diff --git a/docs/spaces/images/edit-space-feature-visibility.png b/docs/spaces/images/edit-space-feature-visibility.png
index f1852d3cc03b5..b6ee4740e1d20 100644
Binary files a/docs/spaces/images/edit-space-feature-visibility.png and b/docs/spaces/images/edit-space-feature-visibility.png differ
diff --git a/docs/spaces/images/edit-space.png b/docs/spaces/images/edit-space.png
index 9785dd9e77aba..97d7ec009ade4 100644
Binary files a/docs/spaces/images/edit-space.png and b/docs/spaces/images/edit-space.png differ
diff --git a/docs/spaces/images/spaces-roles.png b/docs/spaces/images/spaces-roles.png
index 031b319cfad3e..b9003a91092bf 100644
Binary files a/docs/spaces/images/spaces-roles.png and b/docs/spaces/images/spaces-roles.png differ
diff --git a/docs/spaces/index.asciidoc b/docs/spaces/index.asciidoc
index aeeb7b45ccd8a..6722503eb0323 100644
--- a/docs/spaces/index.asciidoc
+++ b/docs/spaces/index.asciidoc
@@ -8,29 +8,18 @@ the dashboards and saved objects that belong to that space.
 
 {kib} creates a default space for you.
 After you create your own
-spaces, you're asked to choose a space when you log in to Kibana. You can change your
+spaces, you're asked to choose a space when you log in to {kib}. You can change your
 current space at any time by using the menu.
 
 [role="screenshot"]
 image::images/change-space.png["Change current space menu"]
 
-Kibana supports spaces in several ways.  You can:
-
-[[spaces-getting-started]]
-
-* <<spaces-managing, View&comma; create&comma; and delete spaces>>
-* <<spaces-control-feature-visibility, Control feature access based on user needs>>
-* <<spaces-control-user-access, Control feature access based on user privileges>>
-* <<spaces-moving-objects, Move objects between spaces>>
-* <<spaces-default-route, Configure a Space-level landing page>>
-* <<spaces-delete-started, Disable the Spaces feature>>
-
 [float]
-==== Required permissions
+==== Required privileges
 
 The `kibana_admin` role or equivalent is required to manage **Spaces**.
 
-TIP: Looking to support multiple tenants? See <<xpack-security-multiple-tenants, the Security documentation>> for more information.
+TIP: Looking to support multiple tenants? Refer to <<xpack-security-multiple-tenants, the Security documentation>> for more information.
 
 [float]
 [[spaces-managing]]
@@ -71,14 +60,14 @@ You can't delete the default space, but you can customize it to your liking.
 === Control feature access based on user needs
 
 You have control over which features are visible in each space.
-For example, you might hide Dev Tools
-in your "Executive" space or show Stack Monitoring only in your "Admin" space.
+For example, you might hide *Dev Tools*
+in your "Executive" space or show *Stack Monitoring* only in your "Admin" space.
 You can define which features to show or hide when you add or edit a space.
 
 Controlling feature
 visibility is not a security feature. To secure access
 to specific features on a per-user basis, you must configure
-<<xpack-security-authorization, Kibana Security>>.
+<<xpack-security-authorization, {kib} Security>>.
 
 [role="screenshot"]
 image::images/edit-space-feature-visibility.png["Controlling features visiblity"]
@@ -87,12 +76,12 @@ image::images/edit-space-feature-visibility.png["Controlling features visiblity"
 [[spaces-control-user-access]]
 === Control feature access based on user privileges
 
-When using Kibana with security, you can configure applications and features
+When using {kib} with security, you can configure applications and features
 based on your users’ privileges. This means different roles can have access
 to different features in the same space.
 Power users might have privileges to create and edit visualizations and dashboards,
-while analysts or executives might have Dashboard and Canvas with read-only privileges.
-See <<adding_kibana_privileges>> for details.
+while analysts or executives might have read-only privileges for *Dashboard* and *Canvas*.
+Refer to <<adding_kibana_privileges>> for details.
 
 [role="screenshot"]
 image::images/spaces-roles.png["Controlling features visiblity"]
@@ -105,7 +94,7 @@ To move saved objects between spaces, you can <<managing-saved-objects-copy-to-s
 
 [float]
 [[spaces-default-route]]
-=== Configure a Space-level landing page
+=== Configure a space-level landing page
 
 You can create a custom experience for users by configuring the {kib} landing page on a per-space basis.
 The landing page can route users to a specific dashboard, application, or saved object as they enter each space.
@@ -123,9 +112,8 @@ image::images/spaces-configure-landing-page.png["Configure space-level landing p
 === Disable and version updates
 
 Spaces are automatically enabled in {kib}. If you don't want use this feature,
-you can disable it
-by setting `xpack.spaces.enabled` to `false` in your
-`kibana.yml` configuration file.
+you can disable it. For more information, refer to <<spaces-settings-kb,Spaces settings in {kib}>>.
+
+When you upgrade {kib}, the default space contains all of your existing saved objects.
+
 
-If you are upgrading your
-version of {kib}, the default space will contain all of your existing saved objects.
diff --git a/docs/user/dashboard/dashboard.asciidoc b/docs/user/dashboard/dashboard.asciidoc
index 6430c5d246dc6..1284c057af2da 100644
--- a/docs/user/dashboard/dashboard.asciidoc
+++ b/docs/user/dashboard/dashboard.asciidoc
@@ -283,37 +283,15 @@ To enable series interactions, refer to <<settings-explore-data-in-chart,`xpack.
 [[download-csv]]
 == Download panel data
 
-Download panel data in a CSV file. You can download most panels in a CSV file, but there is a shortcut available
-for *Lens* panels.
-
-[float]
-[role="xpack"]
-[[download-lens-data]]
-=== Download Lens data
-
-When you download *Lens* panel data, each layer produces a single CSV file with columns.
-When you download multiple layers, the file names combine the visualization and layer index names.
-
-. Open the *Lens* panel menu
-
-. Select *More > Download as CSV*.
-
-[float]
-[[download-other-panel-data]]
-=== Download all other panel data
-
-Download the data for non-*Lens* panels.  
+Download panel data in a CSV file. When you download visualization panels with multiple layers, each layer produces a CSV file, and the file names contain the visualization and layer index names.
 
 . Open the panel menu, then select *Inspect*.
 
-. Click *Download CSV*, then select the CSV type from the dropdown:
+. Click *Download CSV*, then select the format type from the dropdown:
 
 * *Formatted CSV* &mdash; Contains human-readable dates and numbers.
 
 * *Unformatted* &mdash; Best used for computer use.
-+
-[role="screenshot"]
-image:images/Dashboard_inspect.png[Inspect in dashboard]
 
 [float]
 [[defer-loading-panels-below-the-fold]]
diff --git a/docs/user/dashboard/lens.asciidoc b/docs/user/dashboard/lens.asciidoc
index 774b50caeba6a..6b61c9fe6a9a3 100644
--- a/docs/user/dashboard/lens.asciidoc
+++ b/docs/user/dashboard/lens.asciidoc
@@ -1,14 +1,18 @@
 [[lens]]
-=== Lens
+=== Create visualizations with Lens
+++++
+<titleabbrev>Lens</titleabbrev>
+++++
 
-To create visualization panels with *Lens*, you drag the data fields you want to visualize to the workspace, then *Lens* uses heuristics to apply each field and create a visualization for you. 
+To create a visualization, drag the data fields you want to visualize to the workspace, then *Lens* uses visualization best practices to apply the fields and create a visualization that best displays the data. 
 
 With *Lens*, you can:
 
-* Create area, line, and bar charts with multiple layers, indices, and visualization types.
-* Change the aggregation function and labels to customize the data.
+* Create area, line, and bar charts with layers to display multiple indices and chart types.
+* Change the aggregation function to change the data in the visualization.
 * Perform math on aggregations using *Formula*.
-* Use time shifts to compare data for two time intervals, such as month over month.
+* Use time shifts to compare the data in two time intervals, such as month over month.
+* Create custom tables.
 
 ++++
 <script type="text/javascript" async 
@@ -32,15 +36,23 @@ If you're unsure about the visualization type you want to use, or how you want t
 
 If you already know the visualization type you want to use, and how you want to display the data, use the following process:
 
-* *Choose the visualization type.* Open the *Chart type* dropdown, then select the visualization type before you drag any fields.  
-+
-To view more visualizations that *Lens* automatically created for the fields, click the *Suggestions*. If one of the *Suggestions* meets your visualization needs, click *Save and return* to add it to the dashboard.
+Choose the visualization type. 
 
-* *Choose the data you want to visualize.* Drag the fields directly to the layer pane. *Lens* automatically selects the aggregation function.
-+
-If you want to learn more about the data a field contains, click *i* next to the field.
+. Before you drag fields to the workspace, open the *Chart type* dropdown, then select the visualization type.  
+
+. To view more visualizations that *Lens* automatically created for the fields, click *Suggestions*. If one of the *Suggestions* meets your visualization needs, click *Save and return* to add it to the dashboard.
+
+Choose the data you want to visualize.
+
+. Drag the fields directly to the layer pane. *Lens* automatically selects the aggregation function.
 
-* *Edit and delete.* To change the *Quick function* and display options, click the field in the layer pane. To delete a field, close the configuration options, then click *X* next to the field.
+. If you want to learn more about the data a field contains, click the field.
+
+Edit and delete.
+
+. To change the aggregation *Quick function* and display options, click the field in the layer pane. 
+
+. To delete a field, close the configuration options, then click *X* next to the field.
 
 [float]
 [[change-the-fields]]
@@ -59,60 +71,11 @@ image:images/runtime-field-menu.png[Dropdown menu located next to index pattern
 +
 For more information about adding fields to index patterns and examples, refer to <<runtime-fields>>.
 
-[float]
-[[lens-formulas]]
-==== Use formulas to perform math
-
-Formulas allow you to perform math on aggregated data. The most common formulas divide two values to produce a percent.
-
-. In the layer pane, click a field.
-
-. Click *Formula*, then enter the formula. 
-+
-Filter ratio example:: Use `kql=''` to filter one set of documents, then compare the document set to other documents within the same grouping:
-+
-See how the error rate changes over time:
-+
-```
-count(kql='response.status_code > 400') / count()
-```
-+
-Week over week example:: Use `shift='1w'` to get the value of each grouping from the previous week. Time shift should not be used with the *Top values* function.
-+
-```
-percentile(system.network.in.bytes, percentile=99) /
-percentile(system.network.in.bytes, percentile=99, shift='1w')
-```
-+
-Percent of total example:: Formulas can calculate `overall_sum` for all the groupings,
-which lets you convert each grouping into a percent of total:
-+
-```
-sum(products.base_price) / overall_sum(sum(products.base_price))
-```
-TIP: For detailed information on formulas, click image:dashboard/images/formula_reference.png[Formula reference icon].
-
-. To accurately display the formula, select *Percent* from the *Value format* dropdown.
-
-[float]
-[[compare-data-with-time-offsets]]
-==== Compare differences over time
-
-Compare your real-time data set to the results that are offset by a time increment. For example, you can compare the real-time percentage of a user CPU time spent to the results offset by one hour. 
-
-. In the layer pane, click the field you want to offset.
-
-. From the *Add advanced options* dropdown, select *Time shift*.
-
-. Select the time offset increment. 
-
-For a time shift example, refer to <<compare-time-ranges>>.
-
 [float]
 [[create-custom-tables]]
 ==== Create custom tables
 
-*Lens* tables are highly customizable, and provide you with text alignment, value formatting, coloring options, and more.
+Tables are highly customizable, and provide you with text alignment, value formatting, coloring options, and more.
 
 . From the *Chart type* dropdown, select *Table*. 
 
@@ -167,35 +130,80 @@ image::images/lens_drag_drop_3.gif[Using drag and drop to reorder]
 . To confirm the action, press Space bar. To cancel, press Esc.
 
 [float]
-[[configure-the-visualization-components]]
-==== Configure the visualization components
+[[lens-formulas]]
+==== Use formulas to perform math
 
-Each visualiztion type comes with a set of components that you can configure, such as data labels, legend, axes, and more.
+Formulas allow you to perform math on aggregated data. The most common formulas divide two values to produce a percent.
 
-For example, to add data labels to bar and horizontal bar charts, use the *Values* menu.
+. In the layer pane, click a field.
 
-[role="screenshot"]
-image::images/lens_value_labels_xychart_toggle.png[Lens Bar chart value labels menu]
+. Click *Formula*, then enter the formula. 
++
+Filter ratio example:: To filter a document set, use `kql=''`, then compare to other documents within the same grouping:
++
+```
+count(kql='response.status_code > 400') / count()
+```
++
+Week over week example:: To get the value for each grouping from the previous week, use `shift='1w'`.
++
+```
+percentile(system.network.in.bytes, percentile=99) /
+percentile(system.network.in.bytes, percentile=99, shift='1w')
+```
+You are unable to combine different time shifts, such as `count(shift="1w") - count()` and `count(shift="1w") - count(shift="1m")`, with the *Top values* function.
++
+Percent of total example:: To convert each grouping into a percent of the total, formulas calculate `overall_sum` for all groupings:
++
+```
+sum(products.base_price) / overall_sum(sum(products.base_price))
+```
+TIP: For detailed information on formulas, click image:dashboard/images/formula_reference.png[Formula reference icon].
 
-To add data labels to pie charts, donut charts, or treemaps, use the *Labels* menu.
+. To accurately display the formula, select *Percent* from the *Value format* dropdown.
 
-[role="screenshot"]
-image::images/lens_value_labels_partition_toggle.png[Lens Pie chart value labels menu]
+[float]
+[[compare-data-with-time-offsets]]
+==== Compare differences over time
+
+Compare your real-time data set to the results that are offset by a time increment. For example, you can compare the real-time percentage of a user CPU time spent to the results offset by one hour. 
+
+. In the layer pane, click the field you want to offset.
+
+. From the *Add advanced options* dropdown, select *Time shift*.
+
+. Select the time offset increment. 
+
+For a time shift example, refer to <<compare-time-ranges>>.
 
 [float]
 [[filter-the-data]]
-==== Filter the data
+==== Apply filters with the legend
 
-Apply filters to visualizations directly from the values in the legend. Only *Bar*, *Line and area*, and *Proportion* visualizations support legend filters.
+Apply filters to visualizations directly from the values in the legend. *Bar*, *Line and area*, and *Proportion* visualizations support legend filters.
 
-. In the legend, click the field.
-
-. Choose one of the following options:
+In the legend, click the field, then choose one of the following options:
 
 * *Filter for value* &mdash; Applies a filter that displays only the field data in the visualization.
 
 * *Filter out value* &mdash; Applies a filter that removes the field data from the visualization.
 
+[float]
+[[configure-the-visualization-components]]
+==== Configure the visualization components
+
+Each visualiztion type comes with a set of components that you access from the editor toolbar.
+
+The following component menus are available:
+
+* *Visual options* &mdash; Specifies how to display area, line, and bar chart options. For example, you can specify how to display the labels in bar charts.
+
+* *Labels* &mdash; Specifies how to display the labels for donut charts, pie charts, and treemaps. 
+
+* *Legend* &mdash; Specifies how to display the legend. For example, you can display the legend inside the visualization and truncate the legend values.
+
+* *Left axis*, *Bottom axis*, and *Right axis* &mdash; Specify how you want to display the chart axes. For example, add axis labels and change the orientation and bounds.
+
 [float]
 [[lens-faq]]
 ==== Frequently asked questions
@@ -287,7 +295,7 @@ Use formulas to compare multiple {es} aggregations that can be filtered or shift
 
 [discrete]
 [[is-it-possible-to-have-more-than-one-Y-axis-scale]]
-.*Can I add more than one y-axis scale to a visualization?*
+.*Can I add more than one y-axis scale?*
 [%collapsible]
 ====
 For each y-axis, you can select *Left* and *Right*, and configure a different scale.
@@ -327,12 +335,12 @@ refer to <<explore-fields-in-your-data,Explore the fields in your data>>.
 .*Why is my field missing from the fields list?*
 [%collapsible]
 ====
-Fields do not appear in the *Available fields* in the following scenarios:
+The following field types do not appear in the *Available fields* list:
 
-* The field is a full-text field.
-* The field is a `geo_point` field
-* The field is a `flattened` field.
-* The field is a `object` field.
+* Full-text
+* geo_point
+* flattened
+* object
 
 Verify if the field appears in the *Empty fields* list. *Lens* uses heuristics to determine if the fields contain values. For sparse data sets, the heuristics are less precise.
 ====
diff --git a/src/core/server/saved_objects/service/lib/repository.test.js b/src/core/server/saved_objects/service/lib/repository.test.js
index 427c28ceb326c..0d7365c4b97c1 100644
--- a/src/core/server/saved_objects/service/lib/repository.test.js
+++ b/src/core/server/saved_objects/service/lib/repository.test.js
@@ -197,7 +197,16 @@ describe('SavedObjectsRepository', () => {
     { type, id, references, namespace: objectNamespace, originId },
     namespace
   ) => {
-    const namespaceId = objectNamespace === 'default' ? undefined : objectNamespace ?? namespace;
+    let namespaces;
+    if (objectNamespace) {
+      namespaces = [objectNamespace];
+    } else if (namespace) {
+      namespaces = Array.isArray(namespace) ? namespace : [namespace];
+    } else {
+      namespaces = ['default'];
+    }
+    const namespaceId = namespaces[0] === 'default' ? undefined : namespaces[0];
+
     return {
       // NOTE: Elasticsearch returns more fields (_index, _type) but the SavedObjectsRepository method ignores these
       found: true,
@@ -207,7 +216,7 @@ describe('SavedObjectsRepository', () => {
       ...mockVersionProps,
       _source: {
         ...(registry.isSingleNamespace(type) && { namespace: namespaceId }),
-        ...(registry.isMultiNamespace(type) && { namespaces: [namespaceId ?? 'default'] }),
+        ...(registry.isMultiNamespace(type) && { namespaces }),
         ...(originId && { originId }),
         type,
         [type]: { title: 'Testing' },
@@ -219,7 +228,9 @@ describe('SavedObjectsRepository', () => {
   };
 
   const getMockMgetResponse = (objects, namespace) => ({
-    docs: objects.map((obj) => (obj.found === false ? obj : getMockGetResponse(obj, namespace))),
+    docs: objects.map((obj) =>
+      obj.found === false ? obj : getMockGetResponse(obj, obj.initialNamespaces ?? namespace)
+    ),
   });
 
   expect.extend({
@@ -555,6 +566,25 @@ describe('SavedObjectsRepository', () => {
         await test(namespace);
       });
 
+      it(`normalizes initialNamespaces from 'default' to undefined`, async () => {
+        const test = async (namespace) => {
+          const objects = [{ ...obj1, type: 'dashboard', initialNamespaces: ['default'] }];
+          await bulkCreateSuccess(objects, { namespace, overwrite: true });
+          const body = [
+            { index: expect.objectContaining({ _id: `dashboard:${obj1.id}` }) },
+            expect.not.objectContaining({ namespace: 'default' }),
+          ];
+          expect(client.bulk).toHaveBeenCalledWith(
+            expect.objectContaining({ body }),
+            expect.anything()
+          );
+          client.bulk.mockClear();
+          client.mget.mockClear();
+        };
+        await test(undefined);
+        await test(namespace);
+      });
+
       it(`doesn't add namespaces to request body for any types that are not multi-namespace`, async () => {
         const test = async (namespace) => {
           const objects = [obj1, { ...obj2, type: NAMESPACE_AGNOSTIC_TYPE }];
@@ -778,6 +808,54 @@ describe('SavedObjectsRepository', () => {
         });
       });
 
+      it(`returns error when there is an unresolvable conflict with an existing multi-namespace saved object when using initialNamespaces (get)`, async () => {
+        const obj = {
+          ...obj3,
+          type: MULTI_NAMESPACE_TYPE,
+          initialNamespaces: ['foo-namespace', 'default'],
+        };
+        const response1 = {
+          status: 200,
+          docs: [
+            {
+              found: true,
+              _source: {
+                type: obj.type,
+                namespaces: ['bar-namespace'],
+              },
+            },
+          ],
+        };
+        client.mget.mockResolvedValueOnce(
+          elasticsearchClientMock.createSuccessTransportRequestPromise(response1)
+        );
+        const response2 = getMockBulkCreateResponse([obj1, obj2]);
+        client.bulk.mockResolvedValueOnce(
+          elasticsearchClientMock.createSuccessTransportRequestPromise(response2)
+        );
+
+        const options = { overwrite: true };
+        const result = await savedObjectsRepository.bulkCreate([obj1, obj, obj2], options);
+
+        expect(client.bulk).toHaveBeenCalled();
+        expect(client.mget).toHaveBeenCalled();
+
+        const body1 = { docs: [expect.objectContaining({ _id: `${obj.type}:${obj.id}` })] };
+        expect(client.mget).toHaveBeenCalledWith(
+          expect.objectContaining({ body: body1 }),
+          expect.anything()
+        );
+        const body2 = [...expectObjArgs(obj1), ...expectObjArgs(obj2)];
+        expect(client.bulk).toHaveBeenCalledWith(
+          expect.objectContaining({ body: body2 }),
+          expect.anything()
+        );
+        const expectedError = expectErrorConflict(obj, { metadata: { isNotOverwritable: true } });
+        expect(result).toEqual({
+          saved_objects: [expectSuccess(obj1), expectedError, expectSuccess(obj2)],
+        });
+      });
+
       it(`returns bulk error`, async () => {
         const expectedErrorResult = { type: obj3.type, id: obj3.id, error: 'Oh no, a bulk error!' };
         await bulkCreateError(obj3, true, expectedErrorResult);
@@ -2072,6 +2150,24 @@ describe('SavedObjectsRepository', () => {
         );
       });
 
+      it(`normalizes initialNamespaces from 'default' to undefined`, async () => {
+        await savedObjectsRepository.create('dashboard', attributes, {
+          id,
+          namespace,
+          initialNamespaces: ['default'],
+        });
+
+        expect(client.create).toHaveBeenCalledTimes(1);
+        expect(client.create).toHaveBeenNthCalledWith(
+          1,
+          expect.objectContaining({
+            id: `dashboard:${id}`,
+            body: expect.not.objectContaining({ namespace: 'default' }),
+          }),
+          expect.anything()
+        );
+      });
+
       it(`doesn't prepend namespace to the id or add namespace or namespaces fields when using namespace-agnostic type`, async () => {
         await createSuccess(NAMESPACE_AGNOSTIC_TYPE, attributes, { id, namespace });
         expect(client.create).toHaveBeenCalledWith(
@@ -2160,6 +2256,22 @@ describe('SavedObjectsRepository', () => {
         expect(client.get).toHaveBeenCalled();
       });
 
+      it(`throws when there is an unresolvable conflict with an existing multi-namespace saved object when using initialNamespaces (get)`, async () => {
+        const response = getMockGetResponse({ type: MULTI_NAMESPACE_ISOLATED_TYPE, id }, namespace);
+        client.get.mockResolvedValueOnce(
+          elasticsearchClientMock.createSuccessTransportRequestPromise(response)
+        );
+        await expect(
+          savedObjectsRepository.create(MULTI_NAMESPACE_TYPE, attributes, {
+            id,
+            overwrite: true,
+            initialNamespaces: ['bar-ns', 'dolly-ns'],
+            namespace,
+          })
+        ).rejects.toThrowError(createConflictError(MULTI_NAMESPACE_TYPE, id));
+        expect(client.get).toHaveBeenCalled();
+      });
+
       it.todo(`throws when automatic index creation fails`);
 
       it.todo(`throws when an unexpected failure occurs`);
diff --git a/src/core/server/saved_objects/service/lib/repository.ts b/src/core/server/saved_objects/service/lib/repository.ts
index 7ce3a55d057eb..e49b2e413981f 100644
--- a/src/core/server/saved_objects/service/lib/repository.ts
+++ b/src/core/server/saved_objects/service/lib/repository.ts
@@ -301,13 +301,19 @@ export class SavedObjectsRepository {
     let savedObjectNamespaces: string[] | undefined;
 
     if (this._registry.isSingleNamespace(type)) {
-      savedObjectNamespace = initialNamespaces ? initialNamespaces[0] : namespace;
+      savedObjectNamespace = initialNamespaces
+        ? normalizeNamespace(initialNamespaces[0])
+        : namespace;
     } else if (this._registry.isMultiNamespace(type)) {
       if (id && overwrite) {
         // we will overwrite a multi-namespace saved object if it exists; if that happens, ensure we preserve its included namespaces
         // note: this check throws an error if the object is found but does not exist in this namespace
-        const existingNamespaces = await this.preflightGetNamespaces(type, id, namespace);
-        savedObjectNamespaces = initialNamespaces || existingNamespaces;
+        savedObjectNamespaces = await this.preflightGetNamespaces(
+          type,
+          id,
+          namespace,
+          initialNamespaces
+        );
       } else {
         savedObjectNamespaces = initialNamespaces || getSavedObjectNamespaces(namespace);
       }
@@ -453,8 +459,14 @@ export class SavedObjectsRepository {
         const indexFound = bulkGetResponse?.statusCode !== 404;
         const actualResult = indexFound ? bulkGetResponse?.body.docs[esRequestIndex] : undefined;
         const docFound = indexFound && actualResult?.found === true;
-        // @ts-expect-error MultiGetHit._source is optional
-        if (docFound && !this.rawDocExistsInNamespace(actualResult!, namespace)) {
+        if (
+          docFound &&
+          !this.rawDocExistsInNamespaces(
+            // @ts-expect-error MultiGetHit._source is optional
+            actualResult!,
+            initialNamespaces ?? [SavedObjectsUtils.namespaceIdToString(namespace)]
+          )
+        ) {
           const { id, type } = object;
           return {
             tag: 'Left' as 'Left',
@@ -476,7 +488,9 @@ export class SavedObjectsRepository {
         versionProperties = getExpectedVersionProperties(version, actualResult);
       } else {
         if (this._registry.isSingleNamespace(object.type)) {
-          savedObjectNamespace = initialNamespaces ? initialNamespaces[0] : namespace;
+          savedObjectNamespace = initialNamespaces
+            ? normalizeNamespace(initialNamespaces[0])
+            : namespace;
         } else if (this._registry.isMultiNamespace(object.type)) {
           savedObjectNamespaces = initialNamespaces || getSavedObjectNamespaces(namespace);
         }
@@ -2136,12 +2150,18 @@ export class SavedObjectsRepository {
    * @param type The type of the saved object.
    * @param id The ID of the saved object.
    * @param namespace The target namespace.
+   * @param initialNamespaces The target namespace(s) we intend to create the object in, if specified.
    * @returns Array of namespaces that this saved object currently includes, or (if the object does not exist yet) the namespaces that a
    * newly-created object will include. Value may be undefined if an existing saved object has no namespaces attribute; this should not
    * happen in normal operations, but it is possible if the Elasticsearch document is manually modified.
    * @throws Will throw an error if the saved object exists and it does not include the target namespace.
    */
-  private async preflightGetNamespaces(type: string, id: string, namespace?: string) {
+  private async preflightGetNamespaces(
+    type: string,
+    id: string,
+    namespace: string | undefined,
+    initialNamespaces?: string[]
+  ) {
     if (!this._registry.isMultiNamespace(type)) {
       throw new Error(`Cannot make preflight get request for non-multi-namespace type '${type}'.`);
     }
@@ -2156,17 +2176,19 @@ export class SavedObjectsRepository {
       }
     );
 
