './validate_datafeed_preview';
diff --git a/x-pack/plugins/ml/server/models/job_validation/job_validation.ts b/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
index 838f188455d44..4cd2d8a95ee79 100644
--- a/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/job_validation.ts
@@ -17,7 +17,7 @@ import { basicJobValidation, uniqWithIsEqual } from '../../../common/util/job_ut
 import { validateBucketSpan } from './validate_bucket_span';
 import { validateCardinality } from './validate_cardinality';
 import { validateInfluencers } from './validate_influencers';
-import { validateDatafeedPreview } from './validate_datafeed_preview';
+import { validateDatafeedPreviewWithMessages } from './validate_datafeed_preview';
 import { validateModelMemoryLimit } from './validate_model_memory_limit';
 import { validateTimeRange, isValidTimeField } from './validate_time_range';
 import { validateJobSchema } from '../../routes/schemas/job_validation_schema';
@@ -111,7 +111,9 @@ export async function validateJob(
         validationMessages.push({ id: 'missing_summary_count_field_name' });
       }
 
-      validationMessages.push(...(await validateDatafeedPreview(mlClient, authHeader, job)));
+      validationMessages.push(
+        ...(await validateDatafeedPreviewWithMessages(mlClient, authHeader, job))
+      );
     } else {
       validationMessages = basicValidation.messages;
       validationMessages.push({ id: 'skipped_extended_tests' });
diff --git a/x-pack/plugins/ml/server/models/job_validation/validate_datafeed_preview.ts b/x-pack/plugins/ml/server/models/job_validation/validate_datafeed_preview.ts
index 4ae94229a930b..0775de7ae0e13 100644
--- a/x-pack/plugins/ml/server/models/job_validation/validate_datafeed_preview.ts
+++ b/x-pack/plugins/ml/server/models/job_validation/validate_datafeed_preview.ts
@@ -9,12 +9,25 @@ import type { MlClient } from '../../lib/ml_client';
 import type { AuthorizationHeader } from '../../lib/request_authorization';
 import type { CombinedJob } from '../../../common/types/anomaly_detection_jobs';
 import type { JobValidationMessage } from '../../../common/constants/messages';
+import type { DatafeedValidationResponse } from '../../../common/types/job_validation';
 
-export async function validateDatafeedPreview(
+export async function validateDatafeedPreviewWithMessages(
   mlClient: MlClient,
   authHeader: AuthorizationHeader,
   job: CombinedJob
 ): Promise<JobValidationMessage[]> {
+  const { valid, documentsFound } = await validateDatafeedPreview(mlClient, authHeader, job);
+  if (valid) {
+    return documentsFound ? [] : [{ id: 'datafeed_preview_no_documents' }];
+  }
+  return [{ id: 'datafeed_preview_failed' }];
+}
+
+export async function validateDatafeedPreview(
+  mlClient: MlClient,
+  authHeader: AuthorizationHeader,
+  job: CombinedJob
+): Promise<DatafeedValidationResponse> {
   const { datafeed_config: datafeed, ...tempJob } = job;
   try {
     const { body } = (await mlClient.previewDatafeed(
@@ -28,11 +41,15 @@ export async function validateDatafeedPreview(
       // previewDatafeed response type is incorrect
     )) as unknown as { body: unknown[] };
 
-    if (Array.isArray(body) === false || body.length === 0) {
-      return [{ id: 'datafeed_preview_no_documents' }];
-    }
-    return [];
+    return {
+      valid: true,
+      documentsFound: Array.isArray(body) && body.length > 0,
+    };
   } catch (error) {
-    return [{ id: 'datafeed_preview_failed' }];
+    return {
+      valid: false,
+      documentsFound: false,
+      error: error.body ?? error,
+    };
   }
 }
diff --git a/x-pack/plugins/ml/server/routes/apidoc.json b/x-pack/plugins/ml/server/routes/apidoc.json
index 7f53ebb92b68a..226b69e06b48a 100644
--- a/x-pack/plugins/ml/server/routes/apidoc.json
+++ b/x-pack/plugins/ml/server/routes/apidoc.json
@@ -123,11 +123,13 @@
     "GetJobAuditMessages",
     "GetAllJobAuditMessages",
     "ClearJobAuditMessages",
+    
     "JobValidation",
     "EstimateBucketSpan",
     "CalculateModelMemoryLimit",
     "ValidateCardinality",
     "ValidateJob",
+    "ValidateDataFeedPreview",
 