+    const namespaces = initialNamespaces ?? [SavedObjectsUtils.namespaceIdToString(namespace)];
+
     const indexFound = statusCode !== 404;
     if (indexFound && isFoundGetResponse(body)) {
-      if (!this.rawDocExistsInNamespace(body, namespace)) {
+      if (!this.rawDocExistsInNamespaces(body, namespaces)) {
         throw SavedObjectsErrorHelpers.createConflictError(type, id);
       }
-      return getSavedObjectNamespaces(namespace, body);
+      return initialNamespaces ?? getSavedObjectNamespaces(namespace, body);
     } else if (isNotFoundFromUnsupportedServer({ statusCode, headers })) {
       // checking if the 404 is from Elasticsearch
       throw SavedObjectsErrorHelpers.createGenericNotFoundEsUnavailableError(type, id);
     }
-    return getSavedObjectNamespaces(namespace);
+    return initialNamespaces ?? getSavedObjectNamespaces(namespace);
   }
 
   /**
diff --git a/src/plugins/dashboard/public/application/hooks/use_dashboard_app_state.ts b/src/plugins/dashboard/public/application/hooks/use_dashboard_app_state.ts
index c01cd43b1f1e3..7bf390b0bee5a 100644
--- a/src/plugins/dashboard/public/application/hooks/use_dashboard_app_state.ts
+++ b/src/plugins/dashboard/public/application/hooks/use_dashboard_app_state.ts
@@ -35,7 +35,7 @@ import {
   syncDashboardFilterState,
   loadSavedDashboardState,
   buildDashboardContainer,
-  loadDashboardUrlState,
+  syncDashboardUrlState,
   diffDashboardState,
   areTimeRangesEqual,
 } from '../lib';
@@ -151,15 +151,20 @@ export const useDashboardAppState = ({
        * Combine initial state from the saved object, session storage, and URL, then dispatch it to Redux.
        */
       const dashboardSessionStorageState = dashboardSessionStorage.getState(savedDashboardId) || {};
-      const dashboardURLState = loadDashboardUrlState(dashboardBuildContext);
+
       const forwardedAppState = loadDashboardHistoryLocationState(
         scopedHistory()?.location?.state as undefined | DashboardAppLocatorParams
       );
 
+      const { initialDashboardStateFromUrl, stopWatchingAppStateInUrl } = syncDashboardUrlState({
+        ...dashboardBuildContext,
+        savedDashboard,
+      });
+
       const initialDashboardState = {
         ...savedDashboardState,
         ...dashboardSessionStorageState,
-        ...dashboardURLState,
+        ...initialDashboardStateFromUrl,
         ...forwardedAppState,
 
         // if there is an incoming embeddable, dashboard always needs to be in edit mode to receive it.
@@ -291,6 +296,7 @@ export const useDashboardAppState = ({
 
       onDestroy = () => {
         stopSyncingContainerInput();
+        stopWatchingAppStateInUrl();
         stopSyncingDashboardFilterState();
         lastSavedSubscription.unsubscribe();
         indexPatternsSubscription.unsubscribe();
diff --git a/src/plugins/dashboard/public/application/lib/index.ts b/src/plugins/dashboard/public/application/lib/index.ts
index 9aba481c3fb86..845cfcb096c51 100644
--- a/src/plugins/dashboard/public/application/lib/index.ts
+++ b/src/plugins/dashboard/public/application/lib/index.ts
@@ -12,7 +12,7 @@ export { saveDashboard } from './save_dashboard';
 export { migrateAppState } from './migrate_app_state';
 export { addHelpMenuToAppChrome } from './help_menu_util';
 export { getTagsFromSavedDashboard } from './dashboard_tagging';
-export { loadDashboardUrlState } from './load_dashboard_url_state';
+export { syncDashboardUrlState } from './sync_dashboard_url_state';
 export { DashboardSessionStorage } from './dashboard_session_storage';
 export { loadSavedDashboardState } from './load_saved_dashboard_state';
 export { attemptLoadDashboardByTitle } from './load_dashboard_by_title';
diff --git a/src/plugins/dashboard/public/application/lib/sync_dashboard_filter_state.ts b/src/plugins/dashboard/public/application/lib/sync_dashboard_filter_state.ts
index 2cfd7da6145ee..ea4ecf8dc7a3d 100644
--- a/src/plugins/dashboard/public/application/lib/sync_dashboard_filter_state.ts
+++ b/src/plugins/dashboard/public/application/lib/sync_dashboard_filter_state.ts
@@ -48,34 +48,13 @@ export const syncDashboardFilterState = ({
   const { filterManager, queryString, timefilter } = queryService;
   const { timefilter: timefilterService } = timefilter;
 
-  // apply initial filters to the query service and to the saved dashboard
-  filterManager.setAppFilters(_.cloneDeep(initialDashboardState.filters));
-  savedDashboard.searchSource.setField('filter', initialDashboardState.filters);
-
-  // apply initial query to the query service and to the saved dashboard
-  queryString.setQuery(initialDashboardState.query);
-  savedDashboard.searchSource.setField('query', initialDashboardState.query);
-
-  /**
-   * If a global time range is not set explicitly and the time range was saved with the dashboard, apply
-   * initial time range and refresh interval to the query service.
-   */
-  if (initialDashboardState.timeRestore) {
-    const initialGlobalQueryState = kbnUrlStateStorage.get<QueryState>('_g');
-    if (!initialGlobalQueryState?.time) {
-      if (savedDashboard.timeFrom && savedDashboard.timeTo) {
-        timefilterService.setTime({
-          from: savedDashboard.timeFrom,
-          to: savedDashboard.timeTo,
-        });
-      }
-    }
-    if (!initialGlobalQueryState?.refreshInterval) {
-      if (savedDashboard.refreshInterval) {
-        timefilterService.setRefreshInterval(savedDashboard.refreshInterval);
-      }
-    }
-  }
+  // apply initial dashboard filter state.
+  applyDashboardFilterState({
+    currentDashboardState: initialDashboardState,
+    kbnUrlStateStorage,
+    savedDashboard,
+    queryService,
+  });
 
   // this callback will be used any time new filters and query need to be applied.
   const applyFilters = (query: Query, filters: Filter[]) => {
@@ -155,3 +134,49 @@ export const syncDashboardFilterState = ({
 
   return { applyFilters, stopSyncingDashboardFilterState };
 };
+
+interface ApplyDashboardFilterStateProps {
+  kbnUrlStateStorage: DashboardBuildContext['kbnUrlStateStorage'];
+  queryService: DashboardBuildContext['query'];
+  currentDashboardState: DashboardState;
+  savedDashboard: DashboardSavedObject;
+}
+
+export const applyDashboardFilterState = ({
+  currentDashboardState,
+  kbnUrlStateStorage,
+  savedDashboard,
+  queryService,
+}: ApplyDashboardFilterStateProps) => {
+  const { filterManager, queryString, timefilter } = queryService;
+  const { timefilter: timefilterService } = timefilter;
+
+  // apply filters to the query service and to the saved dashboard
+  filterManager.setAppFilters(_.cloneDeep(currentDashboardState.filters));
+  savedDashboard.searchSource.setField('filter', currentDashboardState.filters);
+
+  // apply query to the query service and to the saved dashboard
+  queryString.setQuery(currentDashboardState.query);
+  savedDashboard.searchSource.setField('query', currentDashboardState.query);
+
+  /**
+   * If a global time range is not set explicitly and the time range was saved with the dashboard, apply
+   * time range and refresh interval to the query service.
+   */
+  if (currentDashboardState.timeRestore) {
+    const globalQueryState = kbnUrlStateStorage.get<QueryState>('_g');
+    if (!globalQueryState?.time) {
+      if (savedDashboard.timeFrom && savedDashboard.timeTo) {
+        timefilterService.setTime({
+          from: savedDashboard.timeFrom,
+          to: savedDashboard.timeTo,
+        });
+      }
+    }
+    if (!globalQueryState?.refreshInterval) {
+      if (savedDashboard.refreshInterval) {
+        timefilterService.setRefreshInterval(savedDashboard.refreshInterval);
+      }
+    }
+  }
+};
diff --git a/src/plugins/dashboard/public/application/lib/load_dashboard_url_state.ts b/src/plugins/dashboard/public/application/lib/sync_dashboard_url_state.ts
similarity index 52%
rename from src/plugins/dashboard/public/application/lib/load_dashboard_url_state.ts
rename to src/plugins/dashboard/public/application/lib/sync_dashboard_url_state.ts
index f76382c1fbbdd..00b8f8217e25f 100644
--- a/src/plugins/dashboard/public/application/lib/load_dashboard_url_state.ts
+++ b/src/plugins/dashboard/public/application/lib/sync_dashboard_url_state.ts
@@ -9,7 +9,11 @@
 import _ from 'lodash';
 
 import { migrateAppState } from '.';
+import { DashboardSavedObject } from '../..';
+import { setDashboardState } from '../state';
+import { migrateLegacyQuery } from './migrate_legacy_query';
 import { replaceUrlHashQuery } from '../../../../kibana_utils/public';
+import { applyDashboardFilterState } from './sync_dashboard_filter_state';
 import { DASHBOARD_STATE_STORAGE_KEY } from '../../dashboard_constants';
 import type {
   DashboardBuildContext,
@@ -17,17 +21,60 @@ import type {
   DashboardState,
   RawDashboardState,
 } from '../../types';
-import { migrateLegacyQuery } from './migrate_legacy_query';
 import { convertSavedPanelsToPanelMap } from './convert_saved_panels_to_panel_map';
 
+type SyncDashboardUrlStateProps = DashboardBuildContext & { savedDashboard: DashboardSavedObject };
+
+export const syncDashboardUrlState = ({
+  dispatchDashboardStateChange,
+  getLatestDashboardState,
+  query: queryService,
+  kbnUrlStateStorage,
+  usageCollection,
+  savedDashboard,
+  kibanaVersion,
+}: SyncDashboardUrlStateProps) => {
+  // load initial state before subscribing to avoid state removal triggering update.
+  const loadDashboardStateProps = { kbnUrlStateStorage, usageCollection, kibanaVersion };
+  const initialDashboardStateFromUrl = loadDashboardUrlState(loadDashboardStateProps);
+
+  const appStateSubscription = kbnUrlStateStorage
+    .change$(DASHBOARD_STATE_STORAGE_KEY)
+    .subscribe(() => {
+      const stateFromUrl = loadDashboardUrlState(loadDashboardStateProps);
+
+      const updatedDashboardState = { ...getLatestDashboardState(), ...stateFromUrl };
+      applyDashboardFilterState({
+        currentDashboardState: updatedDashboardState,
+        kbnUrlStateStorage,
+        queryService,
+        savedDashboard,
+      });
+
+      if (Object.keys(stateFromUrl).length === 0) return;
+      dispatchDashboardStateChange(setDashboardState(updatedDashboardState));
+    });
+
+  const stopWatchingAppStateInUrl = () => {
+    appStateSubscription.unsubscribe();
+  };
+  return { initialDashboardStateFromUrl, stopWatchingAppStateInUrl };
+};
+
+interface LoadDashboardUrlStateProps {
+  kibanaVersion: DashboardBuildContext['kibanaVersion'];
+  usageCollection: DashboardBuildContext['usageCollection'];
+  kbnUrlStateStorage: DashboardBuildContext['kbnUrlStateStorage'];
+}
+
 /**
  * Loads any dashboard state from the URL, and removes the state from the URL.
  */
-export const loadDashboardUrlState = ({
+const loadDashboardUrlState = ({
   kibanaVersion,
   usageCollection,
   kbnUrlStateStorage,
-}: DashboardBuildContext): Partial<DashboardState> => {
+}: LoadDashboardUrlStateProps): Partial<DashboardState> => {
   const rawAppStateInUrl = kbnUrlStateStorage.get<RawDashboardState>(DASHBOARD_STATE_STORAGE_KEY);
   if (!rawAppStateInUrl) return {};
 
diff --git a/test/functional/apps/dashboard/dashboard_back_button.ts b/test/functional/apps/dashboard/dashboard_back_button.ts
index 1e901cdbd48be..3b03ea525b903 100644
--- a/test/functional/apps/dashboard/dashboard_back_button.ts
+++ b/test/functional/apps/dashboard/dashboard_back_button.ts
@@ -14,12 +14,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
   const PageObjects = getPageObjects(['dashboard', 'header', 'common', 'visualize', 'timePicker']);
   const browser = getService('browser');
+  const security = getService('security');
 
   describe('dashboard back button', () => {
     before(async () => {
       await esArchiver.loadIfNeeded(
         'test/functional/fixtures/es_archiver/dashboard/current/kibana'
       );
+      await security.testUser.setRoles(['kibana_admin', 'animals', 'test_logstash_reader']);
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });
@@ -27,6 +29,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.dashboard.preserveCrossAppState();
     });
 
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     it('after navigation from listing page to dashboard back button works', async () => {
       await PageObjects.dashboard.gotoDashboardLandingPage();
       await PageObjects.dashboard.loadSavedDashboard('dashboard with everything');
diff --git a/test/functional/apps/dashboard/dashboard_filter_bar.ts b/test/functional/apps/dashboard/dashboard_filter_bar.ts
index e1a15009afe51..2f561f3220158 100644
--- a/test/functional/apps/dashboard/dashboard_filter_bar.ts
+++ b/test/functional/apps/dashboard/dashboard_filter_bar.ts
@@ -20,6 +20,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
   const browser = getService('browser');
+  const security = getService('security');
   const PageObjects = getPageObjects([
     'common',
     'dashboard',
@@ -32,12 +33,17 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   describe('dashboard filter bar', () => {
     before(async () => {
       await esArchiver.load('test/functional/fixtures/es_archiver/dashboard/current/kibana');
+      await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader', 'animals']);
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });
       await PageObjects.common.navigateToApp('dashboard');
     });
 
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     describe('Add a filter bar', function () {
       before(async () => {
         await PageObjects.dashboard.gotoDashboardLandingPage();
@@ -181,7 +187,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       it('are added when a cell magnifying glass is clicked', async function () {
         await dashboardAddPanel.addSavedSearch('Rendering-Test:-saved-search');
         await PageObjects.dashboard.waitForRenderComplete();
-        const isLegacyDefault = PageObjects.discover.useLegacyTable();
+        const isLegacyDefault = await PageObjects.discover.useLegacyTable();
         if (isLegacyDefault) {
           await testSubjects.click('docTableCellFilter');
         } else {
diff --git a/test/functional/apps/dashboard/dashboard_state.ts b/test/functional/apps/dashboard/dashboard_state.ts
index 1a9cf3b7593a0..cd51faa4be0b7 100644
--- a/test/functional/apps/dashboard/dashboard_state.ts
+++ b/test/functional/apps/dashboard/dashboard_state.ts
@@ -171,7 +171,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     };
 
     const hardRefresh = async (newUrl: string) => {
-      // We need to add a timestamp to the URL because URL changes now only work with a hard refresh.
+      // We add a timestamp here to force a hard refresh
       await browser.get(newUrl.toString());
       const alert = await browser.getAlert();
       await alert?.accept();
@@ -186,16 +186,23 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.timePicker.setHistoricalDataRange();
       });
 
-      it('for query parameter', async function () {
-        const currentQuery = await queryBar.getQueryString();
-        expect(currentQuery).to.equal('');
+      const changeQuery = async (useHardRefresh: boolean, newQuery: string) => {
+        await queryBar.clickQuerySubmitButton();
+        const oldQuery = await queryBar.getQueryString();
         const currentUrl = await getUrlFromShare();
-        const newUrl = currentUrl.replace(`query:''`, `query:'hi:hello'`);
+        const newUrl = currentUrl.replace(`query:'${oldQuery}'`, `query:'${newQuery}'`);
+
+        await browser.get(newUrl.toString(), !useHardRefresh);
+        const queryBarContentsAfterRefresh = await queryBar.getQueryString();
+        expect(queryBarContentsAfterRefresh).to.equal(newQuery);
+      };
+
+      it('for query parameter with soft refresh', async function () {
+        await changeQuery(false, 'hi:goodbye');
+      });
 
-        // We need to add a timestamp to the URL because URL changes now only work with a hard refresh.
-        await browser.get(newUrl.toString());
-        const newQuery = await queryBar.getQueryString();
-        expect(newQuery).to.equal('hi:hello');
+      it('for query parameter with hard refresh', async function () {
+        await changeQuery(true, 'hi:hello');
         await queryBar.clearQuery();
         await queryBar.clickQuerySubmitButton();
       });
diff --git a/test/functional/apps/dashboard/data_shared_attributes.ts b/test/functional/apps/dashboard/data_shared_attributes.ts
index 34fd4ddb346ed..4b993287ffe42 100644
--- a/test/functional/apps/dashboard/data_shared_attributes.ts
+++ b/test/functional/apps/dashboard/data_shared_attributes.ts
@@ -15,6 +15,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
   const dashboardPanelActions = getService('dashboardPanelActions');
+  const security = getService('security');
   const PageObjects = getPageObjects(['common', 'dashboard', 'timePicker']);
 
   describe('dashboard data-shared attributes', function describeIndexTests() {
@@ -22,6 +23,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     before(async () => {
       await esArchiver.load('test/functional/fixtures/es_archiver/dashboard/current/kibana');
+      await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader', 'animals']);
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });
@@ -31,6 +33,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.dashboard.waitForRenderComplete();
     });
 
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     it('should have time picker with data-shared-timefilter-duration', async () => {
       await retry.try(async () => {
         const sharedData = await PageObjects.timePicker.getTimeDurationForSharing();
diff --git a/test/functional/apps/dashboard/legacy_urls.ts b/test/functional/apps/dashboard/legacy_urls.ts
index 96c7a5aac3f4b..b449c0f6728a5 100644
--- a/test/functional/apps/dashboard/legacy_urls.ts
+++ b/test/functional/apps/dashboard/legacy_urls.ts
@@ -32,7 +32,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
   describe('legacy urls', function describeIndexTests() {
     before(async function () {
-      await security.testUser.setRoles(['kibana_admin', 'animals']);
+      await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader', 'animals']);
       await esArchiver.load('test/functional/fixtures/es_archiver/dashboard/current/kibana');
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.clickNewDashboard();
diff --git a/test/functional/apps/dashboard/view_edit.ts b/test/functional/apps/dashboard/view_edit.ts
index b29b07f9df4e4..f0ee5aad7a7cf 100644
--- a/test/functional/apps/dashboard/view_edit.ts
+++ b/test/functional/apps/dashboard/view_edit.ts
@@ -18,10 +18,12 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['dashboard', 'header', 'common', 'visualize', 'timePicker']);
   const dashboardName = 'dashboard with filter';
   const filterBar = getService('filterBar');
+  const security = getService('security');
 
   describe('dashboard view edit mode', function viewEditModeTests() {
     before(async () => {
       await esArchiver.load('test/functional/fixtures/es_archiver/dashboard/current/kibana');
+      await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader', 'animals']);
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });
@@ -29,6 +31,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.dashboard.preserveCrossAppState();
     });
 
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     it('create new dashboard opens in edit mode', async function () {
       await PageObjects.dashboard.gotoDashboardLandingPage();
       await PageObjects.dashboard.clickNewDashboard();
diff --git a/test/package/templates/kibana.yml b/test/package/templates/kibana.yml
index a5e44b7acb018..ac2d03467051b 100644
--- a/test/package/templates/kibana.yml
+++ b/test/package/templates/kibana.yml
@@ -3,3 +3,6 @@ server.host: 0.0.0.0
 elasticsearch.hosts: http://192.168.50.1:9200
 elasticsearch.username: "{{ elasticsearch_username }}"
 elasticsearch.password: "{{ elasticsearch_password }}"
+
+pid.file: /run/kibana/kibana.pid
+logging.dest: /var/log/kibana/kibana.log
\ No newline at end of file
diff --git a/x-pack/plugins/alerting/server/rules_client/rules_client.ts b/x-pack/plugins/alerting/server/rules_client/rules_client.ts
index 5a2a124f55abc..c3e21e02cdb7d 100644
--- a/x-pack/plugins/alerting/server/rules_client/rules_client.ts
+++ b/x-pack/plugins/alerting/server/rules_client/rules_client.ts
@@ -35,6 +35,9 @@ import {
   AlertNotifyWhenType,
   AlertTypeParams,
   ResolvedSanitizedRule,
+  AlertWithLegacyId,
+  SanitizedAlertWithLegacyId,
+  PartialAlertWithLegacyId,
 } from '../types';
 import {
   validateAlertTypeParams,
@@ -383,9 +386,11 @@ export class RulesClient {
 
   public async get<Params extends AlertTypeParams = never>({
     id,
+    includeLegacyId = false,
   }: {
     id: string;
-  }): Promise<SanitizedAlert<Params>> {
+    includeLegacyId?: boolean;
+  }): Promise<SanitizedAlert<Params> | SanitizedAlertWithLegacyId<Params>> {
     const result = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
     try {
       await this.authorization.ensureAuthorized({
@@ -414,7 +419,8 @@ export class RulesClient {
       result.id,
       result.attributes.alertTypeId,
       result.attributes,
-      result.references
+      result.references,
+      includeLegacyId
     );
   }
 
@@ -486,7 +492,8 @@ export class RulesClient {
     dateStart,
   }: GetAlertInstanceSummaryParams): Promise<AlertInstanceSummary> {
     this.logger.debug(`getAlertInstanceSummary(): getting alert ${id}`);
-    const alert = await this.get({ id });
+    const alert = (await this.get({ id, includeLegacyId: true })) as SanitizedAlertWithLegacyId;
+
     await this.authorization.ensureAuthorized({
       ruleTypeId: alert.alertTypeId,
       consumer: alert.consumer,
@@ -505,13 +512,18 @@ export class RulesClient {
     this.logger.debug(`getAlertInstanceSummary(): search the event log for alert ${id}`);
     let events: IEvent[];
     try {
-      const queryResults = await eventLogClient.findEventsBySavedObjectIds('alert', [id], {
-        page: 1,
-        per_page: 10000,
-        start: parsedDateStart.toISOString(),
-        end: dateNow.toISOString(),
-        sort_order: 'desc',
-      });
+      const queryResults = await eventLogClient.findEventsBySavedObjectIds(
+        'alert',
+        [id],
+        {
+          page: 1,
+          per_page: 10000,
+          start: parsedDateStart.toISOString(),
+          end: dateNow.toISOString(),
+          sort_order: 'desc',
+        },
+        alert.legacyId !== null ? [alert.legacyId] : undefined
+      );
       events = queryResults.data;
     } catch (err) {
       this.logger.debug(
@@ -1533,13 +1545,26 @@ export class RulesClient {
     id: string,
     ruleTypeId: string,
     rawAlert: RawAlert,
-    references: SavedObjectReference[] | undefined
-  ): Alert {
+    references: SavedObjectReference[] | undefined,
+    includeLegacyId: boolean = false
+  ): Alert | AlertWithLegacyId {
     const ruleType = this.ruleTypeRegistry.get(ruleTypeId);
     // In order to support the partial update API of Saved Objects we have to support
     // partial updates of an Alert, but when we receive an actual RawAlert, it is safe
     // to cast the result to an Alert
-    return this.getPartialAlertFromRaw<Params>(id, ruleType, rawAlert, references) as Alert;
+    const res = this.getPartialAlertFromRaw<Params>(
+      id,
+      ruleType,
+      rawAlert,
+      references,
+      includeLegacyId
+    );
+    // include to result because it is for internal rules client usage
+    if (includeLegacyId) {
+      return res as AlertWithLegacyId;
+    }
+    // exclude from result because it is an internal variable
+    return omit(res, ['legacyId']) as Alert;
   }
 
   private getPartialAlertFromRaw<Params extends AlertTypeParams>(
@@ -1550,17 +1575,18 @@ export class RulesClient {
       updatedAt,
       meta,
       notifyWhen,
+      legacyId,
       scheduledTaskId,
       params,
-      legacyId, // exclude from result because it is an internal variable
       executionStatus,
       schedule,
       actions,
       ...partialRawAlert
     }: Partial<RawAlert>,
-    references: SavedObjectReference[] | undefined
-  ): PartialAlert<Params> {
-    return {
+    references: SavedObjectReference[] | undefined,
+    includeLegacyId: boolean = false
+  ): PartialAlert<Params> | PartialAlertWithLegacyId<Params> {
+    const rule = {
       id,
       notifyWhen,
       ...partialRawAlert,
@@ -1576,6 +1602,9 @@ export class RulesClient {
         ? { executionStatus: alertExecutionStatusFromRaw(this.logger, id, executionStatus) }
         : {}),
     };
+    return includeLegacyId
+      ? ({ ...rule, legacyId } as PartialAlertWithLegacyId<Params>)
+      : (rule as PartialAlert<Params>);
   }
 
   private async validateActions(
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/get_alert_instance_summary.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/get_alert_instance_summary.test.ts
index f8414b08f191b..6b018fb342d99 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/get_alert_instance_summary.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/get_alert_instance_summary.test.ts
@@ -212,6 +212,7 @@ describe('getAlertInstanceSummary()', () => {
           "sort_order": "desc",
           "start": "2019-02-12T21:00:22.479Z",
         },
+        undefined,
       ]
     `);
     // calculate the expected start/end date for one test
@@ -225,6 +226,38 @@ describe('getAlertInstanceSummary()', () => {
     expect(endMillis - startMillis).toBeLessThan(expectedDuration + 2);
   });
 
+  test('calls event log client with legacy ids param', async () => {
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce(
+      getAlertInstanceSummarySavedObject({ legacyId: '99999' })
+    );
+    eventLogClient.findEventsBySavedObjectIds.mockResolvedValueOnce(
+      AlertInstanceSummaryFindEventsResult
+    );
+
+    await rulesClient.getAlertInstanceSummary({ id: '1' });
+
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
+    expect(eventLogClient.findEventsBySavedObjectIds).toHaveBeenCalledTimes(1);
+    expect(eventLogClient.findEventsBySavedObjectIds.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alert",
+        Array [
+          "1",
+        ],
+        Object {
+          "end": "2019-02-12T21:01:22.479Z",
+          "page": 1,
+          "per_page": 10000,
+          "sort_order": "desc",
+          "start": "2019-02-12T21:00:22.479Z",
+        },
+        Array [
+          "99999",
+        ],
+      ]
+    `);
+  });
+
   test('calls event log client with start date', async () => {
     unsecuredSavedObjectsClient.get.mockResolvedValueOnce(getAlertInstanceSummarySavedObject());
     eventLogClient.findEventsBySavedObjectIds.mockResolvedValueOnce(
diff --git a/x-pack/plugins/alerting/server/types.ts b/x-pack/plugins/alerting/server/types.ts
index 67565271fedc8..ba35890efd781 100644
--- a/x-pack/plugins/alerting/server/types.ts
+++ b/x-pack/plugins/alerting/server/types.ts
@@ -192,6 +192,21 @@ export interface RawAlertExecutionStatus extends SavedObjectAttributes {
 export type PartialAlert<Params extends AlertTypeParams = never> = Pick<Alert<Params>, 'id'> &
   Partial<Omit<Alert<Params>, 'id'>>;
 
+export interface AlertWithLegacyId<Params extends AlertTypeParams = never> extends Alert<Params> {
+  legacyId: string | null;
+}
+
+export type SanitizedAlertWithLegacyId<Params extends AlertTypeParams = never> = Omit<
+  AlertWithLegacyId<Params>,
+  'apiKey'
+>;
+
+export type PartialAlertWithLegacyId<Params extends AlertTypeParams = never> = Pick<
+  AlertWithLegacyId<Params>,
+  'id'
+> &
+  Partial<Omit<AlertWithLegacyId<Params>, 'id'>>;
+
 export interface RawAlert extends SavedObjectAttributes {
   enabled: boolean;
   name: string;
diff --git a/x-pack/plugins/discover_enhanced/common/index.ts b/x-pack/plugins/discover_enhanced/common/index.ts
index 4ac13918c7ed3..99afdb5f30c6b 100644
--- a/x-pack/plugins/discover_enhanced/common/index.ts
+++ b/x-pack/plugins/discover_enhanced/common/index.ts
@@ -5,7 +5,4 @@
  * 2.0.
  */
 
-// TODO: https://github.com/elastic/kibana/issues/110900
-/* eslint-disable @kbn/eslint/no_export_all */
-
-export * from './config';
+export type { Config } from './config';
diff --git a/x-pack/plugins/event_log/README.md b/x-pack/plugins/event_log/README.md
index 33c7fcabc9f46..f637187c1c180 100644
--- a/x-pack/plugins/event_log/README.md
+++ b/x-pack/plugins/event_log/README.md
@@ -271,6 +271,7 @@ Request Body:
 |Property|Description|Type|
 |---|---|---|
 |ids|The array ids of the saved object.|string array|
+|legacyIds|The array legacy ids of the saved object. This filter applies to the rules creted in Kibana versions before 8.0.0.|string array|
 
 Response body:
 
@@ -284,7 +285,8 @@ interface EventLogClient {
   findEventsBySavedObjectIds(
     type: string,
     ids: string[],
-    options?: Partial<FindOptionsType>
+    options?: Partial<FindOptionsType>,
+    legacyIds?: string[]
   ): Promise<QueryEventsBySavedObjectResult>;
 }
 