     "DatafeedService",
     "CreateDatafeed",
diff --git a/x-pack/plugins/ml/server/routes/job_validation.ts b/x-pack/plugins/ml/server/routes/job_validation.ts
index b75eab20e7bc0..bceb59fa33fc6 100644
--- a/x-pack/plugins/ml/server/routes/job_validation.ts
+++ b/x-pack/plugins/ml/server/routes/job_validation.ts
@@ -16,12 +16,18 @@ import {
   modelMemoryLimitSchema,
   validateCardinalitySchema,
   validateJobSchema,
+  validateDatafeedPreviewSchema,
 } from './schemas/job_validation_schema';
 import { estimateBucketSpanFactory } from '../models/bucket_span_estimator';
 import { calculateModelMemoryLimitProvider } from '../models/calculate_model_memory_limit';
-import { validateJob, validateCardinality } from '../models/job_validation';
+import {
+  validateJob,
+  validateCardinality,
+  validateDatafeedPreview,
+} from '../models/job_validation';
 import { getAuthorizationHeader } from '../lib/request_authorization';
 import type { MlClient } from '../lib/ml_client';
+import { CombinedJob } from '../../common/types/anomaly_detection_jobs';
 
 type CalculateModelMemoryLimitPayload = TypeOf<typeof modelMemoryLimitSchema>;
 
@@ -205,4 +211,40 @@ export function jobValidationRoutes({ router, mlLicense, routeGuard }: RouteInit
       }
     })
   );
+
+  /**
+   * @apiGroup DataFeedPreviewValidation
+   *
+   * @api {post} /api/ml/validate/datafeed_preview Validates datafeed preview
+   * @apiName ValidateDataFeedPreview
+   * @apiDescription Validates that the datafeed preview runs successfully and produces results
+   *
+   * @apiSchema (body) validateDatafeedPreviewSchema
+   */
+  router.post(
+    {
+      path: '/api/ml/validate/datafeed_preview',
+      validate: {
+        body: validateDatafeedPreviewSchema,
+      },
+      options: {
+        tags: ['access:ml:canCreateJob'],
+      },
+    },
+    routeGuard.fullLicenseAPIGuard(async ({ client, mlClient, request, response }) => {
+      try {
+        const resp = await validateDatafeedPreview(
+          mlClient,
+          getAuthorizationHeader(request),
+          request.body.job as CombinedJob
+        );
+
+        return response.ok({
+          body: resp,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
 }
diff --git a/x-pack/plugins/ml/server/routes/schemas/job_validation_schema.ts b/x-pack/plugins/ml/server/routes/schemas/job_validation_schema.ts
index a83bbbff6cec9..a481713f67359 100644
--- a/x-pack/plugins/ml/server/routes/schemas/job_validation_schema.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/job_validation_schema.ts
@@ -60,6 +60,13 @@ export const validateJobSchema = schema.object({
   }),
 });
 
+export const validateDatafeedPreviewSchema = schema.object({
+  job: schema.object({
+    ...anomalyDetectionJobSchema,
+    datafeed_config: datafeedConfigSchema,
+  }),
+});
+
 export const validateCardinalitySchema = schema.object({
   ...anomalyDetectionJobSchema,
   datafeed_config: datafeedConfigSchema,
diff --git a/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts b/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
index 055b4b69ab7a6..e7ea71863352e 100644
--- a/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
+++ b/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
@@ -130,7 +130,7 @@ export default ({ getService }: FtrProviderContext) => {
         const destinationIndex = generateDestinationIndex(analyticsId);
 
         before(async () => {
-          await ml.api.createIndices(destinationIndex);
+          await ml.api.createIndex(destinationIndex);
           await ml.api.assertIndicesExist(destinationIndex);
         });
 