@@ -404,7 +406,8 @@ export interface IEventLogClient {
   findEventsBySavedObjectIds(
     type: string,
     ids: string[],
-    options?: Partial<FindOptionsType>
+    options?: Partial<FindOptionsType>,
+    legacyIds?: string[]
   ): Promise<QueryEventsBySavedObjectResult>;
 }
 ```
diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
index cd87bc8e6e18b..ef43b9081f9ec 100644
--- a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
+++ b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
@@ -338,16 +338,106 @@ describe('queryEventsBySavedObject', () => {
         },
       })
     );
-    await clusterClientAdapter.queryEventsBySavedObjects(
-      'index-name',
-      'namespace',
-      'saved-object-type',
-      ['saved-object-id'],
-      DEFAULT_OPTIONS
-    );
+    await clusterClientAdapter.queryEventsBySavedObjects({
+      index: 'index-name',
+      namespace: 'namespace',
+      type: 'saved-object-type',
+      ids: ['saved-object-id'],
+      findOptions: DEFAULT_OPTIONS,
+    });
 
     const [query] = clusterClient.search.mock.calls[0];
-    expect(query).toMatchInlineSnapshot(`
+    expect(query).toMatchInlineSnapshot(
+      {
+        body: {
+          from: 0,
+          query: {
+            bool: {
+              filter: [],
+              must: [
+                {
+                  nested: {
+                    path: 'kibana.saved_objects',
+                    query: {
+                      bool: {
+                        must: [
+                          {
+                            term: {
+                              'kibana.saved_objects.rel': {
+                                value: 'primary',
+                              },
+                            },
+                          },
+                          {
+                            term: {
+                              'kibana.saved_objects.type': {
+                                value: 'saved-object-type',
+                              },
+                            },
+                          },
+                          {
+                            term: {
+                              'kibana.saved_objects.namespace': {
+                                value: 'namespace',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  },
+                },
+                {
+                  bool: {
+                    should: [
+                      {
+                        bool: {
+                          must: [
+                            {
+                              nested: {
+                                path: 'kibana.saved_objects',
+                                query: {
+                                  bool: {
+                                    must: [
+                                      {
+                                        terms: {
+                                          'kibana.saved_objects.id': ['saved-object-id'],
+                                        },
+                                      },
+                                    ],
+                                  },
+                                },
+                              },
+                            },
+                            {
+                              range: {
+                                'kibana.version': {
+                                  gte: '8.0.0',
+                                },
+                              },
+                            },
+                          ],
+                        },
+                      },
+                    ],
+                  },
+                },
+              ],
+            },
+          },
+          size: 10,
+          sort: [
+            {
+              '@timestamp': {
+                order: 'asc',
+              },
+            },
+          ],
+        },
+        index: 'index-name',
+        track_total_hits: true,
+      },
+      `
       Object {
         "body": Object {
           "from": 0,
@@ -375,13 +465,6 @@ describe('queryEventsBySavedObject', () => {
                               },
                             },
                           },
-                          Object {
-                            "terms": Object {
-                              "kibana.saved_objects.id": Array [
-                                "saved-object-id",
-                              ],
-                            },
-                          },
                           Object {
                             "term": Object {
                               "kibana.saved_objects.namespace": Object {
@@ -394,6 +477,43 @@ describe('queryEventsBySavedObject', () => {
                     },
                   },
                 },
+                Object {
+                  "bool": Object {
+                    "should": Array [
+                      Object {
+                        "bool": Object {
+                          "must": Array [
+                            Object {
+                              "nested": Object {
+                                "path": "kibana.saved_objects",
+                                "query": Object {
+                                  "bool": Object {
+                                    "must": Array [
+                                      Object {
+                                        "terms": Object {
+                                          "kibana.saved_objects.id": Array [
+                                            "saved-object-id",
+                                          ],
+                                        },
+                                      },
+                                    ],
+                                  },
+                                },
+                              },
+                            },
+                            Object {
+                              "range": Object {
+                                "kibana.version": Object {
+                                  "gte": "8.0.0",
+                                },
+                              },
+                            },
+                          ],
+                        },
+                      },
+                    ],
+                  },
+                },
               ],
             },
           },
@@ -409,7 +529,8 @@ describe('queryEventsBySavedObject', () => {
         "index": "index-name",
         "track_total_hits": true,
       }
-    `);
+    `
+    );
   });
 
   test('should call cluster with proper arguments with default namespace', async () => {
@@ -429,80 +550,106 @@ describe('queryEventsBySavedObject', () => {
         },
       })
     );
-    await clusterClientAdapter.queryEventsBySavedObjects(
-      'index-name',
-      undefined,
-      'saved-object-type',
-      ['saved-object-id'],
-      DEFAULT_OPTIONS
-    );
+    await clusterClientAdapter.queryEventsBySavedObjects({
+      index: 'index-name',
+      namespace: undefined,
+      type: 'saved-object-type',
+      ids: ['saved-object-id'],
+      findOptions: DEFAULT_OPTIONS,
+    });
 
     const [query] = clusterClient.search.mock.calls[0];
-    expect(query).toMatchInlineSnapshot(`
-      Object {
-        "body": Object {
-          "from": 0,
-          "query": Object {
-            "bool": Object {
-              "filter": Array [],
-              "must": Array [
-                Object {
-                  "nested": Object {
-                    "path": "kibana.saved_objects",
-                    "query": Object {
-                      "bool": Object {
-                        "must": Array [
-                          Object {
-                            "term": Object {
-                              "kibana.saved_objects.rel": Object {
-                                "value": "primary",
-                              },
+    expect(query).toMatchObject({
+      body: {
+        from: 0,
+        query: {
+          bool: {
+            filter: [],
+            must: [
+              {
+                nested: {
+                  path: 'kibana.saved_objects',
+                  query: {
+                    bool: {
+                      must: [
+                        {
+                          term: {
+                            'kibana.saved_objects.rel': {
+                              value: 'primary',
                             },
                           },
-                          Object {
-                            "term": Object {
-                              "kibana.saved_objects.type": Object {
-                                "value": "saved-object-type",
-                              },
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.type': {
+                              value: 'saved-object-type',
                             },
                           },
-                          Object {
-                            "terms": Object {
-                              "kibana.saved_objects.id": Array [
-                                "saved-object-id",
-                              ],
+                        },
+                        {
+                          bool: {
+                            must_not: {
+                              exists: {
+                                field: 'kibana.saved_objects.namespace',
+                              },
                             },
                           },
-                          Object {
-                            "bool": Object {
-                              "must_not": Object {
-                                "exists": Object {
-                                  "field": "kibana.saved_objects.namespace",
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+              {
+                bool: {
+                  should: [
+                    {
+                      bool: {
+                        must: [
+                          {
+                            nested: {
+                              path: 'kibana.saved_objects',
+                              query: {
+                                bool: {
+                                  must: [
+                                    {
+                                      terms: {
+                                        'kibana.saved_objects.id': ['saved-object-id'],
+                                      },
+                                    },
+                                  ],
                                 },
                               },
                             },
                           },
+                          {
+                            range: {
+                              'kibana.version': {
+                                gte: '8.0.0',
+                              },
+                            },
+                          },
                         ],
                       },
                     },
-                  },
+                  ],
                 },
-              ],
-            },
-          },
-          "size": 10,
-          "sort": Array [
-            Object {
-              "@timestamp": Object {
-                "order": "asc",
               },
-            },
-          ],
+            ],
+          },
         },
-        "index": "index-name",
-        "track_total_hits": true,
-      }
-    `);
+        size: 10,
+        sort: [
+          {
+            '@timestamp': {
+              order: 'asc',
+            },
+          },
+        ],
+      },
+      index: 'index-name',
+      track_total_hits: true,
+    });
   });
 
   test('should call cluster with sort', async () => {
@@ -522,13 +669,13 @@ describe('queryEventsBySavedObject', () => {
         },
       })
     );
-    await clusterClientAdapter.queryEventsBySavedObjects(
-      'index-name',
-      'namespace',
-      'saved-object-type',
-      ['saved-object-id'],
-      { ...DEFAULT_OPTIONS, sort_field: 'event.end', sort_order: 'desc' }
-    );
+    await clusterClientAdapter.queryEventsBySavedObjects({
+      index: 'index-name',
+      namespace: 'namespace',
+      type: 'saved-object-type',
+      ids: ['saved-object-id'],
+      findOptions: { ...DEFAULT_OPTIONS, sort_field: 'event.end', sort_order: 'desc' },
+    });
 
     const [query] = clusterClient.search.mock.calls[0];
     expect(query).toMatchObject({
@@ -559,85 +706,111 @@ describe('queryEventsBySavedObject', () => {
 
     const start = '2020-07-08T00:52:28.350Z';
 
-    await clusterClientAdapter.queryEventsBySavedObjects(
-      'index-name',
-      'namespace',
-      'saved-object-type',
-      ['saved-object-id'],
-      { ...DEFAULT_OPTIONS, start }
-    );
+    await clusterClientAdapter.queryEventsBySavedObjects({
+      index: 'index-name',
+      namespace: 'namespace',
+      type: 'saved-object-type',
+      ids: ['saved-object-id'],
+      findOptions: { ...DEFAULT_OPTIONS, start },
+    });
 
     const [query] = clusterClient.search.mock.calls[0];
-    expect(query).toMatchInlineSnapshot(`
-      Object {
-        "body": Object {
-          "from": 0,
-          "query": Object {
-            "bool": Object {
-              "filter": Array [],
-              "must": Array [
-                Object {
-                  "nested": Object {
-                    "path": "kibana.saved_objects",
-                    "query": Object {
-                      "bool": Object {
-                        "must": Array [
-                          Object {
-                            "term": Object {
-                              "kibana.saved_objects.rel": Object {
-                                "value": "primary",
-                              },
+    expect(query).toMatchObject({
+      body: {
+        from: 0,
+        query: {
+          bool: {
+            filter: [],
+            must: [
+              {
+                nested: {
+                  path: 'kibana.saved_objects',
+                  query: {
+                    bool: {
+                      must: [
+                        {
+                          term: {
+                            'kibana.saved_objects.rel': {
+                              value: 'primary',
                             },
                           },
-                          Object {
-                            "term": Object {
-                              "kibana.saved_objects.type": Object {
-                                "value": "saved-object-type",
-                              },
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.type': {
+                              value: 'saved-object-type',
                             },
                           },
-                          Object {
-                            "terms": Object {
-                              "kibana.saved_objects.id": Array [
-                                "saved-object-id",
-                              ],
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.namespace': {
+                              value: 'namespace',
                             },
                           },
-                          Object {
-                            "term": Object {
-                              "kibana.saved_objects.namespace": Object {
-                                "value": "namespace",
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+              {
+                bool: {
+                  should: [
+                    {
+                      bool: {
+                        must: [
+                          {
+                            nested: {
+                              path: 'kibana.saved_objects',
+                              query: {
+                                bool: {
+                                  must: [
+                                    {
+                                      terms: {
+                                        'kibana.saved_objects.id': ['saved-object-id'],
+                                      },
+                                    },
+                                  ],
+                                },
+                              },
+                            },
+                          },
+                          {
+                            range: {
+                              'kibana.version': {
+                                gte: '8.0.0',
                               },
                             },
                           },
                         ],
                       },
                     },
-                  },
+                  ],
                 },
-                Object {
-                  "range": Object {
-                    "@timestamp": Object {
-                      "gte": "2020-07-08T00:52:28.350Z",
-                    },
+              },
+              {
+                range: {
+                  '@timestamp': {
+                    gte: '2020-07-08T00:52:28.350Z',
                   },
                 },
-              ],
-            },
-          },
-          "size": 10,
-          "sort": Array [
-            Object {
-              "@timestamp": Object {
-                "order": "asc",
               },
-            },
-          ],
+            ],
+          },
         },
-        "index": "index-name",
-        "track_total_hits": true,
-      }
-    `);
+        size: 10,
+        sort: [
+          {
+            '@timestamp': {
+              order: 'asc',
+            },
+          },
+        ],
+      },
+      index: 'index-name',
+      track_total_hits: true,
+    });
   });
 
   test('supports optional date range', async () => {
@@ -661,92 +834,163 @@ describe('queryEventsBySavedObject', () => {
     const start = '2020-07-08T00:52:28.350Z';
     const end = '2020-07-08T00:00:00.000Z';
 
-    await clusterClientAdapter.queryEventsBySavedObjects(
-      'index-name',
-      'namespace',
-      'saved-object-type',
-      ['saved-object-id'],
-      { ...DEFAULT_OPTIONS, start, end }
-    );
+    await clusterClientAdapter.queryEventsBySavedObjects({
+      index: 'index-name',
+      namespace: 'namespace',
+      type: 'saved-object-type',
+      ids: ['saved-object-id'],
+      findOptions: { ...DEFAULT_OPTIONS, start, end },
+      legacyIds: ['legacy-id'],
+    });
 
     const [query] = clusterClient.search.mock.calls[0];
-    expect(query).toMatchInlineSnapshot(`
-      Object {
-        "body": Object {
-          "from": 0,
-          "query": Object {
-            "bool": Object {
-              "filter": Array [],
-              "must": Array [
-                Object {
-                  "nested": Object {
-                    "path": "kibana.saved_objects",
-                    "query": Object {
-                      "bool": Object {
-                        "must": Array [
-                          Object {
-                            "term": Object {
-                              "kibana.saved_objects.rel": Object {
-                                "value": "primary",
-                              },
+    expect(query).toMatchObject({
+      body: {
+        from: 0,
+        query: {
+          bool: {
+            filter: [],
+            must: [
+              {
+                nested: {
+                  path: 'kibana.saved_objects',
+                  query: {
+                    bool: {
+                      must: [
+                        {
+                          term: {
+                            'kibana.saved_objects.rel': {
+                              value: 'primary',
                             },
                           },
-                          Object {
-                            "term": Object {
-                              "kibana.saved_objects.type": Object {
-                                "value": "saved-object-type",
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.type': {
+                              value: 'saved-object-type',
+                            },
+                          },
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.namespace': {
+                              value: 'namespace',
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+              {
+                bool: {
+                  should: [
+                    {
+                      bool: {
+                        must: [
+                          {
+                            nested: {
+                              path: 'kibana.saved_objects',
+                              query: {
+                                bool: {
+                                  must: [
+                                    {
+                                      terms: {
+                                        'kibana.saved_objects.id': ['saved-object-id'],
+                                      },
+                                    },
+                                  ],
+                                },
                               },
                             },
                           },
-                          Object {
-                            "terms": Object {
-                              "kibana.saved_objects.id": Array [
-                                "saved-object-id",
-                              ],
+                          {
+                            range: {
+                              'kibana.version': {
+                                gte: '8.0.0',
+                              },
                             },
                           },
-                          Object {
-                            "term": Object {
-                              "kibana.saved_objects.namespace": Object {
-                                "value": "namespace",
+                        ],
+                      },
+                    },
+                    {
+                      bool: {
+                        must: [
+                          {
+                            nested: {
+                              path: 'kibana.saved_objects',
+                              query: {
+                                bool: {
+                                  must: [
+                                    {
+                                      terms: {
+                                        'kibana.saved_objects.id': ['legacy-id'],
+                                      },
+                                    },
+                                  ],
+                                },
                               },
                             },
                           },
+                          {
+                            bool: {
+                              should: [
+                                {
+                                  range: {
+                                    'kibana.version': {
+                                      lt: '8.0.0',
+                                    },
+                                  },
+                                },
+                                {
+                                  bool: {
+                                    must_not: {
+                                      exists: {
+                                        field: 'kibana.version',
+                                      },
+                                    },
+                                  },
+                                },
+                              ],
+                            },
+                          },
                         ],
                       },
                     },
-                  },
+                  ],
                 },
-                Object {
-                  "range": Object {
-                    "@timestamp": Object {
-                      "gte": "2020-07-08T00:52:28.350Z",
-                    },
+              },
+              {
+                range: {
+                  '@timestamp': {
+                    gte: '2020-07-08T00:52:28.350Z',
                   },
                 },
-                Object {
-                  "range": Object {
-                    "@timestamp": Object {
-                      "lte": "2020-07-08T00:00:00.000Z",
-                    },
+              },
+              {
+                range: {
+                  '@timestamp': {
+                    lte: '2020-07-08T00:00:00.000Z',
                   },
                 },
-              ],
-            },
-          },
-          "size": 10,
-          "sort": Array [
-            Object {
-              "@timestamp": Object {
-                "order": "asc",
               },
-            },
-          ],
+            ],
+          },
         },
-        "index": "index-name",
-        "track_total_hits": true,
-      }
-    `);
+        size: 10,
+        sort: [
+          {
+            '@timestamp': {
+              order: 'asc',
+            },
+          },
+        ],
+      },
+      index: 'index-name',
+      track_total_hits: true,
+    });
   });
 });
 
diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
index a3a48c04370d8..47bd29cf4b08a 100644
--- a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
+++ b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
@@ -41,9 +41,20 @@ export interface QueryEventsBySavedObjectResult {
   data: IValidatedEvent[];
 }
 
+interface QueryOptionsEventsBySavedObjectFilter {
+  index: string;
+  namespace: string | undefined;
+  type: string;
+  ids: string[];
+  findOptions: FindOptionsType;
+  legacyIds?: string[];
+}
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 type AliasAny = any;
 
+const LEGACY_ID_CUTOFF_VERSION = '8.0.0';
+
 export class ClusterClientAdapter<TDoc extends { body: AliasAny; index: string } = Doc> {
   private readonly logger: Logger;
   private readonly elasticsearchClientPromise: Promise<ElasticsearchClient>;
@@ -202,13 +213,12 @@ export class ClusterClientAdapter<TDoc extends { body: AliasAny; index: string }
   }
 
   public async queryEventsBySavedObjects(
-    index: string,
-    namespace: string | undefined,
-    type: string,
-    ids: string[],
-    // eslint-disable-next-line @typescript-eslint/naming-convention
-    { page, per_page: perPage, start, end, sort_field, sort_order, filter }: FindOptionsType
+    queryOptions: QueryOptionsEventsBySavedObjectFilter
   ): Promise<QueryEventsBySavedObjectResult> {
+    const { index, namespace, type, ids, findOptions, legacyIds } = queryOptions;
+    // eslint-disable-next-line @typescript-eslint/naming-convention
+    const { page, per_page: perPage, start, end, sort_field, sort_order, filter } = findOptions;
+
     const defaultNamespaceQuery = {
       bool: {
         must_not: {
@@ -238,41 +248,125 @@ export class ClusterClientAdapter<TDoc extends { body: AliasAny; index: string }
       });
       throw err;
     }
+    const savedObjectsQueryMust: estypes.QueryDslQueryContainer[] = [
+      {
+        term: {
+          'kibana.saved_objects.rel': {
+            value: SAVED_OBJECT_REL_PRIMARY,
+          },
+        },
+      },
+      {
+        term: {
+          'kibana.saved_objects.type': {
+            value: type,
+          },
+        },
+      },
+      // @ts-expect-error undefined is not assignable as QueryDslTermQuery value
+      namespaceQuery,
+    ];
+
     const musts: estypes.QueryDslQueryContainer[] = [
       {
         nested: {
           path: 'kibana.saved_objects',
           query: {
             bool: {
-              must: [
-                {
-                  term: {
-                    'kibana.saved_objects.rel': {
-                      value: SAVED_OBJECT_REL_PRIMARY,
+              must: reject(savedObjectsQueryMust, isUndefined),
+            },
+          },
+        },
+      },
+    ];
+
+    const shouldQuery = [];
+
+    shouldQuery.push({
+      bool: {
+        must: [
+          {
+            nested: {
+              path: 'kibana.saved_objects',
+              query: {
+                bool: {
+                  must: [
+                    {
+                      terms: {
+                        // default maximum of 65,536 terms, configurable by index.max_terms_count
+                        'kibana.saved_objects.id': ids,
+                      },
                     },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            range: {
+              'kibana.version': {
+                gte: LEGACY_ID_CUTOFF_VERSION,
+              },
+            },
+          },
+        ],
+      },
+    });
+
+    if (legacyIds && legacyIds.length > 0) {
+      shouldQuery.push({
+        bool: {
+          must: [
+            {
+              nested: {
+                path: 'kibana.saved_objects',
+                query: {
+                  bool: {
+                    must: [
+                      {
+                        terms: {
+                          // default maximum of 65,536 terms, configurable by index.max_terms_count
+                          'kibana.saved_objects.id': legacyIds,
+                        },
+                      },
+                    ],
                   },
                 },
-                {
-                  term: {
-                    'kibana.saved_objects.type': {
-                      value: type,
+              },
+            },
+            {
+              bool: {
+                should: [
+                  {
+                    range: {
+                      'kibana.version': {
+                        lt: LEGACY_ID_CUTOFF_VERSION,
+                      },
                     },
                   },
-                },
-                {
-                  terms: {
-                    // default maximum of 65,536 terms, configurable by index.max_terms_count
-                    'kibana.saved_objects.id': ids,
+                  {
+                    bool: {
+                      must_not: {
+                        exists: {
+                          field: 'kibana.version',
+                        },
+                      },
+                    },
                   },
-                },
-                // @ts-expect-error undefined is not assignable as QueryDslTermQuery value
-                namespaceQuery,
-              ],
+                ],
+              },
             },
-          },
+          ],
         },
+      });
+    }
+
+    musts.push({
+      bool: {
+        should: shouldQuery,
       },
-    ];
+    });
+
     if (start) {
       musts.push({
         range: {
diff --git a/x-pack/plugins/event_log/server/event_log_client.test.ts b/x-pack/plugins/event_log/server/event_log_client.test.ts
index 1f58592ea44fa..6babfef9bd8a8 100644
--- a/x-pack/plugins/event_log/server/event_log_client.test.ts
+++ b/x-pack/plugins/event_log/server/event_log_client.test.ts
@@ -111,21 +111,27 @@ describe('EventLogStart', () => {
       esContext.esAdapter.queryEventsBySavedObjects.mockResolvedValue(result);
 
       expect(
-        await eventLogClient.findEventsBySavedObjectIds('saved-object-type', ['saved-object-id'])
+        await eventLogClient.findEventsBySavedObjectIds(
+          'saved-object-type',
+          ['saved-object-id'],
+          undefined,
+          ['legacy-id']
+        )
       ).toEqual(result);
 
-      expect(esContext.esAdapter.queryEventsBySavedObjects).toHaveBeenCalledWith(
-        esContext.esNames.indexPattern,
-        undefined,
-        'saved-object-type',
-        ['saved-object-id'],
-        {
+      expect(esContext.esAdapter.queryEventsBySavedObjects).toHaveBeenCalledWith({
+        index: esContext.esNames.indexPattern,
+        namespace: undefined,
+        type: 'saved-object-type',
+        ids: ['saved-object-id'],
+        findOptions: {
           page: 1,
           per_page: 10,
           sort_field: '@timestamp',
           sort_order: 'asc',
-        }
-      );
+        },
+        legacyIds: ['legacy-id'],
+      });
     });
 
     test('fetches all events in time frame that reference the saved object', async () => {
@@ -189,26 +195,32 @@ describe('EventLogStart', () => {
       const end = moment().add(1, 'days').toISOString();
 
       expect(
-        await eventLogClient.findEventsBySavedObjectIds('saved-object-type', ['saved-object-id'], {
-          start,
-          end,
-        })
+        await eventLogClient.findEventsBySavedObjectIds(
+          'saved-object-type',
+          ['saved-object-id'],
+          {
+            start,
+            end,
+          },
+          ['legacy-id']
+        )
       ).toEqual(result);
 
-      expect(esContext.esAdapter.queryEventsBySavedObjects).toHaveBeenCalledWith(
-        esContext.esNames.indexPattern,
-        undefined,
-        'saved-object-type',
-        ['saved-object-id'],
-        {
+      expect(esContext.esAdapter.queryEventsBySavedObjects).toHaveBeenCalledWith({
+        index: esContext.esNames.indexPattern,
+        namespace: undefined,
+        type: 'saved-object-type',
+        ids: ['saved-object-id'],
+        findOptions: {
           page: 1,
           per_page: 10,
           sort_field: '@timestamp',
           sort_order: 'asc',
           start,
           end,
-        }
-      );
+        },
+        legacyIds: ['legacy-id'],
+      });
     });
 
     test('validates that the start date is valid', async () => {
diff --git a/x-pack/plugins/event_log/server/event_log_client.ts b/x-pack/plugins/event_log/server/event_log_client.ts
index 5214db1169deb..39b78296e3875 100644
--- a/x-pack/plugins/event_log/server/event_log_client.ts
+++ b/x-pack/plugins/event_log/server/event_log_client.ts
@@ -83,7 +83,8 @@ export class EventLogClient implements IEventLogClient {
   async findEventsBySavedObjectIds(
     type: string,
     ids: string[],
-    options?: Partial<FindOptionsType>
+    options?: Partial<FindOptionsType>,
+    legacyIds?: string[]
   ): Promise<QueryEventsBySavedObjectResult> {
     const findOptions = findOptionsSchema.validate(options ?? {});
 
@@ -93,12 +94,13 @@ export class EventLogClient implements IEventLogClient {
     // verify the user has the required permissions to view this saved objects
     await this.savedObjectGetter(type, ids);
 
-    return await this.esContext.esAdapter.queryEventsBySavedObjects(
-      this.esContext.esNames.indexPattern,
+    return await this.esContext.esAdapter.queryEventsBySavedObjects({
+      index: this.esContext.esNames.indexPattern,
       namespace,
       type,
       ids,
-      findOptions
-    );
+      findOptions,
+      legacyIds,
+    });
   }
 }
diff --git a/x-pack/plugins/event_log/server/routes/find_by_ids.test.ts b/x-pack/plugins/event_log/server/routes/find_by_ids.test.ts
index 5259191a98f2b..4685306e869da 100644
--- a/x-pack/plugins/event_log/server/routes/find_by_ids.test.ts
+++ b/x-pack/plugins/event_log/server/routes/find_by_ids.test.ts
@@ -41,7 +41,7 @@ describe('find_by_ids', () => {
       eventLogClient,
       {
         params: { type: 'action' },
-        body: { ids: ['1'] },
+        body: { ids: ['1'], legacyIds: ['2'] },
       },
       ['ok']
     );
@@ -50,9 +50,10 @@ describe('find_by_ids', () => {
 
     expect(eventLogClient.findEventsBySavedObjectIds).toHaveBeenCalledTimes(1);
 
-    const [type, ids] = eventLogClient.findEventsBySavedObjectIds.mock.calls[0];
+    const [type, ids, , legacyIds] = eventLogClient.findEventsBySavedObjectIds.mock.calls[0];
     expect(type).toEqual(`action`);
     expect(ids).toEqual(['1']);
+    expect(legacyIds).toEqual(['2']);
 
     expect(res.ok).toHaveBeenCalledWith({
       body: result,
diff --git a/x-pack/plugins/event_log/server/routes/find_by_ids.ts b/x-pack/plugins/event_log/server/routes/find_by_ids.ts
index 130887e5d30a7..378b9516631ad 100644
--- a/x-pack/plugins/event_log/server/routes/find_by_ids.ts
+++ b/x-pack/plugins/event_log/server/routes/find_by_ids.ts
@@ -23,6 +23,7 @@ const paramSchema = schema.object({
 
 const bodySchema = schema.object({
   ids: schema.arrayOf(schema.string(), { defaultValue: [] }),
+  legacyIds: schema.arrayOf(schema.string(), { defaultValue: [] }),
 });
 
 export const findByIdsRoute = (router: EventLogRouter, systemLogger: Logger) => {
@@ -46,13 +47,13 @@ export const findByIdsRoute = (router: EventLogRouter, systemLogger: Logger) =>
       const eventLogClient = context.eventLog.getEventLogClient();
       const {
         params: { type },
-        body: { ids },
+        body: { ids, legacyIds },
         query,
       } = req;
 
       try {
         return res.ok({
-          body: await eventLogClient.findEventsBySavedObjectIds(type, ids, query),
+          body: await eventLogClient.findEventsBySavedObjectIds(type, ids, query, legacyIds),
         });
       } catch (err) {
         const call = `findEventsBySavedObjectIds(${type}, [${ids}], ${JSON.stringify(query)})`;
diff --git a/x-pack/plugins/event_log/server/types.ts b/x-pack/plugins/event_log/server/types.ts
index 0e5e62b591290..0750e89473b8e 100644
--- a/x-pack/plugins/event_log/server/types.ts
+++ b/x-pack/plugins/event_log/server/types.ts
@@ -45,7 +45,8 @@ export interface IEventLogClient {
   findEventsBySavedObjectIds(
     type: string,
     ids: string[],
-    options?: Partial<FindOptionsType>
+    options?: Partial<FindOptionsType>,
+    legacyIds?: string[]
   ): Promise<QueryEventsBySavedObjectResult>;
 }
 
diff --git a/x-pack/plugins/infra/common/http_api/metrics_api.ts b/x-pack/plugins/infra/common/http_api/metrics_api.ts
index 94d26abc701fe..c2449707647d7 100644
--- a/x-pack/plugins/infra/common/http_api/metrics_api.ts
+++ b/x-pack/plugins/infra/common/http_api/metrics_api.ts
@@ -78,7 +78,9 @@ export const MetricsAPISeriesRT = rt.intersection([
 ]);
 
 export const MetricsAPIResponseRT = rt.type({
-  series: rt.array(MetricsAPISeriesRT),
+  series: rt.array(
+    rt.intersection([MetricsAPISeriesRT, rt.partial({ metricsets: rt.array(rt.string) })])
+  ),
   info: MetricsAPIPageInfoRT,
 });
 
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
index 6d99b6e2f5fe3..9a8f2267e7efe 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { mapValues, first, last, isNaN } from 'lodash';
+import { mapValues, first, last, isNaN, isNumber, isObject, has } from 'lodash';
 import moment from 'moment';
 import { ElasticsearchClient } from 'kibana/server';
 import {
@@ -23,7 +23,11 @@ import { UNGROUPED_FACTORY_KEY } from '../../common/utils';
 import { MetricExpressionParams, Comparator, Aggregators } from '../types';
 import { getElasticsearchMetricQuery } from './metric_query';
 
-interface Aggregation {
+interface AggregationWithoutIntervals {
+  aggregatedValue: { value: number; values?: Array<{ key: number; value: number }> };
+}
+
+interface AggregationWithIntervals {
   aggregatedIntervals: {
     buckets: Array<{
       aggregatedValue: { value: number; values?: Array<{ key: number; value: number }> };
@@ -35,6 +39,14 @@ interface Aggregation {
   };
 }
 
+type Aggregation = AggregationWithIntervals | AggregationWithoutIntervals;
+
+function isAggregationWithIntervals(
+  subject: Aggregation | undefined
+): subject is AggregationWithIntervals {
+  return isObject(subject) && has(subject, 'aggregatedIntervals');
+}
+
 interface CompositeAggregationsResponse {
   groupings: {
     buckets: Aggregation[];
@@ -52,7 +64,7 @@ export const evaluateAlert = <Params extends EvaluatedAlertParams = EvaluatedAle
   esClient: ElasticsearchClient,
   params: Params,
   config: InfraSource['configuration'],
-  timeframe?: { start: number; end: number }
+  timeframe?: { start?: number; end: number }
 ) => {
   const { criteria, groupBy, filterQuery, shouldDropPartialBuckets } = params;
   return Promise.all(
@@ -105,7 +117,7 @@ const getMetric: (
   timefield: string,
   groupBy: string | undefined | string[],
   filterQuery: string | undefined,
-  timeframe?: { start: number; end: number },
+  timeframe?: { start?: number; end: number },
   shouldDropPartialBuckets?: boolean
 ) => Promise<Record<string, number[]>> = async function (
   esClient,
@@ -124,10 +136,7 @@ const getMetric: (
   const intervalAsSeconds = getIntervalInSeconds(interval);
   const intervalAsMS = intervalAsSeconds * 1000;
 
-  const to = moment(timeframe ? timeframe.end : Date.now())
-    .add(1, timeUnit)
-    .startOf(timeUnit)
-    .valueOf();
+  const to = moment(timeframe ? timeframe.end : Date.now()).valueOf();
 
   // Rate aggregations need 5 buckets worth of data
   const minimumBuckets = aggType === Aggregators.RATE ? 5 : 1;
@@ -135,7 +144,7 @@ const getMetric: (
   const minimumFrom = to - intervalAsMS * minimumBuckets;
 
   const from = roundTimestamp(
-    timeframe && timeframe.start <= minimumFrom ? timeframe.start : minimumFrom,
+    timeframe && timeframe.start && timeframe.start <= minimumFrom ? timeframe.start : minimumFrom,
     timeUnit
   );
 
@@ -172,16 +181,26 @@ const getMetric: (
         searchBody,
         bucketSelector,
         afterKeyHandler
-      )) as Array<Aggregation & { key: Record<string, string> }>;
-      return compositeBuckets.reduce(
+      )) as Array<Aggregation & { key: Record<string, string>; doc_count: number }>;
+      const groupedResults = compositeBuckets.reduce(
         (result, bucket) => ({
           ...result,
           [Object.values(bucket.key)
             .map((value) => value)
-            .join(', ')]: getValuesFromAggregations(bucket, aggType, dropPartialBucketsOptions),
+            .join(', ')]: getValuesFromAggregations(
+            bucket,
+            aggType,
+            dropPartialBucketsOptions,
+            {
+              start: from,
+              end: to,
+            },
+            bucket.doc_count
+          ),
         }),
         {}
       );
+      return groupedResults;
     }
     const { body: result } = await esClient.search({
       body: searchBody,
@@ -192,7 +211,9 @@ const getMetric: (
       [UNGROUPED_FACTORY_KEY]: getValuesFromAggregations(
         (result.aggregations! as unknown) as Aggregation,
         aggType,
-        dropPartialBucketsOptions
+        dropPartialBucketsOptions,
+        { start: from, end: to },
+        isNumber(result.hits.total) ? result.hits.total : result.hits.total.value
       ),
     };
   } catch (e) {
@@ -221,7 +242,7 @@ interface DropPartialBucketOptions {
 const dropPartialBuckets = ({ from, to, bucketSizeInMillis }: DropPartialBucketOptions) => (
   row: {
     key: string;
-    value: number;
+    value: number | null;
   } | null
 ) => {
   if (row == null) return null;
@@ -230,20 +251,45 @@ const dropPartialBuckets = ({ from, to, bucketSizeInMillis }: DropPartialBucketO
 };
 
 const getValuesFromAggregations = (
-  aggregations: Aggregation,
+  aggregations: Aggregation | undefined,
   aggType: MetricExpressionParams['aggType'],
-  dropPartialBucketsOptions: DropPartialBucketOptions | null
+  dropPartialBucketsOptions: DropPartialBucketOptions | null,
+  timeFrame: { start: number; end: number },
+  docCount?: number
 ) => {
   try {
-    const { buckets } = aggregations.aggregatedIntervals;
+    let buckets;
+    if (aggType === Aggregators.COUNT) {
+      buckets = [
+        {
+          doc_count: docCount,
+          to_as_string: moment(timeFrame.end).toISOString(),
+          from_as_string: moment(timeFrame.start).toISOString(),
+          key_as_string: moment(timeFrame.start).toISOString(),
+        },
+      ];
+    } else if (isAggregationWithIntervals(aggregations)) {
+      buckets = aggregations.aggregatedIntervals.buckets;
+    } else {
+      buckets = [
+        {
+          ...aggregations,
+          doc_count: docCount,
+          to_as_string: moment(timeFrame.end).toISOString(),
+          from_as_string: moment(timeFrame.start).toISOString(),
+          key_as_string: moment(timeFrame.start).toISOString(),
+        },
+      ];
+    }
+
     if (!buckets.length) return null; // No Data state
 
-    let mappedBuckets;
+    let mappedBuckets: Array<{ key: string; value: number | null } | null>;
 
     if (aggType === Aggregators.COUNT) {
       mappedBuckets = buckets.map((bucket) => ({
         key: bucket.from_as_string,
-        value: bucket.doc_count,
+        value: bucket.doc_count || null,
       }));
     } else if (aggType === Aggregators.P95 || aggType === Aggregators.P99) {
       mappedBuckets = buckets.map((bucket) => {
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
index dd29437275243..2ba8365d6b4a9 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
@@ -64,30 +64,4 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
       );
     });
   });
-
-  describe('when passed a timeframe of 1 hour', () => {
-    const testTimeframe = {
-      start: moment().subtract(1, 'hour').valueOf(),
-      end: moment().valueOf(),
-    };
-    const searchBodyWithoutGroupBy = getElasticsearchMetricQuery(
-      expressionParams,
-      timefield,
-      testTimeframe
-    );
-    const searchBodyWithGroupBy = getElasticsearchMetricQuery(
-      expressionParams,
-      timefield,
-      testTimeframe,
-      groupBy
-    );
-    test("generates 1 hour's worth of buckets", () => {
-      // @ts-ignore
-      expect(searchBodyWithoutGroupBy.aggs.aggregatedIntervals.date_range.ranges.length).toBe(60);
-      expect(
-        // @ts-ignore
-        searchBodyWithGroupBy.aggs.groupings.aggs.aggregatedIntervals.date_range.ranges.length
-      ).toBe(60);
-    });
-  });
 });
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
index 66e112640c357..f5ff4448ecb60 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
@@ -7,7 +7,6 @@
 
 import { networkTraffic } from '../../../../../common/inventory_models/shared/metrics/snapshot/network_traffic';
 import { MetricExpressionParams, Aggregators } from '../types';
-import { getIntervalInSeconds } from '../../../../utils/get_interval_in_seconds';
 import { createPercentileAggregation } from './create_percentile_aggregation';
 import { calculateDateHistogramOffset } from '../../../metrics/lib/calculate_date_histogram_offset';
 
@@ -34,13 +33,9 @@ export const getElasticsearchMetricQuery = (
     throw new Error('Can only aggregate without a metric if using the document count aggregator');
   }
   const interval = `${timeSize}${timeUnit}`;
-  const intervalAsSeconds = getIntervalInSeconds(interval);
-  const intervalAsMS = intervalAsSeconds * 1000;
   const to = timeframe.end;
   const from = timeframe.start;
 
-  const deliveryDelay = 60 * 1000; // INFO: This allows us to account for any delay ES has in indexing the most recent data.
-
   const aggregations =
     aggType === Aggregators.COUNT
       ? {}
@@ -72,21 +67,7 @@ export const getElasticsearchMetricQuery = (
             aggregations,
           },
         }
-      : {
-          aggregatedIntervals: {
-            date_range: {
-              field: timefield,
-              // Generate an array of buckets, starting at `from` and ending at `to`
-              // This is usually only necessary for alert previews or rate aggs. Most alert evaluations
-              // will generate only one bucket from this logic.
-              ranges: Array.from(Array(Math.floor((to - from) / intervalAsMS)), (_, i) => ({
-                from: from + intervalAsMS * i - deliveryDelay,
-                to: from + intervalAsMS * (i + 1) - deliveryDelay,
-              })),
-            },
-            aggregations,
-          },
-        };
+      : aggregations;
 
   const aggs = groupBy
     ? {
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index 18de1a2ad5c00..8eb19ad582057 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -515,7 +515,7 @@ services.scopedClusterClient.asCurrentUser.search.mockImplementation((params?: a
   }
   if (metric === 'test.metric.2') {
     return elasticsearchClientMock.createSuccessTransportRequestPromise(
-      mocks.alternateMetricResponse(from)
+      mocks.alternateMetricResponse()
     );
   } else if (metric === 'test.metric.3') {
     return elasticsearchClientMock.createSuccessTransportRequestPromise(
@@ -524,9 +524,7 @@ services.scopedClusterClient.asCurrentUser.search.mockImplementation((params?: a
         : mocks.emptyMetricResponse
     );
   }
-  return elasticsearchClientMock.createSuccessTransportRequestPromise(
-    mocks.basicMetricResponse(from)
-  );
+  return elasticsearchClientMock.createSuccessTransportRequestPromise(mocks.basicMetricResponse());
 });
 services.savedObjectsClient.get.mockImplementation(async (type: string, sourceId: string) => {
   if (sourceId === 'alternate')
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
index 409a4329aa65c..b1173f2d611c8 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
@@ -103,20 +103,26 @@ const bucketsC = (from: number) => [
   },
 ];
 
-export const basicMetricResponse = (from: number) => ({
-  aggregations: {
-    aggregatedIntervals: {
-      buckets: bucketsA(from),
+export const basicMetricResponse = () => ({
+  hits: {
+    total: {
+      value: 1,
     },
   },
+  aggregations: {
+    aggregatedValue: { value: 1.0, values: [{ key: 95.0, value: 1.0 }] },
+  },
 });
 
-export const alternateMetricResponse = (from: number) => ({
-  aggregations: {
-    aggregatedIntervals: {
-      buckets: bucketsB(from),
+export const alternateMetricResponse = () => ({
+  hits: {
+    total: {
+      value: 1,
     },
   },
+  aggregations: {
+    aggregatedValue: { value: 3, values: [{ key: 99.0, value: 3 }] },
+  },
 });
 
 export const emptyMetricResponse = {
diff --git a/x-pack/plugins/infra/server/lib/metrics/index.ts b/x-pack/plugins/infra/server/lib/metrics/index.ts
index a2d9ad2b401d4..131f6944b0484 100644
--- a/x-pack/plugins/infra/server/lib/metrics/index.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/index.ts
@@ -91,12 +91,14 @@ export const query = async (
     return {
       series: groupings.buckets.map((bucket) => {
         const keys = Object.values(bucket.key);
-        return convertHistogramBucketsToTimeseries(
+        const metricsetNames = bucket.metricsets.buckets.map((m) => m.key);
+        const timeseries = convertHistogramBucketsToTimeseries(
           keys,
           options,
           bucket.histogram.buckets,
           bucketSize * 1000
         );
+        return { ...timeseries, metricsets: metricsetNames };
       }),
       info: {
         afterKey: returnAfterKey ? afterKey : null,
diff --git a/x-pack/plugins/infra/server/lib/metrics/lib/__snapshots__/create_aggregations.test.ts.snap b/x-pack/plugins/infra/server/lib/metrics/lib/__snapshots__/create_aggregations.test.ts.snap
index c7acfb147aa7e..d35d7ce1a4b81 100644
--- a/x-pack/plugins/infra/server/lib/metrics/lib/__snapshots__/create_aggregations.test.ts.snap
+++ b/x-pack/plugins/infra/server/lib/metrics/lib/__snapshots__/create_aggregations.test.ts.snap
@@ -20,6 +20,11 @@ Object {
       "offset": "-60000ms",
     },
   },
+  "metricsets": Object {
+    "terms": Object {
+      "field": "metricset.name",
+    },
+  },
 }
 `;
 
@@ -45,6 +50,11 @@ Object {
           "offset": "0s",
         },
       },
+      "metricsets": Object {
+        "terms": Object {
+          "field": "metricset.name",
+        },
+      },
     },
     "composite": Object {
       "size": 20,
@@ -82,5 +92,10 @@ Object {
       "offset": "0s",
     },
   },
+  "metricsets": Object {
+    "terms": Object {
+      "field": "metricset.name",
+    },
+  },
 }
 `;
diff --git a/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.ts b/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.ts
index 1fb87499b8f44..65cd4ebe2d501 100644
--- a/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.ts
@@ -25,6 +25,11 @@ export const createAggregations = (options: MetricsAPIRequest) => {
       },
       aggregations: createMetricsAggregations(options),
     },
+    metricsets: {
+      terms: {
+        field: 'metricset.name',
+      },
+    },
   };
 
   if (Array.isArray(options.groupBy) && options.groupBy.length) {
diff --git a/x-pack/plugins/infra/server/lib/metrics/types.ts b/x-pack/plugins/infra/server/lib/metrics/types.ts
index e1f5ecd45e363..b18486f88cc4c 100644
--- a/x-pack/plugins/infra/server/lib/metrics/types.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/types.ts
@@ -63,6 +63,14 @@ export const HistogramResponseRT = rt.type({
   histogram: rt.type({
     buckets: rt.array(HistogramBucketRT),
   }),
+  metricsets: rt.type({
+    buckets: rt.array(
+      rt.type({
+        key: rt.string,
+        doc_count: rt.number,
+      })
+    ),
+  }),
 });
 
 const GroupingBucketRT = rt.intersection([
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/get_nodes.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/get_nodes.ts
index 0fef75faed07e..f59756e0c5b25 100644
--- a/x-pack/plugins/infra/server/routes/snapshot/lib/get_nodes.ts
+++ b/x-pack/plugins/infra/server/routes/snapshot/lib/get_nodes.ts
@@ -10,7 +10,7 @@ import { ESSearchClient } from '../../../lib/metrics/types';
 import { InfraSource } from '../../../lib/sources';
 import { transformRequestToMetricsAPIRequest } from './transform_request_to_metrics_api_request';
 import { queryAllData } from './query_all_data';
-import { transformMetricsApiResponseToSnapshotResponse } from './trasform_metrics_ui_response';
+import { transformMetricsApiResponseToSnapshotResponse } from './transform_metrics_ui_response';
 import { copyMissingMetrics } from './copy_missing_metrics';
 import { LogQueryFields } from '../../../services/log_queries/get_log_query_fields';
 
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/transform_metrics_ui_response.test.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/transform_metrics_ui_response.test.ts
new file mode 100644
index 0000000000000..159f6d0b646ec
--- /dev/null
+++ b/x-pack/plugins/infra/server/routes/snapshot/lib/transform_metrics_ui_response.test.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { transformMetricsApiResponseToSnapshotResponse } from './transform_metrics_ui_response';
+
+jest.mock('./apply_metadata_to_last_path', () => ({
+  applyMetadataToLastPath: (series: any) => [{ label: series.id }],
+}));
+
+const now = 1630597319235;
+
+describe('transformMetricsApiResponseToSnapshotResponse', () => {
+  test('filters out nodes from APM which report no data', () => {
+    const result = transformMetricsApiResponseToSnapshotResponse(
+      {
+        // @ts-ignore
+        metrics: [{ id: 'cpu' }],
+      },
+      {
+        includeTimeseries: false,
+        nodeType: 'host',
+      },
+      {},
+      {
+        info: {
+          interval: 60,
+        },
+        series: [
+          {
+            metricsets: ['app'],
+            id: 'apm-node-with-no-data',
+            columns: [],
+            rows: [
+              {
+                timestamp: now,
+                cpu: null,
+              },
+            ],
+          },
+          {
+            metricsets: ['app'],
+            id: 'apm-node-with-data',
+            columns: [],
+            rows: [
+              {
+                timestamp: now,
+                cpu: 1.0,
+              },
+            ],
+          },
+          {
+            metricsets: ['cpu'],
+            id: 'metricbeat-node',
+            columns: [],
+            rows: [
+              {
+                timestamp: now,
+                cpu: 1.0,
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const nodeNames = result.nodes.map((n) => n.name);
+    expect(nodeNames).toEqual(expect.arrayContaining(['metricbeat-node', 'apm-node-with-data']));
+    expect(nodeNames).not.toEqual(expect.arrayContaining(['apm-node']));
+  });
+});
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/transform_metrics_ui_response.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/transform_metrics_ui_response.ts
new file mode 100644
index 0000000000000..a76093f78e08c
--- /dev/null
+++ b/x-pack/plugins/infra/server/routes/snapshot/lib/transform_metrics_ui_response.ts
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { get, max, sum, last, isNumber } from 'lodash';
+import { SnapshotMetricType } from '../../../../common/inventory_models/types';
+import {
+  MetricsAPIResponse,
+  SnapshotNodeResponse,
+  MetricsAPIRequest,
+  MetricsExplorerColumnType,
+  MetricsAPIRow,
+  SnapshotRequest,
+  SnapshotNodePath,
+  SnapshotNodeMetric,
+  SnapshotNode,
+} from '../../../../common/http_api';
+import { META_KEY } from './constants';
+import { InfraSource } from '../../../lib/sources';
+import { applyMetadataToLastPath } from './apply_metadata_to_last_path';
+
+const getMetricValue = (row: MetricsAPIRow) => {
+  if (!isNumber(row.metric_0)) return null;
+  const value = row.metric_0;
+  return isFinite(value) ? value : null;
+};
+
+const calculateMax = (rows: MetricsAPIRow[]) => {
+  return max(rows.map(getMetricValue)) || 0;
+};
+
+const calculateAvg = (rows: MetricsAPIRow[]): number => {
+  return sum(rows.map(getMetricValue)) / rows.length || 0;
+};
+
+const getLastValue = (rows: MetricsAPIRow[]) => {
+  const row = last(rows);
+  if (!row) return null;
+  return getMetricValue(row);
+};
+
+export const transformMetricsApiResponseToSnapshotResponse = (
+  options: MetricsAPIRequest,
+  snapshotRequest: SnapshotRequest,
+  source: InfraSource,
+  metricsApiResponse: MetricsAPIResponse
+): SnapshotNodeResponse => {
+  const nodes = metricsApiResponse.series
+    .map((series) => {
+      const node = {
+        metrics: options.metrics
+          .filter((m) => m.id !== META_KEY)
+          .map((metric) => {
+            const name = metric.id as SnapshotMetricType;
+            const timeseries = {
+              id: name,
+              columns: [
+                { name: 'timestamp', type: 'date' as MetricsExplorerColumnType },
+                { name: 'metric_0', type: 'number' as MetricsExplorerColumnType },
+              ],
+              rows: series.rows.map((row) => {
+                return { timestamp: row.timestamp, metric_0: get(row, metric.id, null) };
+              }),
+            };
+            const maxValue = calculateMax(timeseries.rows);
+            const avg = calculateAvg(timeseries.rows);
+            const value = getLastValue(timeseries.rows);
+            const nodeMetric: SnapshotNodeMetric = { name, max: maxValue, value, avg };
+            if (snapshotRequest.includeTimeseries) {
+              nodeMetric.timeseries = timeseries;
+            }
+            return nodeMetric;
+          }),
+        path:
+          series.keys?.map((key) => {
+            return { value: key, label: key } as SnapshotNodePath;
+          }) ?? [],
+        name: '',
+      };
+
+      const isNoData = node.metrics.every((m) => m.value === null);
+      const isAPMNode = series.metricsets?.includes('app');
+      if (isNoData && isAPMNode) return null;
+
+      const path = applyMetadataToLastPath(series, node, snapshotRequest, source);
+      const lastPath = last(path);
+      const name = lastPath?.label ?? 'N/A';
+
+      return { ...node, path, name };
+    })
+    .filter((n) => n !== null) as SnapshotNode[];
+  return { nodes, interval: `${metricsApiResponse.info.interval}s` };
+};
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/trasform_metrics_ui_response.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/trasform_metrics_ui_response.ts
deleted file mode 100644
index 21b3e07e83588..0000000000000
--- a/x-pack/plugins/infra/server/routes/snapshot/lib/trasform_metrics_ui_response.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { get, max, sum, last, isNumber } from 'lodash';
-import { SnapshotMetricType } from '../../../../common/inventory_models/types';
-import {
-  MetricsAPIResponse,
-  SnapshotNodeResponse,
-  MetricsAPIRequest,
-  MetricsExplorerColumnType,
-  MetricsAPIRow,
-  SnapshotRequest,
-  SnapshotNodePath,
-  SnapshotNodeMetric,
-} from '../../../../common/http_api';
-import { META_KEY } from './constants';
-import { InfraSource } from '../../../lib/sources';
-import { applyMetadataToLastPath } from './apply_metadata_to_last_path';
-
-const getMetricValue = (row: MetricsAPIRow) => {
-  if (!isNumber(row.metric_0)) return null;
-  const value = row.metric_0;
-  return isFinite(value) ? value : null;
-};
-
-const calculateMax = (rows: MetricsAPIRow[]) => {
-  return max(rows.map(getMetricValue)) || 0;
-};
-
-const calculateAvg = (rows: MetricsAPIRow[]): number => {
-  return sum(rows.map(getMetricValue)) / rows.length || 0;
-};
-
-const getLastValue = (rows: MetricsAPIRow[]) => {
-  const row = last(rows);
-  if (!row) return null;
-  return getMetricValue(row);
-};
-
-export const transformMetricsApiResponseToSnapshotResponse = (
-  options: MetricsAPIRequest,
-  snapshotRequest: SnapshotRequest,
-  source: InfraSource,
-  metricsApiResponse: MetricsAPIResponse
-): SnapshotNodeResponse => {
-  const nodes = metricsApiResponse.series.map((series) => {
-    const node = {
-      metrics: options.metrics
-        .filter((m) => m.id !== META_KEY)
-        .map((metric) => {
-          const name = metric.id as SnapshotMetricType;
-          const timeseries = {
-            id: name,
-            columns: [
-              { name: 'timestamp', type: 'date' as MetricsExplorerColumnType },
-              { name: 'metric_0', type: 'number' as MetricsExplorerColumnType },
-            ],
-            rows: series.rows.map((row) => {
-              return { timestamp: row.timestamp, metric_0: get(row, metric.id, null) };
-            }),
-          };
-          const maxValue = calculateMax(timeseries.rows);
-          const avg = calculateAvg(timeseries.rows);
-          const value = getLastValue(timeseries.rows);
-          const nodeMetric: SnapshotNodeMetric = { name, max: maxValue, value, avg };
-          if (snapshotRequest.includeTimeseries) {
-            nodeMetric.timeseries = timeseries;
-          }
-          return nodeMetric;
-        }),
-      path:
-        series.keys?.map((key) => {
-          return { value: key, label: key } as SnapshotNodePath;
-        }) ?? [],
-      name: '',
-    };
-
-    const path = applyMetadataToLastPath(series, node, snapshotRequest, source);
-    const lastPath = last(path);
-    const name = (lastPath && lastPath.label) || 'N/A';
-    return { ...node, path, name };
-  });
-  return { nodes, interval: `${metricsApiResponse.info.interval}s` };
-};
diff --git a/x-pack/plugins/reporting/server/browsers/chromium/driver_factory/index.ts b/x-pack/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
index 7aaa9c78602a9..c87c202c0ec1f 100644
--- a/x-pack/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
+++ b/x-pack/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
@@ -78,7 +78,8 @@ export class HeadlessChromiumDriverFactory {
     { viewport, browserTimezone }: { viewport: ViewportConfig; browserTimezone?: string },
     pLogger: LevelLogger
   ): Rx.Observable<{ driver: HeadlessChromiumDriver; exit$: Rx.Observable<never> }> {
-    return Rx.Observable.create(async (observer: InnerSubscriber<any, any>) => {
+    // FIXME: 'create' is deprecated
+    return Rx.Observable.create(async (observer: InnerSubscriber<unknown, unknown>) => {
       const logger = pLogger.clone(['browser-driver']);
       logger.info(`Creating browser page driver`);
 
diff --git a/x-pack/plugins/reporting/server/config/ui_settings.test.ts b/x-pack/plugins/reporting/server/config/ui_settings.test.ts
index dcd12e4c05f3f..6f40bb648ba93 100644
--- a/x-pack/plugins/reporting/server/config/ui_settings.test.ts
+++ b/x-pack/plugins/reporting/server/config/ui_settings.test.ts
@@ -49,23 +49,57 @@ test('throws validation error if provided with data over max size', () => {
 });
 
 test('throws validation error if provided with non-image data', () => {
-  const invalidErrorMatcher = /try a different image/;
-
-  expect(() => PdfLogoSchema.validate('')).toThrowError(invalidErrorMatcher);
-  expect(() => PdfLogoSchema.validate(true)).toThrow(invalidErrorMatcher);
-  expect(() => PdfLogoSchema.validate(false)).toThrow(invalidErrorMatcher);
-  expect(() => PdfLogoSchema.validate({})).toThrow(invalidErrorMatcher);
-  expect(() => PdfLogoSchema.validate([])).toThrow(invalidErrorMatcher);
-  expect(() => PdfLogoSchema.validate(0)).toThrow(invalidErrorMatcher);
-  expect(() => PdfLogoSchema.validate(0x00f)).toThrow(invalidErrorMatcher);
+  expect(() => PdfLogoSchema.validate('')).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: Sorry, that file will not work. Please try a different image file.
+    - [1]: expected value to equal [null]"
+  `);
+  expect(() => PdfLogoSchema.validate(true)).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: expected value of type [string] but got [boolean]
+    - [1]: expected value to equal [null]"
+  `);
+  expect(() => PdfLogoSchema.validate(false)).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: expected value of type [string] but got [boolean]
+    - [1]: expected value to equal [null]"
+  `);
+  expect(() => PdfLogoSchema.validate({})).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: expected value of type [string] but got [Object]
+    - [1]: expected value to equal [null]"
+  `);
+  expect(() => PdfLogoSchema.validate([])).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: expected value of type [string] but got [Array]
+    - [1]: expected value to equal [null]"
+  `);
+  expect(() => PdfLogoSchema.validate(0)).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: expected value of type [string] but got [number]
+    - [1]: expected value to equal [null]"
+  `);
+  expect(() => PdfLogoSchema.validate(0x00f)).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: expected value of type [string] but got [number]
+    - [1]: expected value to equal [null]"
+  `);
 
   const csvString =
     `data:text/csv;base64,Il9pZCIsIl9pbmRleCIsIl9zY29yZSIsIl90eXBlIiwiZm9vLmJhciIsImZvby5iYXIua2V5d29yZCIKZjY1QU9IZ0J5bFZmWW04W` +
     `TRvb1EsYmVlLDEsIi0iLGJheixiYXoKbks1QU9IZ0J5bFZmWW04WTdZcUcsYmVlLDEsIi0iLGJvbyxib28K`;
-  expect(() => PdfLogoSchema.validate(csvString)).toThrow(invalidErrorMatcher);
+  expect(() => PdfLogoSchema.validate(csvString)).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: Sorry, that file will not work. Please try a different image file.
+    - [1]: expected value to equal [null]"
+  `);
 
   const scriptString =
     `data:application/octet-stream;base64,QEVDSE8gT0ZGCldFRUtPRllSLkNPTSB8IEZJTkQgIlRoaXMgaXMiID4gVEVNUC5CQV` +
     `QKRUNITz5USElTLkJBVCBTRVQgV0VFSz0lJTMKQ0FMTCBURU1QLkJBVApERUwgIFRFTVAuQkFUCkRFTCAgVEhJUy5CQVQKRUNITyBXZWVrICVXRUVLJQo=`;
-  expect(() => PdfLogoSchema.validate(scriptString)).toThrow(invalidErrorMatcher);
+  expect(() => PdfLogoSchema.validate(scriptString)).toThrowErrorMatchingInlineSnapshot(`
+    "types that failed validation:
+    - [0]: Sorry, that file will not work. Please try a different image file.
+    - [1]: expected value to equal [null]"
+  `);
 });
diff --git a/x-pack/plugins/reporting/server/config/ui_settings.ts b/x-pack/plugins/reporting/server/config/ui_settings.ts
index 587997bd1ecbd..bd13dcb8320ff 100644
--- a/x-pack/plugins/reporting/server/config/ui_settings.ts
+++ b/x-pack/plugins/reporting/server/config/ui_settings.ts
@@ -17,7 +17,7 @@ const maxLogoSizeInBase64 = kbToBase64Length(200);
 const dataurlRegex = /^data:([a-z]+\/[a-z0-9-+.]+)(;[a-z-]+=[a-z0-9-]+)?(;([a-z0-9]+))?,/;
 const imageTypes = ['image/svg+xml', 'image/jpeg', 'image/png', 'image/gif'];
 
-const isImageData = (str: any): boolean => {
+const isImageData = (str: string) => {
   const matches = str.match(dataurlRegex);
 
   if (!matches) {
@@ -33,7 +33,7 @@ const isImageData = (str: any): boolean => {
   return true;
 };
 
-const validatePdfLogoBase64String = (str: any) => {
+const validatePdfLogoBase64String = (str: string) => {
   if (typeof str !== 'string' || !isImageData(str)) {
     return i18n.translate('xpack.reporting.uiSettings.validate.customLogo.badFile', {
       defaultMessage: `Sorry, that file will not work. Please try a different image file.`,
@@ -46,7 +46,9 @@ const validatePdfLogoBase64String = (str: any) => {
   }
 };
 
-export const PdfLogoSchema = schema.nullable(schema.any({ validate: validatePdfLogoBase64String }));
+export const PdfLogoSchema = schema.nullable(
+  schema.string({ validate: validatePdfLogoBase64String })
+);
 
 export function registerUiSettings(core: CoreSetup<object, unknown>) {
   core.uiSettings.register({
diff --git a/x-pack/plugins/reporting/server/export_types/common/pdf/index.ts b/x-pack/plugins/reporting/server/export_types/common/pdf/index.ts
index 4e5309bcff5b1..0fc4e497e16a7 100644
--- a/x-pack/plugins/reporting/server/export_types/common/pdf/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/common/pdf/index.ts
@@ -101,7 +101,10 @@ export class PdfMaker {
     this._addContents(contents);
   }
 
-  addImage(image: Buffer, opts = { title: '', description: '' }) {
+  addImage(
+    image: Buffer,
+    opts: { title?: string; description?: string } = { title: '', description: '' }
+  ) {
     const size = this._layout.getPdfImageSize();
     const img = {
       image: `data:image/png;base64,${image.toString('base64')}`,
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts
index a7e492b882c20..74b013edc8cab 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/lib/generate_pdf.ts
@@ -73,8 +73,8 @@ export async function generatePdfObservableFactory(reporting: ReportingCore) {
             tracker.startAddImage();
             tracker.endAddImage();
             pdfOutput.addImage(screenshot.data, {
-              title: screenshot.title,
-              description: screenshot.description,
+              title: screenshot.title ?? undefined,