@@ -189,7 +189,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         before(async () => {
           // Mimic real job by creating target index & index pattern after DFA job is created
-          await ml.api.createIndices(destinationIndex);
+          await ml.api.createIndex(destinationIndex);
           await ml.api.assertIndicesExist(destinationIndex);
           await ml.testResources.createIndexPatternIfNeeded(destinationIndex);
         });
diff --git a/x-pack/test/api_integration/apis/ml/job_validation/datafeed_preview_validation.ts b/x-pack/test/api_integration/apis/ml/job_validation/datafeed_preview_validation.ts
new file mode 100644
index 0000000000000..c16050e08c886
--- /dev/null
+++ b/x-pack/test/api_integration/apis/ml/job_validation/datafeed_preview_validation.ts
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { estypes } from '@elastic/elasticsearch';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { USER } from '../../../../functional/services/ml/security_common';
+import { COMMON_REQUEST_HEADERS } from '../../../../functional/services/ml/common_api';
+
+const farequoteMappings: estypes.MappingTypeMapping = {
+  properties: {
+    '@timestamp': {
+      type: 'date',
+    },
+    airline: {
+      type: 'keyword',
+    },
+    responsetime: {
+      type: 'float',
+    },
+  },
+};
+
+function getBaseJobConfig() {
+  return {
+    job_id: 'test',
+    description: '',
+    analysis_config: {
+      bucket_span: '15m',
+      detectors: [
+        {
+          function: 'mean',
+          field_name: 'responsetime',
+        },
+      ],
+      influencers: [],
+    },
+    analysis_limits: {
+      model_memory_limit: '11MB',
+    },
+    data_description: {
+      time_field: '@timestamp',
+      time_format: 'epoch_ms',
+    },
+    model_plot_config: {
+      enabled: false,
+      annotations_enabled: false,
+    },
+    model_snapshot_retention_days: 10,
+    daily_model_snapshot_retention_after_days: 1,
+    allow_lazy_open: false,
+    datafeed_config: {
+      query: {
+        bool: {
+          must: [
+            {
+              match_all: {},
+            },
+          ],
+        },
+      },
+      indices: ['ft_farequote'],
+      scroll_size: 1000,
+      delayed_data_check_config: {
+        enabled: true,
+      },
+      job_id: 'test',
+      datafeed_id: 'datafeed-test',
+    },
+  };
+}
+
+export default ({ getService }: FtrProviderContext) => {
+  const esArchiver = getService('esArchiver');
+  const supertest = getService('supertestWithoutAuth');
+  const ml = getService('ml');
+
+  describe('Validate datafeed preview', function () {
+    before(async () => {
+      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/ml/farequote');
+      await ml.testResources.setKibanaTimeZoneToUTC();
+      await ml.api.createIndex('farequote_empty', farequoteMappings);
+    });
+
+    after(async () => {
+      await ml.api.cleanMlIndices();
+      await ml.api.deleteIndices('farequote_empty');
+    });
+
+    it(`should validate a job with documents`, async () => {
+      const job = getBaseJobConfig();
+
+      const { body } = await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_POWERUSER, ml.securityCommon.getPasswordForUser(USER.ML_POWERUSER))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(200);
+
+      expect(body.valid).to.eql(true, `valid should be true, but got ${body.valid}`);
+      expect(body.documentsFound).to.eql(
+        true,
+        `documentsFound should be true, but got ${body.documentsFound}`
+      );
+    });
+
+    it(`should fail to validate a job with documents and non-existent field`, async () => {
+      const job = getBaseJobConfig();
+      job.analysis_config.detectors[0].field_name = 'no_such_field';
+
+      const { body } = await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_POWERUSER, ml.securityCommon.getPasswordForUser(USER.ML_POWERUSER))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(200);
+
+      expect(body.valid).to.eql(false, `valid should be false, but got ${body.valid}`);
+      expect(body.documentsFound).to.eql(
+        false,
+        `documentsFound should be false, but got ${body.documentsFound}`
+      );
+    });
+
+    it(`should validate a job with no documents`, async () => {
+      const job = getBaseJobConfig();
+      job.datafeed_config.indices = ['farequote_empty'];
+
+      const { body } = await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_POWERUSER, ml.securityCommon.getPasswordForUser(USER.ML_POWERUSER))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(200);
+
+      expect(body.valid).to.eql(true, `valid should be true, but got ${body.valid}`);
+      expect(body.documentsFound).to.eql(
+        false,
+        `documentsFound should be false, but got ${body.documentsFound}`
+      );
+    });
+
+    it(`should fail for viewer user`, async () => {
+      const job = getBaseJobConfig();
+
+      await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_VIEWER, ml.securityCommon.getPasswordForUser(USER.ML_VIEWER))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(403);
+    });
+
+    it(`should fail for unauthorized user`, async () => {
+      const job = getBaseJobConfig();
+
+      await supertest
+        .post('/api/ml/validate/datafeed_preview')
+        .auth(USER.ML_UNAUTHORIZED, ml.securityCommon.getPasswordForUser(USER.ML_UNAUTHORIZED))
+        .set(COMMON_REQUEST_HEADERS)
+        .send({ job })
+        .expect(403);
+    });
+  });
+};
diff --git a/x-pack/test/api_integration/apis/ml/job_validation/index.ts b/x-pack/test/api_integration/apis/ml/job_validation/index.ts
index 4b75102d7b0bf..be07ae3b1852a 100644
--- a/x-pack/test/api_integration/apis/ml/job_validation/index.ts
+++ b/x-pack/test/api_integration/apis/ml/job_validation/index.ts
@@ -13,5 +13,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./calculate_model_memory_limit'));
     loadTestFile(require.resolve('./cardinality'));
     loadTestFile(require.resolve('./validate'));
+    loadTestFile(require.resolve('./datafeed_preview_validation'));
   });
 }
diff --git a/x-pack/test/functional/services/ml/api.ts b/x-pack/test/functional/services/ml/api.ts
index abde3bf365384..6ffd95f213c41 100644
--- a/x-pack/test/functional/services/ml/api.ts
+++ b/x-pack/test/functional/services/ml/api.ts
@@ -126,14 +126,20 @@ export function MachineLearningAPIProvider({ getService }: FtrProviderContext) {
       );
     },
 
-    async createIndices(indices: string) {
+    async createIndex(
+      indices: string,
+      mappings?: Record<string, estypes.MappingTypeMapping> | estypes.MappingTypeMapping
+    ) {
       log.debug(`Creating indices: '${indices}'...`);
       if ((await es.indices.exists({ index: indices, allow_no_indices: false })).body === true) {
         log.debug(`Indices '${indices}' already exist. Nothing to create.`);
         return;
       }
 
-      const { body } = await es.indices.create({ index: indices });
+      const { body } = await es.indices.create({
+        index: indices,
+        ...(mappings ? { body: { mappings } } : {}),
+      });
       expect(body)
         .to.have.property('acknowledged')
         .eql(true, 'Response for create request indices should be acknowledged.');