+              description: screenshot.description ?? undefined,
             });
           });
         });
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/lib/generate_pdf.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/lib/generate_pdf.ts
index 8cc2d4b3037b3..9be95223a8864 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/lib/generate_pdf.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/lib/generate_pdf.ts
@@ -84,8 +84,8 @@ export async function generatePdfObservableFactory(reporting: ReportingCore) {
             tracker.startAddImage();
             tracker.endAddImage();
             pdfOutput.addImage(screenshot.data, {
-              title: screenshot.title,
-              description: screenshot.description,
+              title: screenshot.title ?? undefined,
+              description: screenshot.description ?? undefined,
             });
           });
         });
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/get_element_position_data.ts b/x-pack/plugins/reporting/server/lib/screenshots/get_element_position_data.ts
index 61d31153265f3..39163843c732f 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/get_element_position_data.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/get_element_position_data.ts
@@ -45,7 +45,7 @@ export const getElementPositionAndAttributes = async (
               },
               attributes: Object.keys(attributes).reduce((result: AttributesMap, key) => {
                 const attribute = attributes[key];
-                (result as any)[key] = element.getAttribute(attribute);
+                result[key] = element.getAttribute(attribute);
                 return result;
               }, {} as AttributesMap),
             });
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.test.ts b/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.test.ts
index a265a24855efe..edd346c9b8928 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.test.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.test.ts
@@ -8,13 +8,10 @@
 import { HeadlessChromiumDriver } from '../../browsers';
 import {
   createMockBrowserDriverFactory,
-  createMockConfig,
   createMockConfigSchema,
-  createMockLayoutInstance,
   createMockLevelLogger,
   createMockReportingCore,
 } from '../../test_helpers';
-import { LayoutInstance } from '../layouts';
 import { getScreenshots } from './get_screenshots';
 
 describe('getScreenshots', () => {
@@ -35,17 +32,12 @@ describe('getScreenshots', () => {
     },
   ];
 
-  let layout: LayoutInstance;
   let logger: ReturnType<typeof createMockLevelLogger>;
   let browser: jest.Mocked<HeadlessChromiumDriver>;
 
   beforeEach(async () => {
-    const schema = createMockConfigSchema();
-    const config = createMockConfig(schema);
-    const captureConfig = config.get('capture');
-    const core = await createMockReportingCore(schema);
+    const core = await createMockReportingCore(createMockConfigSchema());
 
-    layout = createMockLayoutInstance(captureConfig);
     logger = createMockLevelLogger();
 
     await createMockBrowserDriverFactory(core, logger, {
@@ -71,7 +63,7 @@ describe('getScreenshots', () => {
   });
 
   it('should return screenshots', async () => {
-    await expect(getScreenshots(browser, layout, elementsPositionAndAttributes, logger)).resolves
+    await expect(getScreenshots(browser, elementsPositionAndAttributes, logger)).resolves
       .toMatchInlineSnapshot(`
             Array [
               Object {
@@ -117,7 +109,7 @@ describe('getScreenshots', () => {
   });
 
   it('should forward elements positions', async () => {
-    await getScreenshots(browser, layout, elementsPositionAndAttributes, logger);
+    await getScreenshots(browser, elementsPositionAndAttributes, logger);
 
     expect(browser.screenshot).toHaveBeenCalledTimes(2);
     expect(browser.screenshot).toHaveBeenNthCalledWith(
@@ -134,7 +126,7 @@ describe('getScreenshots', () => {
     browser.screenshot.mockResolvedValue(Buffer.from(''));
 
     await expect(
-      getScreenshots(browser, layout, elementsPositionAndAttributes, logger)
+      getScreenshots(browser, elementsPositionAndAttributes, logger)
     ).rejects.toBeInstanceOf(Error);
   });
 });
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.ts b/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.ts
index 77c732b3336be..9b5f234b78363 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/get_screenshots.ts
@@ -8,12 +8,10 @@
 import { i18n } from '@kbn/i18n';
 import { LevelLogger, startTrace } from '../';
 import { HeadlessChromiumDriver } from '../../browsers';
-import { LayoutInstance } from '../layouts';
 import { ElementsPositionAndAttribute, Screenshot } from './';
 
 export const getScreenshots = async (
   browser: HeadlessChromiumDriver,
-  layout: LayoutInstance,
   elementsPositionAndAttributes: ElementsPositionAndAttribute[],
   logger: LevelLogger
 ): Promise<Screenshot[]> => {
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/index.ts b/x-pack/plugins/reporting/server/lib/screenshots/index.ts
index e6769739ac75a..6615cbdc79c94 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/index.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/index.ts
@@ -21,7 +21,7 @@ export interface ScreenshotObservableOpts {
 }
 
 export interface AttributesMap {
-  [key: string]: any;
+  [key: string]: string | null;
 }
 
 export interface ElementPosition {
@@ -45,8 +45,8 @@ export interface ElementsPositionAndAttribute {
 
 export interface Screenshot {
   data: Buffer;
-  title: string;
-  description: string;
+  title: string | null;
+  description: string | null;
 }
 
 export interface ScreenshotResults {
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/observable.ts b/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
index e833a0dfcaf60..aeb3de0b04e4d 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
@@ -123,7 +123,7 @@ export function getScreenshots$(
                 const elements = data.elementsPositionAndAttributes
                   ? data.elementsPositionAndAttributes
                   : getDefaultElementPosition(layout.getViewport(1));
-                const screenshots = await getScreenshots(driver, layout, elements, logger);
+                const screenshots = await getScreenshots(driver, elements, logger);
                 const { timeRange, error: setupError } = data;
                 return {
                   timeRange,
diff --git a/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts b/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
index 1e29efd9cce0b..84566eb9c250c 100644
--- a/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
+++ b/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
@@ -47,8 +47,8 @@ interface TaskExecutor extends Pick<ExportTypeDefinition, 'jobContentEncoding'>
   jobExecutor: RunTaskFn<BasePayload>;
 }
 
-function isOutput(output: any): output is CompletedReportOutput {
-  return output?.size != null;
+function isOutput(output: CompletedReportOutput | Error): output is CompletedReportOutput {
+  return (output as CompletedReportOutput).size != null;
 }
 
 function reportFromTask(task: ReportTaskParams) {
diff --git a/x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts b/x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts
index 6c5d548e77020..6d844f9637a0b 100644
--- a/x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts
+++ b/x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts
@@ -36,7 +36,7 @@ describe('POST /diagnose/screenshot', () => {
         toPromise: () => (resp instanceof Error ? Promise.reject(resp) : Promise.resolve(resp)),
       }),
     }));
-    (generatePngObservableFactory as any).mockResolvedValue(generateMock);
+    (generatePngObservableFactory as jest.Mock).mockResolvedValue(generateMock);
   };
 
   const config = createMockConfigSchema({ queue: { timeout: 120000 } });
diff --git a/x-pack/plugins/reporting/server/routes/csv_searchsource_immediate.ts b/x-pack/plugins/reporting/server/routes/generate/csv_searchsource_immediate.ts
similarity index 84%
rename from x-pack/plugins/reporting/server/routes/csv_searchsource_immediate.ts
rename to x-pack/plugins/reporting/server/routes/generate/csv_searchsource_immediate.ts
index efdb91d948536..52e6eb87e05cd 100644
--- a/x-pack/plugins/reporting/server/routes/csv_searchsource_immediate.ts
+++ b/x-pack/plugins/reporting/server/routes/generate/csv_searchsource_immediate.ts
@@ -5,16 +5,16 @@
  * 2.0.
  */
 
-import { Writable } from 'stream';
 import { schema } from '@kbn/config-schema';
 import { KibanaRequest } from 'src/core/server';
-import { ReportingCore } from '../';
-import { runTaskFnFactory } from '../export_types/csv_searchsource_immediate/execute_job';
-import { JobParamsDownloadCSV } from '../export_types/csv_searchsource_immediate/types';
-import { LevelLogger as Logger } from '../lib';
-import { TaskRunResult } from '../lib/tasks';
-import { authorizedUserPreRouting } from './lib/authorized_user_pre_routing';
-import { HandlerErrorFunction } from './types';
+import { Writable } from 'stream';
+import { ReportingCore } from '../../';
+import { runTaskFnFactory } from '../../export_types/csv_searchsource_immediate/execute_job';
+import { JobParamsDownloadCSV } from '../../export_types/csv_searchsource_immediate/types';
+import { LevelLogger as Logger } from '../../lib';
+import { TaskRunResult } from '../../lib/tasks';
+import { authorizedUserPreRouting } from '../lib/authorized_user_pre_routing';
+import { RequestHandler } from '../lib/request_handler';
 
 const API_BASE_URL_V1 = '/api/reporting/v1';
 const API_BASE_GENERATE_V1 = `${API_BASE_URL_V1}/generate`;
@@ -32,7 +32,6 @@ export type CsvFromSavedObjectRequest = KibanaRequest<unknown, unknown, JobParam
  */
 export function registerGenerateCsvFromSavedObjectImmediate(
   reporting: ReportingCore,
-  handleError: HandlerErrorFunction,
   parentLogger: Logger
 ) {
   const setupDeps = reporting.getPluginSetupDeps();
@@ -64,9 +63,10 @@ export function registerGenerateCsvFromSavedObjectImmediate(
     },
     authorizedUserPreRouting(
       reporting,
-      async (_user, context, req: CsvFromSavedObjectRequest, res) => {
+      async (user, context, req: CsvFromSavedObjectRequest, res) => {
         const logger = parentLogger.clone(['csv_searchsource_immediate']);
         const runTaskFn = runTaskFnFactory(reporting, logger);
+        const requestHandler = new RequestHandler(reporting, user, context, req, res, logger);
 
         try {
           let buffer = Buffer.from('');
@@ -107,7 +107,7 @@ export function registerGenerateCsvFromSavedObjectImmediate(
           });
         } catch (err) {
           logger.error(err);
-          return handleError(res, err);
+          return requestHandler.handleError(err);
         }
       }
     )
diff --git a/x-pack/plugins/reporting/server/routes/generate_from_jobparams.ts b/x-pack/plugins/reporting/server/routes/generate/generate_from_jobparams.ts
similarity index 81%
rename from x-pack/plugins/reporting/server/routes/generate_from_jobparams.ts
rename to x-pack/plugins/reporting/server/routes/generate/generate_from_jobparams.ts
index c519616cda5fb..cfcb7d6d2b05c 100644
--- a/x-pack/plugins/reporting/server/routes/generate_from_jobparams.ts
+++ b/x-pack/plugins/reporting/server/routes/generate/generate_from_jobparams.ts
@@ -7,19 +7,16 @@
 
 import { schema } from '@kbn/config-schema';
 import rison from 'rison-node';
-import { ReportingCore } from '../';
-import { API_BASE_URL } from '../../common/constants';
-import { BaseParams } from '../types';
-import { authorizedUserPreRouting } from './lib/authorized_user_pre_routing';
-import { HandlerErrorFunction, HandlerFunction } from './types';
+import { ReportingCore } from '../..';
+import { API_BASE_URL } from '../../../common/constants';
+import { LevelLogger } from '../../lib';
+import { BaseParams } from '../../types';
+import { authorizedUserPreRouting } from '../lib/authorized_user_pre_routing';
+import { RequestHandler } from '../lib/request_handler';
 
 const BASE_GENERATE = `${API_BASE_URL}/generate`;
 
-export function registerGenerateFromJobParams(
-  reporting: ReportingCore,
-  handler: HandlerFunction,
-  handleError: HandlerErrorFunction
-) {
+export function registerJobGenerationRoutes(reporting: ReportingCore, logger: LevelLogger) {
   const setupDeps = reporting.getPluginSetupDeps();
   const { router } = setupDeps;
 
@@ -62,7 +59,6 @@ export function registerGenerateFromJobParams(
         });
       }
 
-      const { exportType } = req.params;
       let jobParams;
 
       try {
@@ -80,10 +76,12 @@ export function registerGenerateFromJobParams(
         });
       }
 
+      const requestHandler = new RequestHandler(reporting, user, context, req, res, logger);
+
       try {
-        return await handler(user, exportType, jobParams, context, req, res);
+        return await requestHandler.handleGenerateRequest(req.params.exportType, jobParams);
       } catch (err) {
-        return handleError(res, err);
+        return requestHandler.handleError(err);
       }
     })
   );
diff --git a/x-pack/plugins/reporting/server/routes/generation.test.ts b/x-pack/plugins/reporting/server/routes/generate/generation_from_jobparams.test.ts
similarity index 94%
rename from x-pack/plugins/reporting/server/routes/generation.test.ts
rename to x-pack/plugins/reporting/server/routes/generate/generation_from_jobparams.test.ts
index df5a85d71f49f..dff52f1f67464 100644
--- a/x-pack/plugins/reporting/server/routes/generation.test.ts
+++ b/x-pack/plugins/reporting/server/routes/generate/generation_from_jobparams.test.ts
@@ -12,15 +12,15 @@ import { of } from 'rxjs';
 import { ElasticsearchClient } from 'kibana/server';
 import { setupServer } from 'src/core/server/test_utils';
 import supertest from 'supertest';
-import { ReportingCore } from '..';
-import { ExportTypesRegistry } from '../lib/export_types_registry';
-import { createMockLevelLogger, createMockReportingCore } from '../test_helpers';
+import { ReportingCore } from '../..';
+import { ExportTypesRegistry } from '../../lib/export_types_registry';
+import { createMockLevelLogger, createMockReportingCore } from '../../test_helpers';
 import {
   createMockConfigSchema,
   createMockPluginSetup,
-} from '../test_helpers/create_mock_reportingplugin';
-import { registerJobGenerationRoutes } from './generation';
-import type { ReportingRequestHandlerContext } from '../types';
+} from '../../test_helpers/create_mock_reportingplugin';
+import type { ReportingRequestHandlerContext } from '../../types';
+import { registerJobGenerationRoutes } from './generate_from_jobparams';
 
 type SetupServerReturn = UnwrapPromise<ReturnType<typeof setupServer>>;
 
diff --git a/x-pack/plugins/reporting/server/routes/generate/index.ts b/x-pack/plugins/reporting/server/routes/generate/index.ts
new file mode 100644
index 0000000000000..0df9b4a725768
--- /dev/null
+++ b/x-pack/plugins/reporting/server/routes/generate/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { registerGenerateCsvFromSavedObjectImmediate } from './csv_searchsource_immediate'; // FIXME: should not need to register each immediate export type separately
+export { registerJobGenerationRoutes } from './generate_from_jobparams';
+export { registerLegacy } from './legacy';
diff --git a/x-pack/plugins/reporting/server/routes/legacy.ts b/x-pack/plugins/reporting/server/routes/generate/legacy.ts
similarity index 61%
rename from x-pack/plugins/reporting/server/routes/legacy.ts
rename to x-pack/plugins/reporting/server/routes/generate/legacy.ts
index 79f1b7f17c2da..92f1784dc8eca 100644
--- a/x-pack/plugins/reporting/server/routes/legacy.ts
+++ b/x-pack/plugins/reporting/server/routes/generate/legacy.ts
@@ -6,21 +6,16 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import querystring from 'querystring';
-import { authorizedUserPreRouting } from './lib/authorized_user_pre_routing';
-import { API_BASE_URL } from '../../common/constants';
-import { HandlerErrorFunction, HandlerFunction } from './types';
-import { ReportingCore } from '../core';
-import { LevelLogger } from '../lib';
+import querystring, { ParsedUrlQueryInput } from 'querystring';
+import { API_BASE_URL } from '../../../common/constants';
+import { ReportingCore } from '../../core';
+import { LevelLogger } from '../../lib';
+import { authorizedUserPreRouting } from '../lib/authorized_user_pre_routing';
+import { RequestHandler } from '../lib/request_handler';
 
 const BASE_GENERATE = `${API_BASE_URL}/generate`;
 
-export function registerLegacy(
-  reporting: ReportingCore,
-  handler: HandlerFunction,
-  handleError: HandlerErrorFunction,
-  logger: LevelLogger
-) {
+export function registerLegacy(reporting: ReportingCore, logger: LevelLogger) {
   const { router } = reporting.getPluginSetupDeps();
 
   function createLegacyPdfRoute({ path, objectType }: { path: string; objectType: string }) {
@@ -32,12 +27,15 @@ export function registerLegacy(
         validate: {
           params: schema.object({
             savedObjectId: schema.string({ minLength: 3 }),
+            title: schema.string(),
+            browserTimezone: schema.string(),
           }),
-          query: schema.any(),
+          query: schema.maybe(schema.string()),
         },
       },
 
       authorizedUserPreRouting(reporting, async (user, context, req, res) => {
+        const requestHandler = new RequestHandler(reporting, user, context, req, res, logger);
         const message = `The following URL is deprecated and will stop working in the next major version: ${req.url.pathname}${req.url.search}`;
         logger.warn(message, ['deprecation']);
 
@@ -46,26 +44,19 @@ export function registerLegacy(
             title,
             savedObjectId,
             browserTimezone,
-          }: { title: string; savedObjectId: string; browserTimezone: string } = req.params as any;
-          const queryString = querystring.stringify(req.query as any);
+          }: { title: string; savedObjectId: string; browserTimezone: string } = req.params;
+          const queryString = querystring.stringify(req.query as ParsedUrlQueryInput | undefined);
 
-          return await handler(
-            user,
-            exportTypeId,
-            {
-              title,
-              objectType,
-              savedObjectId,
-              browserTimezone,
-              queryString,
-              version: reporting.getKibanaVersion(),
-            },
-            context,
-            req,
-            res
-          );
+          return await requestHandler.handleGenerateRequest(exportTypeId, {
+            title,
+            objectType,
+            savedObjectId,
+            browserTimezone,
+            queryString,
+            version: reporting.getKibanaVersion(),
+          });
         } catch (err) {
-          throw handleError(res, err);
+          throw requestHandler.handleError(err);
         }
       })
     );
diff --git a/x-pack/plugins/reporting/server/routes/generation.ts b/x-pack/plugins/reporting/server/routes/generation.ts
deleted file mode 100644
index adbfbda727af2..0000000000000
--- a/x-pack/plugins/reporting/server/routes/generation.ts
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import Boom from '@hapi/boom';
-import { kibanaResponseFactory } from 'src/core/server';
-import { ReportingCore } from '../';
-import { API_BASE_URL } from '../../common/constants';
-import { LevelLogger as Logger } from '../lib';
-import { enqueueJob } from '../lib/enqueue_job';
-import { registerGenerateCsvFromSavedObjectImmediate } from './csv_searchsource_immediate';
-import { registerGenerateFromJobParams } from './generate_from_jobparams';
-import { registerLegacy } from './legacy';
-import { HandlerFunction } from './types';
-
-const getDownloadBaseUrl = (reporting: ReportingCore) => {
-  const config = reporting.getConfig();
-  return config.kbnConfig.get('server', 'basePath') + `${API_BASE_URL}/jobs/download`;
-};
-
-export function registerJobGenerationRoutes(reporting: ReportingCore, logger: Logger) {
-  /*
-   * Generates enqueued job details to use in responses
-   */
-  const handler: HandlerFunction = async (user, exportTypeId, jobParams, context, req, res) => {
-    // ensure the async dependencies are loaded
-    if (!context.reporting) {
-      return res.custom({ statusCode: 503, body: 'Not Available' });
-    }
-
-    const licenseInfo = await reporting.getLicenseInfo();
-    const licenseResults = licenseInfo[exportTypeId];
-
-    if (!licenseResults) {
-      return res.badRequest({ body: `Invalid export-type of ${exportTypeId}` });
-    }
-
-    if (!licenseResults.enableLinks) {
-      return res.forbidden({ body: licenseResults.message });
-    }
-
-    try {
-      const report = await enqueueJob(
-        reporting,
-        req,
-        context,
-        user,
-        exportTypeId,
-        jobParams,
-        logger
-      );
-
-      // return task manager's task information and the download URL
-      const downloadBaseUrl = getDownloadBaseUrl(reporting);
-
-      return res.ok({
-        headers: {
-          'content-type': 'application/json',
-        },
-        body: {
-          path: `${downloadBaseUrl}/${report._id}`,
-          job: report.toApiJSON(),
-        },
-      });
-    } catch (err) {
-      logger.error(err);
-      throw err;
-    }
-  };
-
-  /*
-   * Error should already have been logged by the time we get here
-   */
-  function handleError(res: typeof kibanaResponseFactory, err: Error | Boom.Boom) {
-    if (err instanceof Boom.Boom) {
-      return res.customError({
-        statusCode: err.output.statusCode,
-        body: err.output.payload.message,
-      });
-    }
-
-    // unknown error, can't convert to 4xx
-    throw err;
-  }
-
-  registerGenerateFromJobParams(reporting, handler, handleError);
-  registerGenerateCsvFromSavedObjectImmediate(reporting, handleError, logger);
-  registerLegacy(reporting, handler, handleError, logger);
-}
diff --git a/x-pack/plugins/reporting/server/routes/index.ts b/x-pack/plugins/reporting/server/routes/index.ts
index a462da3849083..14a16e563ccbb 100644
--- a/x-pack/plugins/reporting/server/routes/index.ts
+++ b/x-pack/plugins/reporting/server/routes/index.ts
@@ -5,23 +5,22 @@
  * 2.0.
  */
 
-import { LevelLogger as Logger } from '../lib';
+import { ReportingCore } from '..';
+import { LevelLogger } from '../lib';
 import { registerDeprecationsRoutes } from './deprecations';
 import { registerDiagnosticRoutes } from './diagnostic';
-import { registerJobGenerationRoutes } from './generation';
-import { registerJobInfoRoutes } from './jobs';
-import { ReportingCore } from '../core';
+import {
+  registerGenerateCsvFromSavedObjectImmediate,
+  registerJobGenerationRoutes,
+  registerLegacy,
+} from './generate';
+import { registerJobInfoRoutes } from './management';
 
-export function registerRoutes(reporting: ReportingCore, logger: Logger) {
+export function registerRoutes(reporting: ReportingCore, logger: LevelLogger) {
   registerDeprecationsRoutes(reporting, logger);
   registerDiagnosticRoutes(reporting, logger);
+  registerGenerateCsvFromSavedObjectImmediate(reporting, logger);
   registerJobGenerationRoutes(reporting, logger);
+  registerLegacy(reporting, logger);
   registerJobInfoRoutes(reporting);
 }
-
-export interface ReportingRequestPre {
-  management: {
-    jobTypes: string[];
-  };
-  user: string;
-}
diff --git a/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts b/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
index c083849686ff0..89e6fcf7df21d 100644
--- a/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
+++ b/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
@@ -24,7 +24,7 @@ interface Payload {
   statusCode: number;
   content: string | Stream | ErrorFromPayload;
   contentType: string | null;
-  headers: Record<string, any>;
+  headers: Record<string, string | number>;
 }
 
 type TaskRunResult = Required<ReportApiJSON>['output'];
diff --git a/x-pack/plugins/reporting/server/routes/lib/job_response_handler.ts b/x-pack/plugins/reporting/server/routes/lib/job_response_handler.ts
index 5b63b2627f931..4033b317bef62 100644
--- a/x-pack/plugins/reporting/server/routes/lib/job_response_handler.ts
+++ b/x-pack/plugins/reporting/server/routes/lib/job_response_handler.ts
@@ -60,6 +60,7 @@ export async function downloadJobResponseHandler(
   } catch (err) {
     const { logger } = reporting.getPluginSetupDeps();
     logger.error(err);
+    throw err;
   }
 }
 
diff --git a/x-pack/plugins/reporting/server/routes/lib/jobs_query.ts b/x-pack/plugins/reporting/server/routes/lib/jobs_query.ts
index e15fa01362e97..afa83ed331672 100644
--- a/x-pack/plugins/reporting/server/routes/lib/jobs_query.ts
+++ b/x-pack/plugins/reporting/server/routes/lib/jobs_query.ts
@@ -11,9 +11,10 @@ import { ResponseError } from '@elastic/elasticsearch/lib/errors';
 import { i18n } from '@kbn/i18n';
 import { UnwrapPromise } from '@kbn/utility-types';
 import { ElasticsearchClient } from 'src/core/server';
+import { PromiseType } from 'utility-types';
 import { ReportingCore } from '../../';
-import { statuses } from '../../lib/statuses';
 import { ReportApiJSON, ReportSource } from '../../../common/types';
+import { statuses } from '../../lib/statuses';
 import { Report } from '../../lib/store';
 import { ReportingUser } from '../../types';
 
@@ -58,9 +59,9 @@ export function jobsQueryFactory(reportingCore: ReportingCore): JobsQueryFactory
     return `${config.get('index')}-*`;
   }
 
-  async function execQuery<T extends (client: ElasticsearchClient) => any>(
-    callback: T
-  ): Promise<UnwrapPromise<ReturnType<T>> | undefined> {
+  async function execQuery<
+    T extends (client: ElasticsearchClient) => Promise<PromiseType<ReturnType<T>> | undefined>
+  >(callback: T): Promise<UnwrapPromise<ReturnType<T>> | undefined> {
     try {
       const { asInternalUser: client } = await reportingCore.getEsClient();
 
diff --git a/x-pack/plugins/reporting/server/routes/lib/request_handler.test.ts b/x-pack/plugins/reporting/server/routes/lib/request_handler.test.ts
new file mode 100644
index 0000000000000..d730da4803fe9
--- /dev/null
+++ b/x-pack/plugins/reporting/server/routes/lib/request_handler.test.ts
@@ -0,0 +1,110 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { KibanaRequest, KibanaResponseFactory } from 'kibana/server';
+import { coreMock, httpServerMock } from 'src/core/server/mocks';
+import { ReportingCore } from '../..';
+import {
+  createMockConfigSchema,
+  createMockLevelLogger,
+  createMockReportingCore,
+} from '../../test_helpers';
+import { BaseParams, ReportingRequestHandlerContext, ReportingSetup } from '../../types';
+import { RequestHandler } from './request_handler';
+
+jest.mock('../../lib/enqueue_job', () => ({
+  enqueueJob: () => ({
+    _id: 'id-of-this-test-report',
+    toApiJSON: () => JSON.stringify({ id: 'id-of-this-test-report' }),
+  }),
+}));
+
+const getMockContext = () =>
+  (({
+    core: coreMock.createRequestHandlerContext(),
+  } as unknown) as ReportingRequestHandlerContext);
+
+const getMockRequest = () =>
+  ({
+    url: { port: '5601', search: '', pathname: '/foo' },
+    route: { path: '/foo', options: {} },
+  } as KibanaRequest);
+
+const getMockResponseFactory = () =>
+  (({
+    ...httpServerMock.createResponseFactory(),
+    forbidden: (obj: unknown) => obj,
+    unauthorized: (obj: unknown) => obj,
+  } as unknown) as KibanaResponseFactory);
+
+const mockLogger = createMockLevelLogger();
+
+describe('Handle request to generate', () => {
+  let reportingCore: ReportingCore;
+  let mockContext: ReturnType<typeof getMockContext>;
+  let mockRequest: ReturnType<typeof getMockRequest>;
+  let mockResponseFactory: ReturnType<typeof getMockResponseFactory>;
+  let requestHandler: RequestHandler;
+
+  const mockJobParams = {} as BaseParams;
+
+  beforeEach(async () => {
+    reportingCore = await createMockReportingCore(createMockConfigSchema({}));
+    mockRequest = getMockRequest();
+
+    mockResponseFactory = getMockResponseFactory();
+    (mockResponseFactory.ok as jest.Mock) = jest.fn((args: unknown) => args);
+    (mockResponseFactory.forbidden as jest.Mock) = jest.fn((args: unknown) => args);
+    (mockResponseFactory.badRequest as jest.Mock) = jest.fn((args: unknown) => args);
+
+    mockContext = getMockContext();
+    mockContext.reporting = {} as ReportingSetup;
+    requestHandler = new RequestHandler(
+      reportingCore,
+      { username: 'testymcgee' },
+      mockContext,
+      mockRequest,
+      mockResponseFactory,
+      mockLogger
+    );
+  });
+
+  test('disallows invalid export type', async () => {
+    expect(await requestHandler.handleGenerateRequest('neanderthals', mockJobParams))
+      .toMatchInlineSnapshot(`
+      Object {
+        "body": "Invalid export-type of neanderthals",
+      }
+    `);
+  });
+
+  test('disallows unsupporting license', async () => {
+    (reportingCore.getLicenseInfo as jest.Mock) = jest.fn(() => ({
+      csv: { enableLinks: false, message: `seeing this means the license isn't supported` },
+    }));
+
+    expect(await requestHandler.handleGenerateRequest('csv', mockJobParams)).toMatchInlineSnapshot(`
+      Object {
+        "body": "seeing this means the license isn't supported",
+      }
+    `);
+  });
+
+  test('generates the download path', async () => {
+    expect(await requestHandler.handleGenerateRequest('csv', mockJobParams)).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "job": "{\\"id\\":\\"id-of-this-test-report\\"}",
+          "path": "undefined/api/reporting/jobs/download/id-of-this-test-report",
+        },
+        "headers": Object {
+          "content-type": "application/json",
+        },
+      }
+    `);
+  });
+});
diff --git a/x-pack/plugins/reporting/server/routes/lib/request_handler.ts b/x-pack/plugins/reporting/server/routes/lib/request_handler.ts
new file mode 100644
index 0000000000000..8637000f41d95
--- /dev/null
+++ b/x-pack/plugins/reporting/server/routes/lib/request_handler.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import Boom from '@hapi/boom';
+import { KibanaRequest, KibanaResponseFactory } from 'kibana/server';
+import { ReportingCore } from '../..';
+import { API_BASE_URL } from '../../../common/constants';
+import { JobParamsPDFLegacy } from '../../export_types/printable_pdf/types';
+import { LevelLogger } from '../../lib';
+import { enqueueJob } from '../../lib/enqueue_job';
+import { BaseParams, ReportingRequestHandlerContext, ReportingUser } from '../../types';
+
+export const handleUnavailable = (res: KibanaResponseFactory) => {
+  return res.custom({ statusCode: 503, body: 'Not Available' });
+};
+
+const getDownloadBaseUrl = (reporting: ReportingCore) => {
+  const config = reporting.getConfig();
+  return config.kbnConfig.get('server', 'basePath') + `${API_BASE_URL}/jobs/download`;
+};
+
+export class RequestHandler {
+  constructor(
+    private reporting: ReportingCore,
+    private user: ReportingUser,
+    private context: ReportingRequestHandlerContext,
+    private req: KibanaRequest,
+    private res: KibanaResponseFactory,
+    private logger: LevelLogger
+  ) {}
+
+  public async handleGenerateRequest(
+    exportTypeId: string,
+    jobParams: BaseParams | JobParamsPDFLegacy
+  ) {
+    // ensure the async dependencies are loaded
+    if (!this.context.reporting) {
+      return handleUnavailable(this.res);
+    }
+
+    const licenseInfo = await this.reporting.getLicenseInfo();
+    const licenseResults = licenseInfo[exportTypeId];
+
+    if (!licenseResults) {
+      return this.res.badRequest({ body: `Invalid export-type of ${exportTypeId}` });
+    }
+
+    if (!licenseResults.enableLinks) {
+      return this.res.forbidden({ body: licenseResults.message });
+    }
+
+    try {
+      const report = await enqueueJob(
+        this.reporting,
+        this.req,
+        this.context,
+        this.user,
+        exportTypeId,
+        jobParams,
+        this.logger
+      );
+
+      // return task manager's task information and the download URL
+      const downloadBaseUrl = getDownloadBaseUrl(this.reporting);
+
+      return this.res.ok({
+        headers: { 'content-type': 'application/json' },
+        body: {
+          path: `${downloadBaseUrl}/${report._id}`,
+          job: report.toApiJSON(),
+        },
+      });
+    } catch (err) {
+      this.logger.error(err);
+      throw err;
+    }
+  }
+
+  /*
+   * This method does not log the error, as it assumes the error has already
+   * been caught and logged for stack trace context, and then rethrown
+   */
+  public handleError(err: Error | Boom.Boom) {
+    if (err instanceof Boom.Boom) {
+      return this.res.customError({
+        statusCode: err.output.statusCode,
+        body: err.output.payload.message,
+      });
+    }
+
+    // unknown error, can't convert to 4xx
+    throw err;
+  }
+}
diff --git a/x-pack/plugins/reporting/server/routes/management/index.ts b/x-pack/plugins/reporting/server/routes/management/index.ts
new file mode 100644
index 0000000000000..0c31b2b0d6a0c
--- /dev/null
+++ b/x-pack/plugins/reporting/server/routes/management/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { registerJobInfoRoutes } from './jobs';
diff --git a/x-pack/plugins/reporting/server/routes/jobs.test.ts b/x-pack/plugins/reporting/server/routes/management/jobs.test.ts
similarity index 98%
rename from x-pack/plugins/reporting/server/routes/jobs.test.ts
rename to x-pack/plugins/reporting/server/routes/management/jobs.test.ts
index 883970bd45a74..c14976f616c7b 100644
--- a/x-pack/plugins/reporting/server/routes/jobs.test.ts
+++ b/x-pack/plugins/reporting/server/routes/management/jobs.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-jest.mock('../lib/content_stream', () => ({
+jest.mock('../../lib/content_stream', () => ({
   getContentStream: jest.fn(),
 }));
 
@@ -16,15 +16,15 @@ import { of } from 'rxjs';
 import { ElasticsearchClient } from 'kibana/server';
 import { setupServer } from 'src/core/server/test_utils';
 import supertest from 'supertest';
-import { ReportingCore } from '..';
-import { ReportingInternalSetup } from '../core';
-import { ContentStream, ExportTypesRegistry, getContentStream } from '../lib';
+import { ReportingCore } from '../..';
+import { ReportingInternalSetup } from '../../core';
+import { ContentStream, ExportTypesRegistry, getContentStream } from '../../lib';
 import {
   createMockConfigSchema,
   createMockPluginSetup,
   createMockReportingCore,
-} from '../test_helpers';
-import { ExportTypeDefinition, ReportingRequestHandlerContext } from '../types';
+} from '../../test_helpers';
+import { ExportTypeDefinition, ReportingRequestHandlerContext } from '../../types';
 import { registerJobInfoRoutes } from './jobs';
 
 type SetupServerReturn = UnwrapPromise<ReturnType<typeof setupServer>>;
diff --git a/x-pack/plugins/reporting/server/routes/jobs.ts b/x-pack/plugins/reporting/server/routes/management/jobs.ts
similarity index 91%
rename from x-pack/plugins/reporting/server/routes/jobs.ts
rename to x-pack/plugins/reporting/server/routes/management/jobs.ts
index 6086c1b9eb872..99c317453ca0f 100644
--- a/x-pack/plugins/reporting/server/routes/jobs.ts
+++ b/x-pack/plugins/reporting/server/routes/management/jobs.ts
@@ -5,21 +5,18 @@
  * 2.0.
  */
 
-import { schema } from '@kbn/config-schema';
 import Boom from '@hapi/boom';
-import { ROUTE_TAG_CAN_REDIRECT } from '../../../security/server';
-import { ReportingCore } from '../';
-import { API_BASE_URL } from '../../common/constants';
-import { authorizedUserPreRouting } from './lib/authorized_user_pre_routing';
-import { jobsQueryFactory } from './lib/jobs_query';
-import { deleteJobResponseHandler, downloadJobResponseHandler } from './lib/job_response_handler';
+import { schema } from '@kbn/config-schema';
+import { ReportingCore } from '../../';
+import { ROUTE_TAG_CAN_REDIRECT } from '../../../../security/server';
+import { API_BASE_URL } from '../../../common/constants';
+import { authorizedUserPreRouting } from '../lib/authorized_user_pre_routing';
+import { jobsQueryFactory } from '../lib/jobs_query';
+import { deleteJobResponseHandler, downloadJobResponseHandler } from '../lib/job_response_handler';
+import { handleUnavailable } from '../lib/request_handler';
 
 const MAIN_ENTRY = `${API_BASE_URL}/jobs`;
 
-const handleUnavailable = (res: any) => {
-  return res.custom({ statusCode: 503, body: 'Not Available' });
-};
-
 export function registerJobInfoRoutes(reporting: ReportingCore) {
   const setupDeps = reporting.getPluginSetupDeps();
   const { router } = setupDeps;
diff --git a/x-pack/plugins/reporting/server/routes/types.d.ts b/x-pack/plugins/reporting/server/routes/types.d.ts
deleted file mode 100644
index 336605e6ff9b9..0000000000000
--- a/x-pack/plugins/reporting/server/routes/types.d.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { KibanaRequest, KibanaResponseFactory } from 'src/core/server';
-import type {
-  BaseParams,
-  BaseParamsLegacyPDF,
-  BasePayload,
-  ReportingRequestHandlerContext,
-  ReportingUser,
-} from '../types';
-
-export type HandlerFunction = (
-  user: ReportingUser,
-  exportType: string,
-  jobParams: BaseParams | BaseParamsLegacyPDF,
-  context: ReportingRequestHandlerContext,
-  req: KibanaRequest,
-  res: KibanaResponseFactory
-) => any;
-
-export type HandlerErrorFunction = (res: KibanaResponseFactory, err: Error) => any;
-
-export interface QueuedJobPayload {
-  error?: boolean;
-  source: {
-    job: {
-      payload: BasePayload;
-    };
-  };
-}
diff --git a/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx b/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx
index 3e3c91133eab6..ac49d8e90498d 100644
--- a/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx
@@ -11,7 +11,7 @@ import { useGlobalHeaderPortal } from '../../../../common/hooks/use_global_heade
 
 const StyledStickyWrapper = styled.div`
   position: sticky;
-  z-index: ${(props) => props.theme.eui.euiZLevel2};
+  z-index: ${(props) => props.theme.eui.euiZHeaderBelowDataGrid};
   // TOP location is declared in src/public/rendering/_base.scss to keep in line with Kibana Chrome
 `;
 
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
index b8b6b9766bdde..057d28b0112ad 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
@@ -321,7 +321,7 @@ const EventsViewerComponent: React.FC<Props> = ({
                 refetch={refetch}
               />
 
-              {graphEventId && <GraphOverlay isEventViewer={true} timelineId={id} />}
+              {graphEventId && <GraphOverlay timelineId={id} />}
               <FullWidthFlexGroup $visible={!graphEventId} gutterSize="none">
                 <ScrollableFlexItem grow={1}>
                   <StatefulBody
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
index c91b646aba967..6bfe61b3eac51 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
@@ -147,9 +147,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
   const trailingControlColumns: ControlColumnProps[] = EMPTY_CONTROL_COLUMNS;
   const graphOverlay = useMemo(
     () =>
-      graphEventId != null && graphEventId.length > 0 ? (
-        <GraphOverlay isEventViewer={true} timelineId={id} />
-      ) : null,
+      graphEventId != null && graphEventId.length > 0 ? <GraphOverlay timelineId={id} /> : null,
     [graphEventId, id]
   );
   const setQuery = useCallback(
diff --git a/x-pack/plugins/security_solution/public/common/containers/use_full_screen/index.tsx b/x-pack/plugins/security_solution/public/common/containers/use_full_screen/index.tsx
index e19db8bb94b46..bd9c16e3d88e6 100644
--- a/x-pack/plugins/security_solution/public/common/containers/use_full_screen/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/use_full_screen/index.tsx
@@ -28,7 +28,6 @@ export const resetScroll = () => {
     }
   }, 0);
 };
-
 interface GlobalFullScreen {
   globalFullScreen: boolean;
   setGlobalFullScreen: (fullScreen: boolean) => void;
@@ -46,10 +45,10 @@ export const useGlobalFullScreen = (): GlobalFullScreen => {
   const setGlobalFullScreen = useCallback(
     (fullScreen: boolean) => {
       if (fullScreen) {
-        document.body.classList.add(SCROLLING_DISABLED_CLASS_NAME);
+        document.body.classList.add(SCROLLING_DISABLED_CLASS_NAME, 'euiDataGrid__restrictBody');
         resetScroll();
       } else {
-        document.body.classList.remove(SCROLLING_DISABLED_CLASS_NAME);
+        document.body.classList.remove(SCROLLING_DISABLED_CLASS_NAME, 'euiDataGrid__restrictBody');
         resetScroll();
       }
 
@@ -71,9 +70,15 @@ export const useTimelineFullScreen = (): TimelineFullScreen => {
   const dispatch = useDispatch();
   const timelineFullScreen =
     useShallowEqualSelector(inputsSelectors.timelineFullScreenSelector) ?? false;
-
   const setTimelineFullScreen = useCallback(
-    (fullScreen: boolean) => dispatch(inputsActions.setFullScreen({ id: 'timeline', fullScreen })),
+    (fullScreen: boolean) => {
+      if (fullScreen) {
+        document.body.classList.add('euiDataGrid__restrictBody');
+      } else {
+        document.body.classList.remove('euiDataGrid__restrictBody');
+      }
+      dispatch(inputsActions.setFullScreen({ id: 'timeline', fullScreen }));
+    },
     [dispatch]
   );
   const memoizedReturn = useMemo(
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
index 2e23ecc648aee..21d0e132599fb 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
@@ -13,6 +13,10 @@ import {
   setActiveTabTimeline,
   updateTimelineGraphEventId,
 } from '../../../../timelines/store/timeline/actions';
+import {
+  useGlobalFullScreen,
+  useTimelineFullScreen,
+} from '../../../../common/containers/use_full_screen';
 import { TimelineId, TimelineTabs } from '../../../../../common';
 import { ACTION_INVESTIGATE_IN_RESOLVER } from '../../../../timelines/components/timeline/body/translations';
 import { Ecs } from '../../../../../common/ecs';
@@ -35,13 +39,23 @@ export const useInvestigateInResolverContextItem = ({
 }: InvestigateInResolverProps) => {
   const dispatch = useDispatch();
   const isDisabled = useMemo(() => !isInvestigateInResolverActionEnabled(ecsData), [ecsData]);
+  const { setGlobalFullScreen } = useGlobalFullScreen();
+  const { setTimelineFullScreen } = useTimelineFullScreen();
   const handleClick = useCallback(() => {
+    const dataGridIsFullScreen = document.querySelector('.euiDataGrid--fullScreen');
     dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: ecsData._id }));
     if (timelineId === TimelineId.active) {
+      if (dataGridIsFullScreen) {
+        setTimelineFullScreen(true);
+      }
       dispatch(setActiveTabTimeline({ id: timelineId, activeTab: TimelineTabs.graph }));
+    } else {
+      if (dataGridIsFullScreen) {
+        setGlobalFullScreen(true);
+      }
     }
     onClose();
-  }, [dispatch, ecsData._id, onClose, timelineId]);
+  }, [dispatch, ecsData._id, onClose, timelineId, setGlobalFullScreen, setTimelineFullScreen]);
   return isDisabled
     ? []
     : [
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index 4c3db2ae62be3..4d4ac102ea645 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -695,7 +695,7 @@ const RuleDetailsPageComponent: React.FC<DetectionEngineComponentProps> = ({
                           enabled={isExistingRule && (rule?.enabled ?? false)}
                           onChange={handleOnChangeEnabledRule}
                         />
-                        <EuiFlexItem>{i18n.ACTIVATED_RULE}</EuiFlexItem>
+                        <EuiFlexItem>{i18n.ACTIVATE_RULE}</EuiFlexItem>
                       </EuiFlexGroup>
                     </EuiToolTip>
                   </EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/translations.ts
index ca3e5a4587a09..a83647f8a9781 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/translations.ts
@@ -28,10 +28,10 @@ export const EXPERIMENTAL = i18n.translate(
   }
 );
 
-export const ACTIVATED_RULE = i18n.translate(
-  'xpack.securitySolution.detectionEngine.ruleDetails.activatedRuleLabel',
+export const ACTIVATE_RULE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.ruleDetails.activateRuleLabel',
   {
-    defaultMessage: 'Activated',
+    defaultMessage: 'Activate',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx
index 1286208bff9e6..d672a3c699707 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx
@@ -44,12 +44,10 @@ describe('GraphOverlay', () => {
   });
 
   describe('when used in an events viewer (i.e. in the Detections view, or the Host > Events view)', () => {
-    const isEventViewer = true;
-
-    test('it has 100% width when isEventViewer is true and NOT in full screen mode', async () => {
+    test('it has 100% width when NOT in full screen mode', async () => {
       const wrapper = mount(
         <TestProviders>
-          <GraphOverlay timelineId={TimelineId.test} isEventViewer={isEventViewer} />
+          <GraphOverlay timelineId={TimelineId.test} />
         </TestProviders>
       );
 
@@ -59,9 +57,9 @@ describe('GraphOverlay', () => {
       });
     });
 
-    test('it has a calculated width that makes room for the Timeline flyout button when isEventViewer is true in full screen mode', async () => {
+    test('it has a fixed position when in full screen mode', async () => {
       (useGlobalFullScreen as jest.Mock).mockReturnValue({
-        globalFullScreen: true, // <-- true when an events viewer is in full screen mode
+        globalFullScreen: true,
         setGlobalFullScreen: jest.fn(),
       });
       (useTimelineFullScreen as jest.Mock).mockReturnValue({
@@ -71,25 +69,24 @@ describe('GraphOverlay', () => {
 
       const wrapper = mount(
         <TestProviders>
-          <GraphOverlay timelineId={TimelineId.test} isEventViewer={isEventViewer} />
+          <GraphOverlay timelineId={TimelineId.test} />
         </TestProviders>
       );
 
       await waitFor(() => {
         const overlayContainer = wrapper.find('[data-test-subj="overlayContainer"]').first();
-        expect(overlayContainer).toHaveStyleRule('width', 'calc(100% - 36px)');
+        expect(overlayContainer).toHaveStyleRule('position', 'fixed');
       });
     });
   });
 
   describe('when used in the active timeline', () => {
-    const isEventViewer = false;
     const timelineId = TimelineId.active;
 
-    test('it has 100% width when isEventViewer is false and NOT in full screen mode', async () => {
+    test('it has 100% width when NOT in full screen mode', async () => {
       const wrapper = mount(
         <TestProviders>
-          <GraphOverlay timelineId={timelineId} isEventViewer={isEventViewer} />
+          <GraphOverlay timelineId={timelineId} />
         </TestProviders>
       );
 
@@ -99,7 +96,7 @@ describe('GraphOverlay', () => {
       });
     });
 
-    test('it has 100% width when isEventViewer is false and the active timeline is in full screen mode', async () => {
+    test('it has 100% width when the active timeline is in full screen mode', async () => {
       (useGlobalFullScreen as jest.Mock).mockReturnValue({
         globalFullScreen: false,
         setGlobalFullScreen: jest.fn(),
@@ -111,7 +108,7 @@ describe('GraphOverlay', () => {
 
       const wrapper = mount(
         <TestProviders>
-          <GraphOverlay timelineId={timelineId} isEventViewer={isEventViewer} />
+          <GraphOverlay timelineId={timelineId} />
         </TestProviders>
       );
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
index a8cfea1de8e74..16459381a8431 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
@@ -41,13 +41,19 @@ import {
 import * as i18n from './translations';
 
 const OverlayContainer = styled.div`
-  ${({ $restrictWidth }: { $restrictWidth: boolean }) =>
-    `
-    display: flex;
-    flex-direction: column;
-    flex: 1;
-    width: ${$restrictWidth ? 'calc(100% - 36px)' : '100%'};
-    `}
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+  width: 100%;
+`;
+
+const FullScreenOverlayContainer = styled.div`
+  position: fixed;
+  top: 0;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  z-index: ${(props) => props.theme.eui.euiZLevel3};
 `;
 
 const StyledResolver = styled(Resolver)`
@@ -59,7 +65,6 @@ const FullScreenButtonIcon = styled(EuiButtonIcon)`
 `;
 
 interface OwnProps {
-  isEventViewer: boolean;
   timelineId: TimelineId;
 }
 
@@ -111,18 +116,15 @@ NavigationComponent.displayName = 'NavigationComponent';
 
 const Navigation = React.memo(NavigationComponent);
 
-const GraphOverlayComponent: React.FC<OwnProps> = ({ isEventViewer, timelineId }) => {
+const GraphOverlayComponent: React.FC<OwnProps> = ({ timelineId }) => {
   const dispatch = useDispatch();
-  const onCloseOverlay = useCallback(() => {
-    dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: '' }));
-  }, [dispatch, timelineId]);
+  const { globalFullScreen, setGlobalFullScreen } = useGlobalFullScreen();
+  const { timelineFullScreen, setTimelineFullScreen } = useTimelineFullScreen();
+
   const getTimeline = useMemo(() => timelineSelectors.getTimelineByIdSelector(), []);
   const graphEventId = useDeepEqualSelector(
     (state) => (getTimeline(state, timelineId) ?? timelineDefaults).graphEventId
   );
-
-  const { globalFullScreen, setGlobalFullScreen } = useGlobalFullScreen();
-  const { timelineFullScreen, setTimelineFullScreen } = useTimelineFullScreen();
   const getStartSelector = useMemo(() => startSelector(), []);
   const getEndSelector = useMemo(() => endSelector(), []);
   const getIsLoadingSelector = useMemo(() => isLoadingSelector(), []);
@@ -154,6 +156,16 @@ const GraphOverlayComponent: React.FC<OwnProps> = ({ isEventViewer, timelineId }
     [globalFullScreen, timelineId, timelineFullScreen]
   );
 
+  const isInTimeline = timelineId === TimelineId.active;
+  const onCloseOverlay = useCallback(() => {
+    if (timelineId === TimelineId.active) {
+      setTimelineFullScreen(false);
+    } else {
+      setGlobalFullScreen(false);
+    }
+    dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: '' }));
+  }, [dispatch, timelineId, setTimelineFullScreen, setGlobalFullScreen]);
+
   const toggleFullScreen = useCallback(() => {
     if (timelineId === TimelineId.active) {
       setTimelineFullScreen(!timelineFullScreen);
@@ -173,41 +185,71 @@ const GraphOverlayComponent: React.FC<OwnProps> = ({ isEventViewer, timelineId }
     []
   );
   const existingIndexNames = useDeepEqualSelector<string[]>(existingIndexNamesSelector);
-
-  return (
-    <OverlayContainer
-      data-test-subj="overlayContainer"
-      $restrictWidth={isEventViewer && fullScreen}
-    >
-      <EuiHorizontalRule margin="none" />
-      <EuiFlexGroup gutterSize="none" justifyContent="spaceBetween">
-        <EuiFlexItem grow={false}>
-          <Navigation
-            fullScreen={fullScreen}
-            globalFullScreen={globalFullScreen}
-            onCloseOverlay={onCloseOverlay}
-            timelineId={timelineId}
-            timelineFullScreen={timelineFullScreen}
-            toggleFullScreen={toggleFullScreen}
+  if (fullScreen && !isInTimeline) {
+    return (
+      <FullScreenOverlayContainer data-test-subj="overlayContainer">
+        <EuiHorizontalRule margin="none" />
+        <EuiFlexGroup gutterSize="none" justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <Navigation
+              fullScreen={fullScreen}
+              globalFullScreen={globalFullScreen}
+              onCloseOverlay={onCloseOverlay}
+              timelineId={timelineId}
+              timelineFullScreen={timelineFullScreen}
+              toggleFullScreen={toggleFullScreen}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+        <EuiHorizontalRule margin="none" />
+        {graphEventId !== undefined ? (
+          <StyledResolver
+            databaseDocumentID={graphEventId}
+            resolverComponentInstanceID={timelineId}
+            indices={existingIndexNames}
+            shouldUpdate={shouldUpdate}
+            filters={{ from, to }}
           />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      <EuiHorizontalRule margin="none" />
-      {graphEventId !== undefined ? (
-        <StyledResolver
-          databaseDocumentID={graphEventId}
-          resolverComponentInstanceID={timelineId}
-          indices={existingIndexNames}
-          shouldUpdate={shouldUpdate}
-          filters={{ from, to }}
-        />
-      ) : (
-        <EuiFlexGroup alignItems="center" justifyContent="center" style={{ height: '100%' }}>
-          <EuiLoadingSpinner size="xl" />
+        ) : (
+          <EuiFlexGroup alignItems="center" justifyContent="center" style={{ height: '100%' }}>
+            <EuiLoadingSpinner size="xl" />
+          </EuiFlexGroup>
+        )}
+      </FullScreenOverlayContainer>
+    );
+  } else {
+    return (
+      <OverlayContainer data-test-subj="overlayContainer">
+        <EuiHorizontalRule margin="none" />
+        <EuiFlexGroup gutterSize="none" justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <Navigation
+              fullScreen={fullScreen}
+              globalFullScreen={globalFullScreen}
+              onCloseOverlay={onCloseOverlay}
+              timelineId={timelineId}
+              timelineFullScreen={timelineFullScreen}
+              toggleFullScreen={toggleFullScreen}
+            />
+          </EuiFlexItem>
         </EuiFlexGroup>
-      )}
-    </OverlayContainer>
-  );
+        <EuiHorizontalRule margin="none" />
+        {graphEventId !== undefined ? (
+          <StyledResolver
+            databaseDocumentID={graphEventId}
+            resolverComponentInstanceID={timelineId}
+            indices={existingIndexNames}
+            shouldUpdate={shouldUpdate}
+            filters={{ from, to }}
+          />
+        ) : (
+          <EuiFlexGroup alignItems="center" justifyContent="center" style={{ height: '100%' }}>
+            <EuiLoadingSpinner size="xl" />
+          </EuiFlexGroup>
+        )}
+      </OverlayContainer>
+    );
+  }
 };
 
 export const GraphOverlay = React.memo(GraphOverlayComponent);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/graph_tab_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/graph_tab_content/index.tsx
index 1678a92c4cdaa..64d3f01cff265 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/graph_tab_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/graph_tab_content/index.tsx
@@ -26,7 +26,7 @@ const GraphTabContentComponent: React.FC<GraphTabContentProps> = ({ timelineId }
     return null;
   }
 
-  return <GraphOverlay isEventViewer={false} timelineId={timelineId} />;
+  return <GraphOverlay timelineId={timelineId} />;
 };
 
 GraphTabContentComponent.displayName = 'GraphTabContentComponent';
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
index a1f63a6d4e0c6..a4e812e8f111a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
@@ -121,10 +121,9 @@ export const buildSignalFromSequence = (
 ): SignalHit => {
   const rule = buildRuleWithoutOverrides(ruleSO);
   const timestamp = new Date().toISOString();
-
-  const reason = buildReasonMessage({ rule });
-  const signal: Signal = buildSignal(events, rule, reason);
   const mergedEvents = objectArrayIntersection(events.map((event) => event._source));
+  const reason = buildReasonMessage({ rule, mergedDoc: mergedEvents as SignalSourceHit });
+  const signal: Signal = buildSignal(events, rule, reason);
   return {
     ...mergedEvents,
     '@timestamp': timestamp,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
index 55cd7b942b3d8..49f70eafd7d3a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
@@ -137,6 +137,52 @@ describe('get_filter', () => {
       });
     });
 
+    test('returns the query persisted to the threat_match rule, despite saved_id being specified', async () => {
+      const filter = await getFilter({
+        type: 'threat_match',
+        filters: undefined,
+        language: 'kuery',
+        query: 'host.name: siem',
+        savedId: 'some-id',
+        services: servicesMock,
+        index: ['auditbeat-*'],
+        lists: [],
+      });
+      expect(filter).toEqual({
+        bool: {
+          filter: [
+            { bool: { minimum_should_match: 1, should: [{ match: { 'host.name': 'siem' } }] } },
+          ],
+          must: [],
+          must_not: [],
+          should: [],
+        },
+      });
+    });
+
+    test('returns the query persisted to the threshold rule, despite saved_id being specified', async () => {
+      const filter = await getFilter({
+        type: 'threat_match',
+        filters: undefined,
+        language: 'kuery',
+        query: 'host.name: siem',
+        savedId: 'some-id',
+        services: servicesMock,
+        index: ['auditbeat-*'],
+        lists: [],
+      });
+      expect(filter).toEqual({
+        bool: {
+          filter: [
+            { bool: { minimum_should_match: 1, should: [{ match: { 'host.name': 'siem' } }] } },
+          ],
+          must: [],
+          must_not: [],
+          should: [],
+        },
+      });
+    });
+
     test('throws on saved query if saved_id is undefined', async () => {
       await expect(
         getFilter({
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
index 346c4adeba537..574020af45c15 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
@@ -94,9 +94,7 @@ export const getFilter = async ({
 
   switch (type) {
     case 'threat_match':
-    case 'threshold': {
-      return savedId != null ? savedQueryFilter() : queryFilter();
-    }
+    case 'threshold':
     case 'query': {
       return queryFilter();
     }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/reason_formatter.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/reason_formatter.test.ts
index 1a383b51eb8d4..5b55df2bee936 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/reason_formatter.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/reason_formatter.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { buildCommonReasonMessage } from './reason_formatters';
+import { buildReasonMessageUtil } from './reason_formatters';
 import { RulesSchema } from '../../../../common/detection_engine/schemas/response/rules_schema';
 import { SignalSourceHit } from './types';
 
@@ -14,26 +14,48 @@ describe('reason_formatter', () => {
   let mergedDoc: SignalSourceHit;
   beforeAll(() => {
     rule = {
-      name: 'What is in a name',
+      name: 'my-rule',
       risk_score: 9000,
       severity: 'medium',
     } as RulesSchema; // Cast here as all fields aren't required
     mergedDoc = {
-      _index: 'some-index',
-      _id: 'some-id',
+      _index: 'index-1',
+      _id: 'id-1',
       fields: {
-        'host.name': ['party host'],
-        'user.name': ['ferris bueller'],
+        'destination.address': ['9.99.99.9'],
+        'destination.port': ['6789'],
+        'event.category': ['test'],
+        'file.name': ['sample'],
+        'host.name': ['host'],
+        'process.name': ['doingThings.exe'],
+        'process.parent.name': ['didThings.exe'],
+        'source.address': ['1.11.11.1'],
+        'source.port': ['1234'],
+        'user.name': ['test-user'],
         '@timestamp': '2021-08-11T02:28:59.101Z',
       },
     };
   });
 
-  describe('buildCommonReasonMessage', () => {
+  describe('buildReasonMessageUtil', () => {
     describe('when rule and mergedDoc are provided', () => {
       it('should return the full reason message', () => {
-        expect(buildCommonReasonMessage({ rule, mergedDoc })).toEqual(
-          'Alert What is in a name created with a medium severity and risk score of 9000 by ferris bueller on party host.'
+        expect(buildReasonMessageUtil({ rule, mergedDoc })).toMatchInlineSnapshot(
+          `"test event with process doingThings.exe, parent process didThings.exe, file sample, source 1.11.11.1:1234, destination 9.99.99.9:6789, by test-user on host created medium alert my-rule."`
+        );
+      });
+    });
+    describe('when event category contains multiple items', () => {
+      it('should return the reason message with all categories showing', () => {
+        const updatedMergedDoc = {
+          ...mergedDoc,
+          fields: {
+            ...mergedDoc.fields,
+            'event.category': ['item one', 'item two'],
+          },
+        };
+        expect(buildReasonMessageUtil({ rule, mergedDoc: updatedMergedDoc })).toMatchInlineSnapshot(
+          `"item one, item two event with process doingThings.exe, parent process didThings.exe, file sample, source 1.11.11.1:1234, destination 9.99.99.9:6789, by test-user on host created medium alert my-rule."`
         );
       });
     });
@@ -46,8 +68,8 @@ describe('reason_formatter', () => {
             'host.name': ['-'],
           },
         };
-        expect(buildCommonReasonMessage({ rule, mergedDoc: updatedMergedDoc })).toEqual(
-          'Alert What is in a name created with a medium severity and risk score of 9000 by ferris bueller.'
+        expect(buildReasonMessageUtil({ rule, mergedDoc: updatedMergedDoc })).toMatchInlineSnapshot(
+          `"test event with process doingThings.exe, parent process didThings.exe, file sample, source 1.11.11.1:1234, destination 9.99.99.9:6789, by test-user created medium alert my-rule."`
         );
       });
     });
@@ -60,16 +82,102 @@ describe('reason_formatter', () => {
             'user.name': ['-'],
           },
         };
-        expect(buildCommonReasonMessage({ rule, mergedDoc: updatedMergedDoc })).toEqual(
-          'Alert What is in a name created with a medium severity and risk score of 9000 on party host.'
+        expect(buildReasonMessageUtil({ rule, mergedDoc: updatedMergedDoc })).toMatchInlineSnapshot(
+          `"test event with process doingThings.exe, parent process didThings.exe, file sample, source 1.11.11.1:1234, destination 9.99.99.9:6789, on host created medium alert my-rule."`
+        );
+      });
+    });
+    describe('when rule and mergedDoc are provided, but destination details are missing', () => {
+      it('should return the reason message without the destination port', () => {
+        const noDestinationPortDoc = {
+          ...mergedDoc,
+          fields: {
+            ...mergedDoc.fields,
+            'destination.port': ['-'],
+          },
+        };
+        expect(
+          buildReasonMessageUtil({ rule, mergedDoc: noDestinationPortDoc })
+        ).toMatchInlineSnapshot(
+          `"test event with process doingThings.exe, parent process didThings.exe, file sample, source 1.11.11.1:1234, destination 9.99.99.9 by test-user on host created medium alert my-rule."`
+        );
+      });
+      it('should return the reason message without destination details', () => {
+        const noDestinationPortDoc = {
+          ...mergedDoc,
+          fields: {
+            ...mergedDoc.fields,
+            'destination.address': ['-'],
+            'destination.port': ['-'],
+          },
+        };
+        expect(
+          buildReasonMessageUtil({ rule, mergedDoc: noDestinationPortDoc })
+        ).toMatchInlineSnapshot(
+          `"test event with process doingThings.exe, parent process didThings.exe, file sample, source 1.11.11.1:1234, by test-user on host created medium alert my-rule."`
+        );
+      });
+    });
+    describe('when rule and mergedDoc are provided, but source details are missing', () => {
+      it('should return the reason message without the source port', () => {
+        const noSourcePortDoc = {
+          ...mergedDoc,
+          fields: {
+            ...mergedDoc.fields,
+            'source.port': ['-'],
+          },
+        };
+        expect(buildReasonMessageUtil({ rule, mergedDoc: noSourcePortDoc })).toMatchInlineSnapshot(
+          `"test event with process doingThings.exe, parent process didThings.exe, file sample, source 1.11.11.1 destination 9.99.99.9:6789, by test-user on host created medium alert my-rule."`
+        );
+      });
+      it('should return the reason message without source details', () => {
+        const noSourcePortDoc = {
+          ...mergedDoc,
+          fields: {
+            ...mergedDoc.fields,
+            'source.address': ['-'],
+            'source.port': ['-'],
+          },
+        };
+        expect(buildReasonMessageUtil({ rule, mergedDoc: noSourcePortDoc })).toMatchInlineSnapshot(
+          `"test event with process doingThings.exe, parent process didThings.exe, file sample, destination 9.99.99.9:6789, by test-user on host created medium alert my-rule."`
+        );
+      });
+    });
+    describe('when rule and mergedDoc are provided, but process details missing', () => {
+      it('should return the reason message without process details', () => {
+        const updatedMergedDoc = {
+          ...mergedDoc,
+          fields: {
+            ...mergedDoc.fields,
+            'process.name': ['-'],
+            'process.parent.name': ['-'],
+          },
+        };
+        expect(buildReasonMessageUtil({ rule, mergedDoc: updatedMergedDoc })).toMatchInlineSnapshot(
+          `"test event with file sample, source 1.11.11.1:1234, destination 9.99.99.9:6789, by test-user on host created medium alert my-rule."`
+        );
+      });
+    });
+    describe('when rule and mergedDoc are provided without any fields of interest', () => {
+      it('should return the full reason message', () => {
+        const updatedMergedDoc = {
+          ...mergedDoc,
+          fields: {
+            'event.category': ['test'],
+            'user.name': ['test-user'],
+            '@timestamp': '2021-08-11T02:28:59.101Z',
+          },
+        };
+        expect(buildReasonMessageUtil({ rule, mergedDoc: updatedMergedDoc })).toMatchInlineSnapshot(
+          `"test event by test-user created medium alert my-rule."`
         );
       });
     });
     describe('when only rule is provided', () => {
       it('should return the reason message without host name or user name', () => {
-        expect(buildCommonReasonMessage({ rule })).toEqual(
-          'Alert What is in a name created with a medium severity and risk score of 9000.'
-        );
+        expect(buildReasonMessageUtil({ rule })).toMatchInlineSnapshot(`""`);
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/reason_formatters.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/reason_formatters.ts
index 4917cdbd29170..e93a45bd13246 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/reason_formatters.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/reason_formatters.ts
@@ -6,6 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { getOr } from 'lodash/fp';
 import { RulesSchema } from '../../../../common/detection_engine/schemas/response/rules_schema';
 import { SignalSourceHit } from './types';
 
@@ -14,54 +15,118 @@ export interface BuildReasonMessageArgs {
   mergedDoc?: SignalSourceHit;
 }
 
+export interface BuildReasonMessageUtilArgs extends BuildReasonMessageArgs {
+  type?: 'eql' | 'ml' | 'query' | 'threatMatch' | 'threshold';
+}
+
 export type BuildReasonMessage = (args: BuildReasonMessageArgs) => string;
 
+interface ReasonFields {
+  destinationAddress?: string | string[] | null;
+  destinationPort?: string | string[] | null;
+  eventCategory?: string | string[] | null;
+  fileName?: string | string[] | null;
+  hostName?: string | string[] | null;
+  processName?: string | string[] | null;
+  processParentName?: string | string[] | null;
+  sourceAddress?: string | string[] | null;
+  sourcePort?: string | string[] | null;
+  userName?: string | string[] | null;
+}
+const getFieldsFromDoc = (mergedDoc: SignalSourceHit) => {
+  const reasonFields: ReasonFields = {};
+  const docToUse = mergedDoc?.fields || mergedDoc;
+
+  reasonFields.destinationAddress = getOr(null, 'destination.address', docToUse);
+  reasonFields.destinationPort = getOr(null, 'destination.port', docToUse);
+  reasonFields.eventCategory = getOr(null, 'event.category', docToUse);
+  reasonFields.fileName = getOr(null, 'file.name', docToUse);
+  reasonFields.hostName = getOr(null, 'host.name', docToUse);
+  reasonFields.processName = getOr(null, 'process.name', docToUse);
+  reasonFields.processParentName = getOr(null, 'process.parent.name', docToUse);
+  reasonFields.sourceAddress = getOr(null, 'source.address', docToUse);
+  reasonFields.sourcePort = getOr(null, 'source.port', docToUse);
+  reasonFields.userName = getOr(null, 'user.name', docToUse);
+
+  return reasonFields;
+};
 /**
  * Currently all security solution rule types share a common reason message string. This function composes that string
  * In the future there may be different configurations based on the different rule types, so the plumbing has been put in place
  * to more easily allow for this in the future.
  * @export buildCommonReasonMessage - is only exported for testing purposes, and only used internally here.
  */
-export const buildCommonReasonMessage = ({ rule, mergedDoc }: BuildReasonMessageArgs) => {
-  if (!rule) {
+export const buildReasonMessageUtil = ({ rule, mergedDoc }: BuildReasonMessageUtilArgs) => {
+  if (!rule || !mergedDoc) {
     // This should never happen, but in case, better to not show a malformed string
     return '';
   }
-  let hostName;
-  let userName;
-  if (mergedDoc?.fields) {
-    hostName = mergedDoc.fields['host.name'] != null ? mergedDoc.fields['host.name'] : hostName;
-    userName = mergedDoc.fields['user.name'] != null ? mergedDoc.fields['user.name'] : userName;
-  }
+  const {
+    destinationAddress,
+    destinationPort,
+    eventCategory,
+    fileName,
+    hostName,
+    processName,
+    processParentName,
+    sourceAddress,
+    sourcePort,
+    userName,
+  } = getFieldsFromDoc(mergedDoc);
+
+  const fieldPresenceTracker = { hasFieldOfInterest: false };
 
-  const isFieldEmpty = (field: string | string[] | undefined | null) =>
-    !field || !field.length || (field.length === 1 && field[0] === '-');
+  const getFieldTemplateValue = (
+    field: string | string[] | undefined | null,
+    isFieldOfInterest?: boolean
+  ): string | null => {
+    if (!field || !field.length || (field.length === 1 && field[0] === '-')) return null;
+    if (isFieldOfInterest && !fieldPresenceTracker.hasFieldOfInterest)
+      fieldPresenceTracker.hasFieldOfInterest = true;
+    return Array.isArray(field) ? field.join(', ') : field;
+  };
 
   return i18n.translate('xpack.securitySolution.detectionEngine.signals.alertReasonDescription', {
-    defaultMessage:
-      'Alert {alertName} created with a {alertSeverity} severity and risk score of {alertRiskScore}{userName, select, null {} other {{whitespace}by {userName}} }{hostName, select, null {} other {{whitespace}on {hostName}} }.',
+    defaultMessage: `{eventCategory, select, null {} other {{eventCategory}{whitespace}}}event\
+{hasFieldOfInterest, select, false {} other {{whitespace}with}}\
+{processName, select, null {} other {{whitespace}process {processName},} }\
+{processParentName, select, null {} other {{whitespace}parent process {processParentName},} }\
+{fileName, select, null {} other {{whitespace}file {fileName},} }\
+{sourceAddress, select, null {} other {{whitespace}source {sourceAddress}}}{sourcePort, select, null {} other {:{sourcePort},}}\
+{destinationAddress, select, null {} other {{whitespace}destination {destinationAddress}}}{destinationPort, select, null {} other {:{destinationPort},}}\
+{userName, select, null {} other {{whitespace}by {userName}} }\
+{hostName, select, null {} other {{whitespace}on {hostName}} } \
+created {alertSeverity} alert {alertName}.`,
     values: {
       alertName: rule.name,
       alertSeverity: rule.severity,
-      alertRiskScore: rule.risk_score,
-      hostName: isFieldEmpty(hostName) ? 'null' : hostName,
-      userName: isFieldEmpty(userName) ? 'null' : userName,
+      destinationAddress: getFieldTemplateValue(destinationAddress, true),
+      destinationPort: getFieldTemplateValue(destinationPort, true),
+      eventCategory: getFieldTemplateValue(eventCategory),
+      fileName: getFieldTemplateValue(fileName, true),
+      hostName: getFieldTemplateValue(hostName),
+      processName: getFieldTemplateValue(processName, true),
+      processParentName: getFieldTemplateValue(processParentName, true),
+      sourceAddress: getFieldTemplateValue(sourceAddress, true),
+      sourcePort: getFieldTemplateValue(sourcePort, true),
+      userName: getFieldTemplateValue(userName),
+      hasFieldOfInterest: fieldPresenceTracker.hasFieldOfInterest, // Tracking if we have any fields to show the 'with' word
       whitespace: ' ', // there isn't support for the unicode /u0020 for whitespace, and leading spaces are deleted, so to prevent double-whitespace explicitly passing the space in.
     },
   });
 };
 
 export const buildReasonMessageForEqlAlert = (args: BuildReasonMessageArgs) =>
-  buildCommonReasonMessage({ ...args });
+  buildReasonMessageUtil({ ...args, type: 'eql' });
 
 export const buildReasonMessageForMlAlert = (args: BuildReasonMessageArgs) =>
-  buildCommonReasonMessage({ ...args });
+  buildReasonMessageUtil({ ...args, type: 'ml' });
 
 export const buildReasonMessageForQueryAlert = (args: BuildReasonMessageArgs) =>
-  buildCommonReasonMessage({ ...args });
+  buildReasonMessageUtil({ ...args, type: 'query' });
 
 export const buildReasonMessageForThreatMatchAlert = (args: BuildReasonMessageArgs) =>
-  buildCommonReasonMessage({ ...args });
+  buildReasonMessageUtil({ ...args, type: 'threatMatch' });
 
 export const buildReasonMessageForThresholdAlert = (args: BuildReasonMessageArgs) =>
-  buildCommonReasonMessage({ ...args });
+  buildReasonMessageUtil({ ...args, type: 'threshold' });
diff --git a/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx b/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
index e98d9fff04a0c..c3c83f6be72c8 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
@@ -8,7 +8,13 @@
 import type { AlertConsumers as AlertConsumersTyped } from '@kbn/rule-data-utils';
 // @ts-expect-error
 import { AlertConsumers as AlertConsumersNonTyped } from '@kbn/rule-data-utils/target_node/alerts_as_data_rbac';
-import { EuiEmptyPrompt, EuiLoadingContent, EuiPanel } from '@elastic/eui';
+import {
+  EuiEmptyPrompt,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiPanel,
+  EuiLoadingContent,
+} from '@elastic/eui';
 import { isEmpty } from 'lodash/fp';
 import React, { useEffect, useMemo, useRef, useState } from 'react';
 import styled from 'styled-components';
@@ -80,6 +86,16 @@ const EventsContainerLoading = styled.div.attrs(({ className = '' }) => ({
   flex-direction: column;
 `;
 
+const FullWidthFlexGroup = styled(EuiFlexGroup)<{ $visible: boolean }>`
+  overflow: hidden;
+  margin: 0;
+  display: ${({ $visible }) => ($visible ? 'flex' : 'none')};
+`;
+
+const ScrollableFlexItem = styled(EuiFlexItem)`
+  overflow: auto;
+`;
+
 const SECURITY_ALERTS_CONSUMERS = [AlertConsumers.SIEM];
 
 export interface TGridIntegratedProps {
@@ -309,56 +325,61 @@ const TGridIntegratedComponent: React.FC<TGridIntegratedProps> = ({
             </UpdatedFlexGroup>
 
             {!graphEventId && graphOverlay == null && (
-              <>
-                {totalCountMinusDeleted === 0 && loading === false && (
-                  <EuiEmptyPrompt
-                    title={
-                      <h2>
-                        <FormattedMessage
-                          id="xpack.timelines.tGrid.noResultsMatchSearchCriteriaTitle"
-                          defaultMessage="No results match your search criteria"
-                        />
-                      </h2>
-                    }
-                    titleSize="s"
-                    body={
-                      <p>
-                        <FormattedMessage
-                          id="xpack.timelines.tGrid.noResultsMatchSearchCriteriaDescription"
-                          defaultMessage="Try searching over a longer period of time or modifying your search."
-                        />
-                      </p>
-                    }
-                  />
-                )}
-                {totalCountMinusDeleted > 0 && (
-                  <StatefulBody
-                    hasAlertsCrud={hasAlertsCrud}
-                    activePage={pageInfo.activePage}
-                    browserFields={browserFields}
-                    filterQuery={filterQuery}
-                    data={nonDeletedEvents}
-                    defaultCellActions={defaultCellActions}
-                    id={id}
-                    isEventViewer={true}
-                    itemsPerPageOptions={itemsPerPageOptions}
-                    loadPage={loadPage}
-                    onRuleChange={onRuleChange}
-                    pageSize={itemsPerPage}
-                    renderCellValue={renderCellValue}
-                    rowRenderers={rowRenderers}
-                    tabType={TimelineTabs.query}
-                    tableView={tableView}
-                    totalItems={totalCountMinusDeleted}
-                    unit={unit}
-                    filterStatus={filterStatus}
-                    leadingControlColumns={leadingControlColumns}
-                    trailingControlColumns={trailingControlColumns}
-                    refetch={refetch}
-                    indexNames={indexNames}
-                  />
-                )}
-              </>
+              <FullWidthFlexGroup
+                $visible={!graphEventId && graphOverlay == null}
+                gutterSize="none"
+              >
+                <ScrollableFlexItem grow={1}>
+                  {totalCountMinusDeleted === 0 && loading === false && (
+                    <EuiEmptyPrompt
+                      title={
+                        <h2>
+                          <FormattedMessage
+                            id="xpack.timelines.tGrid.noResultsMatchSearchCriteriaTitle"
+                            defaultMessage="No results match your search criteria"
+                          />
+                        </h2>
+                      }
+                      titleSize="s"
+                      body={
+                        <p>
+                          <FormattedMessage
+                            id="xpack.timelines.tGrid.noResultsMatchSearchCriteriaDescription"
+                            defaultMessage="Try searching over a longer period of time or modifying your search."
+                          />
+                        </p>
+                      }
+                    />
+                  )}
+                  {totalCountMinusDeleted > 0 && (
+                    <StatefulBody
+                      hasAlertsCrud={hasAlertsCrud}
+                      activePage={pageInfo.activePage}
+                      browserFields={browserFields}
+                      filterQuery={filterQuery}
+                      data={nonDeletedEvents}
+                      defaultCellActions={defaultCellActions}
+                      id={id}
+                      isEventViewer={true}
+                      itemsPerPageOptions={itemsPerPageOptions}
+                      loadPage={loadPage}
+                      onRuleChange={onRuleChange}
+                      pageSize={itemsPerPage}
+                      renderCellValue={renderCellValue}
+                      rowRenderers={rowRenderers}
+                      tabType={TimelineTabs.query}
+                      tableView={tableView}
+                      totalItems={totalCountMinusDeleted}
+                      unit={unit}
+                      filterStatus={filterStatus}
+                      leadingControlColumns={leadingControlColumns}
+                      trailingControlColumns={trailingControlColumns}
+                      refetch={refetch}
+                      indexNames={indexNames}
+                    />
+                  )}
+                </ScrollableFlexItem>
+              </FullWidthFlexGroup>
             )}
           </EventsContainerLoading>
         )}
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 209b763686f7e..fd445f34317e0 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -20849,7 +20849,6 @@
     "xpack.securitySolution.detectionEngine.ruleDescription.mlJobStoppedDescription": "停止",
     "xpack.securitySolution.detectionEngine.ruleDescription.thresholdResultsAggregatedByDescription": "結果集約条件",
     "xpack.securitySolution.detectionEngine.ruleDescription.thresholdResultsAllDescription": "すべての結果",
-    "xpack.securitySolution.detectionEngine.ruleDetails.activatedRuleLabel": "有効化",
     "xpack.securitySolution.detectionEngine.ruleDetails.deletedRule": "削除されたルール",
     "xpack.securitySolution.detectionEngine.ruleDetails.errorCalloutTitle": "ルール失敗",
     "xpack.securitySolution.detectionEngine.ruleDetails.exceptionsTab": "例外",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 2ba41ff25b510..beb4f3d0c2860 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -21318,7 +21318,6 @@
     "xpack.securitySolution.detectionEngine.ruleDescription.mlJobStoppedDescription": "已停止",
     "xpack.securitySolution.detectionEngine.ruleDescription.thresholdResultsAggregatedByDescription": "结果聚合依据",
     "xpack.securitySolution.detectionEngine.ruleDescription.thresholdResultsAllDescription": "所有结果",
-    "xpack.securitySolution.detectionEngine.ruleDetails.activatedRuleLabel": "已激活",
     "xpack.securitySolution.detectionEngine.ruleDetails.deletedRule": "已删除规则",
     "xpack.securitySolution.detectionEngine.ruleDetails.errorCalloutTitle": "规则错误位置",
     "xpack.securitySolution.detectionEngine.ruleDetails.exceptionsTab": "例外",
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/delete.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/delete.ts
index d43fb2e7d835f..fe67decd7d191 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/delete.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/delete.ts
@@ -23,7 +23,8 @@ export default function createDeleteTests({ getService }: FtrProviderContext) {
   const retry = getService('retry');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
 
-  describe('delete', () => {
+  // FLAKY https://github.com/elastic/kibana/issues/111001
+  describe.skip('delete', () => {
     const objectRemover = new ObjectRemover(supertest);
 
     after(() => objectRemover.removeAll());
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
index 3454ef5c94d9f..2126e7383e321 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
@@ -17,7 +17,8 @@ export default function createFindTests({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
 
-  describe('find', () => {
+  // FLAKY https://github.com/elastic/kibana/issues/111022
+  describe.skip('find', () => {
     const objectRemover = new ObjectRemover(supertest);
 
     afterEach(() => objectRemover.removeAll());
diff --git a/x-pack/test/api_integration/apis/metrics_ui/constants.ts b/x-pack/test/api_integration/apis/metrics_ui/constants.ts
index a4c5705ab1a10..f0ba9b4c368d5 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/constants.ts
+++ b/x-pack/test/api_integration/apis/metrics_ui/constants.ts
@@ -28,4 +28,14 @@ export const DATES = {
       max: 1564083493080,
     },
   },
+  'alert-test-data': {
+    gauge: {
+      min: 1609459200000, // '2022-01-01T00:00:00Z'
+      max: 1609462800000, // '2021-01-01T01:00:00Z'
+    },
+    rate: {
+      min: 1609545600000, // '2021-01-02T00:00:00Z'
+      max: 1609545900000, // '2021-01-02T00:05:00Z'
+    },
+  },
 };
diff --git a/x-pack/test/api_integration/apis/metrics_ui/index.js b/x-pack/test/api_integration/apis/metrics_ui/index.js
index 861d82733a0fa..dfba4ee0985ba 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/index.js
+++ b/x-pack/test/api_integration/apis/metrics_ui/index.js
@@ -18,5 +18,6 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./metrics_explorer'));
     loadTestFile(require.resolve('./ip_to_hostname'));
     loadTestFile(require.resolve('./http_source'));
+    loadTestFile(require.resolve('./metric_threshold_alert'));
   });
 }
diff --git a/x-pack/test/api_integration/apis/metrics_ui/metric_threshold_alert.ts b/x-pack/test/api_integration/apis/metrics_ui/metric_threshold_alert.ts
new file mode 100644
index 0000000000000..28910bbc6b0c8
--- /dev/null
+++ b/x-pack/test/api_integration/apis/metrics_ui/metric_threshold_alert.ts
@@ -0,0 +1,322 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { InfraSource } from '../../../../plugins/infra/common/source_configuration/source_configuration';
+import { FtrProviderContext } from '../../ftr_provider_context';
+import {
+  evaluateAlert,
+  EvaluatedAlertParams,
+} from '../../../../plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert';
+import {
+  Aggregators,
+  CountMetricExpressionParams,
+  NonCountMetricExpressionParams,
+} from '../../../../plugins/infra/server/lib/alerting/metric_threshold/types';
+import { Comparator } from '../../../../plugins/infra/server/lib/alerting/common/types';
+import { DATES } from './constants';
+
+const { gauge, rate } = DATES['alert-test-data'];
+
+export default function ({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const esClient = getService('es');
+
+  const baseParams: EvaluatedAlertParams = {
+    groupBy: void 0,
+    filterQuery: void 0,
+    criteria: [
+      {
+        timeSize: 5,
+        timeUnit: 'm',
+        threshold: [1],
+        comparator: Comparator.GT_OR_EQ,
+        aggType: Aggregators.SUM,
+        metric: 'value',
+      },
+    ],
+  };
+
+  const configuration: InfraSource['configuration'] = {
+    name: 'Default',
+    description: '',
+    logIndices: {
+      type: 'index_pattern',
+      indexPatternId: 'some-test-id',
+    },
+    metricAlias: 'alerts-test-data',
+    inventoryDefaultView: 'default',
+    metricsExplorerDefaultView: 'default',
+    anomalyThreshold: 70,
+    fields: {
+      container: 'container.id',
+      host: 'host.name',
+      pod: 'kubernetes.od.uid',
+      tiebreaker: '_doc',
+      timestamp: '@timestamp',
+      message: ['message'],
+    },
+    logColumns: [
+      {
+        timestampColumn: {
+          id: '5e7f964a-be8a-40d8-88d2-fbcfbdca0e2f',
+        },
+      },
+      {
+        fieldColumn: {
+          id: ' eb9777a8-fcd3-420e-ba7d-172fff6da7a2',
+          field: 'event.dataset',
+        },
+      },
+      {
+        messageColumn: {
+          id: 'b645d6da-824b-4723-9a2a-e8cece1645c0',
+        },
+      },
+    ],
+  };
+
+  describe('Metric Threshold Alerts Executor', () => {
+    before(() => esArchiver.load('x-pack/test/functional/es_archives/infra/alerts_test_data'));
+    after(() => esArchiver.unload('x-pack/test/functional/es_archives/infra/alerts_test_data'));
+
+    describe('with gauge data', () => {
+      describe('without groupBy', () => {
+        it('should alert on document count', async () => {
+          const params = {
+            ...baseParams,
+            criteria: [
+              {
+                timeSize: 5,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: Comparator.GT_OR_EQ,
+                aggType: Aggregators.COUNT,
+              } as CountMetricExpressionParams,
+            ],
+          };
+          const timeFrame = { end: gauge.max };
+          const results = await evaluateAlert(esClient, params, configuration, timeFrame);
+          expect(results).to.eql([
+            {
+              '*': {
+                timeSize: 5,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: '>=',
+                aggType: 'count',
+                metric: 'Document count',
+                currentValue: 4,
+                timestamp: '2021-01-01T00:55:00.000Z',
+                shouldFire: [true],
+                shouldWarn: [false],
+                isNoData: [false],
+                isError: false,
+              },
+            },
+          ]);
+        });
+        it('should alert on the last value when the end date is the same as the last event', async () => {
+          const params = { ...baseParams };
+          const timeFrame = { end: gauge.max };
+          const results = await evaluateAlert(esClient, params, configuration, timeFrame);
+          expect(results).to.eql([
+            {
+              '*': {
+                timeSize: 5,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: '>=',
+                aggType: 'sum',
+                metric: 'value',
+                currentValue: 1,
+                timestamp: '2021-01-01T00:55:00.000Z',
+                shouldFire: [true],
+                shouldWarn: [false],
+                isNoData: [false],
+                isError: false,
+              },
+            },
+          ]);
+        });
+      });
+      describe('with groupBy', () => {
+        it('should alert on document count', async () => {
+          const params = {
+            ...baseParams,
+            groupBy: ['env'],
+            criteria: [
+              {
+                timeSize: 5,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: Comparator.GT_OR_EQ,
+                aggType: Aggregators.COUNT,
+              } as CountMetricExpressionParams,
+            ],
+          };
+          const timeFrame = { end: gauge.max };
+          const results = await evaluateAlert(esClient, params, configuration, timeFrame);
+          expect(results).to.eql([
+            {
+              dev: {
+                timeSize: 5,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: '>=',
+                aggType: 'count',
+                metric: 'Document count',
+                currentValue: 2,
+                timestamp: '2021-01-01T00:55:00.000Z',
+                shouldFire: [true],
+                shouldWarn: [false],
+                isNoData: [false],
+                isError: false,
+              },
+              prod: {
+                timeSize: 5,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: '>=',
+                aggType: 'count',
+                metric: 'Document count',
+                currentValue: 2,
+                timestamp: '2021-01-01T00:55:00.000Z',
+                shouldFire: [true],
+                shouldWarn: [false],
+                isNoData: [false],
+                isError: false,
+              },
+            },
+          ]);
+        });
+        it('should alert on the last value when the end date is the same as the last event', async () => {
+          const params = {
+            ...baseParams,
+            groupBy: ['env'],
+          };
+          const timeFrame = { end: gauge.max };
+          const results = await evaluateAlert(esClient, params, configuration, timeFrame);
+          expect(results).to.eql([
+            {
+              dev: {
+                timeSize: 5,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: '>=',
+                aggType: 'sum',
+                metric: 'value',
+                currentValue: 0,
+                timestamp: '2021-01-01T00:55:00.000Z',
+                shouldFire: [false],
+                shouldWarn: [false],
+                isNoData: [false],
+                isError: false,
+              },
+              prod: {
+                timeSize: 5,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: '>=',
+                aggType: 'sum',
+                metric: 'value',
+                currentValue: 1,
+                timestamp: '2021-01-01T00:55:00.000Z',
+                shouldFire: [true],
+                shouldWarn: [false],
+                isNoData: [false],
+                isError: false,
+              },
+            },
+          ]);
+        });
+      });
+    });
+
+    describe('with rate data', () => {
+      describe('without groupBy', () => {
+        it('should alert on rate', async () => {
+          const params = {
+            ...baseParams,
+            criteria: [
+              {
+                timeSize: 1,
+                timeUnit: 'm',
+                threshold: [0.5],
+                comparator: Comparator.GT_OR_EQ,
+                aggType: Aggregators.RATE,
+                metric: 'value',
+              } as NonCountMetricExpressionParams,
+            ],
+          };
+          const timeFrame = { end: rate.max };
+          const results = await evaluateAlert(esClient, params, configuration, timeFrame);
+          expect(results).to.eql([
+            {
+              '*': {
+                timeSize: 1,
+                timeUnit: 'm',
+                threshold: [0.5],
+                comparator: '>=',
+                aggType: 'rate',
+                metric: 'value',
+                currentValue: 0.6666666666666666,
+                timestamp: '2021-01-02T00:04:00.000Z',
+                shouldFire: [false, false, false, false, true],
+                shouldWarn: [false],
+                isNoData: [true, false, false, false, false],
+                isError: false,
+              },
+            },
+          ]);
+        });
+      });
+      describe('with groupBy', () => {
+        it('should warn but not fire on rate', async () => {
+          const params = {
+            ...baseParams,
+            groupBy: 'env',
+            criteria: [
+              {
+                timeSize: 1,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: Comparator.GT_OR_EQ,
+                warningThreshold: [0.5],
+                warningComparator: Comparator.GT_OR_EQ,
+                aggType: Aggregators.RATE,
+                metric: 'value',
+              } as NonCountMetricExpressionParams,
+            ],
+          };
+          const timeFrame = { end: rate.max };
+          const results = await evaluateAlert(esClient, params, configuration, timeFrame);
+          expect(results).to.eql([
+            {
+              dev: {
+                timeSize: 1,
+                timeUnit: 'm',
+                threshold: [1],
+                comparator: '>=',
+                warningThreshold: [0.5],
+                warningComparator: '>=',
+                aggType: 'rate',
+                metric: 'value',
+                currentValue: 0.6666666666666666,
+                timestamp: '2021-01-02T00:04:00.000Z',
+                shouldFire: [false, false, false, false, false],
+                shouldWarn: [false, false, false, false, true],
+                isNoData: [true, false, false, false, false],
+                isError: false,
+              },
+            },
+          ]);
+        });
+      });
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/metrics_ui/metrics_alerting.ts b/x-pack/test/api_integration/apis/metrics_ui/metrics_alerting.ts
index 31d4bd147f526..90b815d4d0530 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/metrics_alerting.ts
+++ b/x-pack/test/api_integration/apis/metrics_ui/metrics_alerting.ts
@@ -48,7 +48,9 @@ export default function ({ getService }: FtrProviderContext) {
           });
 
           expect(result.hits).to.be.ok();
-          expect(result.aggregations).to.be.ok();
+          if (aggType !== 'count') {
+            expect(result.aggregations).to.be.ok();
+          }
         });
       }
       it('should work with a filterQuery', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
index 58df5bc3ff9e1..496781dbb985f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
@@ -193,7 +193,7 @@ export default ({ getService }: FtrProviderContext) => {
             index: '.ml-anomalies-custom-linux_anomalous_network_activity_ecs',
             depth: 0,
           },
-          reason: `Alert Test ML rule created with a critical severity and risk score of 50 by root on mothra.`,
+          reason: `event with process store, by root on mothra created critical alert Test ML rule.`,
           original_time: '2020-11-16T22:58:08.000Z',
         },
         all_field_values: [
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
index f985cdfecc465..0aad3c699805a 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
@@ -287,7 +287,8 @@ export default ({ getService }: FtrProviderContext) => {
                 depth: 0,
               },
             ],
-            reason: `Alert Query with a rule id created with a high severity and risk score of 55 by root on zeek-sensor-amsterdam.`,
+            reason:
+              'user-login event by root on zeek-sensor-amsterdam created high alert Query with a rule id.',
             rule: fullSignal.signal.rule,
             status: 'open',
           },
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
index b90ceb3dde9cc..c954d8aa5721d 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
@@ -362,7 +362,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             },
             signal: {
-              reason: `Alert Signal Testing Query created with a high severity and risk score of 1 on suricata-zeek-sensor-toronto.`,
+              reason:
+                'configuration event on suricata-zeek-sensor-toronto created high alert Signal Testing Query.',
               rule: fullSignal.signal.rule,
               original_time: fullSignal.signal.original_time,
               status: 'open',
@@ -497,7 +498,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             },
             signal: {
-              reason: `Alert Signal Testing Query created with a high severity and risk score of 1 on suricata-zeek-sensor-toronto.`,
+              reason:
+                'configuration event on suricata-zeek-sensor-toronto created high alert Signal Testing Query.',
               rule: fullSignal.signal.rule,
               original_time: fullSignal.signal.original_time,
               status: 'open',
@@ -662,7 +664,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             },
             signal: {
-              reason: `Alert Signal Testing Query created with a high severity and risk score of 1 by root on zeek-sensor-amsterdam.`,
+              reason:
+                'anomoly event with process bro, by root on zeek-sensor-amsterdam created high alert Signal Testing Query.',
               rule: fullSignal.signal.rule,
               group: fullSignal.signal.group,
               original_time: fullSignal.signal.original_time,
@@ -753,7 +756,8 @@ export default ({ getService }: FtrProviderContext) => {
               status: 'open',
               depth: 2,
               group: source.signal.group,
-              reason: `Alert Signal Testing Query created with a high severity and risk score of 1.`,
+              reason:
+                'event by root on zeek-sensor-amsterdam created high alert Signal Testing Query.',
               rule: source.signal.rule,
               ancestors: [
                 {
@@ -872,7 +876,7 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
               status: 'open',
-              reason: `Alert Signal Testing Query created with a high severity and risk score of 1.`,
+              reason: 'event created high alert Signal Testing Query.',
               rule: fullSignal.signal.rule,
               original_time: fullSignal.signal.original_time,
               depth: 1,
@@ -1010,7 +1014,7 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
               status: 'open',
-              reason: `Alert Signal Testing Query created with a high severity and risk score of 1.`,
+              reason: `event created high alert Signal Testing Query.`,
               rule: fullSignal.signal.rule,
               original_time: fullSignal.signal.original_time,
               depth: 1,
@@ -1094,7 +1098,7 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
               status: 'open',
-              reason: `Alert Signal Testing Query created with a high severity and risk score of 1.`,
+              reason: `event created high alert Signal Testing Query.`,
               rule: fullSignal.signal.rule,
               original_time: fullSignal.signal.original_time,
               depth: 1,
@@ -1692,7 +1696,7 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
             status: 'open',
-            reason: `Alert boot created with a high severity and risk score of 1 on zeek-sensor-amsterdam.`,
+            reason: `event on zeek-sensor-amsterdam created high alert boot.`,
             rule: {
               ...fullSignal.signal.rule,
               name: 'boot',
diff --git a/x-pack/test/functional/es_archives/event_log_legacy_ids/data.json b/x-pack/test/functional/es_archives/event_log_legacy_ids/data.json
new file mode 100644
index 0000000000000..54b0c3f48189a
--- /dev/null
+++ b/x-pack/test/functional/es_archives/event_log_legacy_ids/data.json
@@ -0,0 +1,164 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "X6bLb3UBt6Z_MVvSTfYk",
+    "index": ".kibana-event-log-8.0.0-000001",
+    "source": {
+      "@timestamp": "2020-10-28T15:19:55.933Z",
+      "ecs": {
+        "version": "1.5.0"
+      },
+      "event": {
+        "action": "test",
+        "duration": 0,
+        "end": "2020-10-28T15:19:55.933Z",
+        "provider": "event_log_fixture",
+        "start": "2020-10-28T15:19:55.933Z"
+      },
+      "kibana": {
+        "saved_objects": [
+          {
+            "id": "621f2511-5cd1-44fd-95df-e0df83e354d5",
+            "rel": "primary",
+            "type": "event_log_test"
+          }
+        ],
+        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
+        "version": "8.0.0"
+      },
+      "message": "test 2020-10-28T15:19:55.913Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "X6bLb3UBt6Z_MVvSTfYk0000",
+    "index": ".kibana-event-log-8.0.0-000001",
+    "source": {
+      "@timestamp": "2020-10-28T15:19:55.933Z",
+      "ecs": {
+        "version": "1.5.0"
+      },
+      "event": {
+        "action": "test legacy",
+        "duration": 0,
+        "end": "2020-10-28T15:19:55.933Z",
+        "provider": "event_log_fixture",
+        "start": "2020-10-28T15:19:55.933Z"
+      },
+      "kibana": {
+        "saved_objects": [
+          {
+            "id": "521f2511-5cd1-44fd-95df-e0df83e354d5",
+            "rel": "primary",
+            "type": "event_log_test"
+          }
+        ],
+        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
+        "version": "7.14.0"
+      },
+      "message": "test legacy 2020-10-28T15:19:55.913Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "YKbLb3UBt6Z_MVvSTfY8",
+    "index": ".kibana-event-log-8.0.0-000001",
+    "source": {
+      "@timestamp": "2020-10-28T15:19:55.957Z",
+      "ecs": {
+        "version": "1.5.0"
+      },
+      "event": {
+        "action": "test",
+        "duration": 0,
+        "end": "2020-10-28T15:19:55.957Z",
+        "provider": "event_log_fixture",
+        "start": "2020-10-28T15:19:55.957Z"
+      },
+      "kibana": {
+        "saved_objects": [
+          {
+            "id": "621f2511-5cd1-44fd-95df-e0df83e354d5",
+            "rel": "primary",
+            "type": "event_log_test"
+          }
+        ],
+        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
+        "version": "8.0.0"
+      },
+      "message": "test 2020-10-28T15:19:55.938Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "YabLb3UBt6Z_MVvSTfZc0000",
+    "index": ".kibana-event-log-8.0.0-000001",
+    "source": {
+      "@timestamp": "2020-10-28T15:19:55.991Z",
+      "ecs": {
+        "version": "1.5.0"
+      },
+      "event": {
+        "action": "test",
+        "duration": 0,
+        "end": "2020-10-28T15:19:55.991Z",
+        "provider": "event_log_fixture",
+        "start": "2020-10-28T15:19:55.991Z"
+      },
+      "kibana": {
+        "saved_objects": [
+          {
+            "id": "521f2511-5cd1-44fd-95df-e0df83e354d5",
+            "rel": "primary",
+            "type": "event_log_test"
+          }
+        ],
+        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
+        "version": "7.0.0"
+      },
+      "message": "test legacy 2020-10-28T15:19:55.962Z"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "YabLb3UBt6Z_MVvSTfZc",
+    "index": ".kibana-event-log-8.0.0-000001",
+    "source": {
+      "@timestamp": "2020-10-28T15:19:55.991Z",
+      "ecs": {
+        "version": "1.5.0"
+      },
+      "event": {
+        "action": "test",
+        "duration": 0,
+        "end": "2020-10-28T15:19:55.991Z",
+        "provider": "event_log_fixture",
+        "start": "2020-10-28T15:19:55.991Z"
+      },
+      "kibana": {
+        "saved_objects": [
+          {
+            "id": "621f2511-5cd1-44fd-95df-e0df83e354d5",
+            "rel": "primary",
+            "type": "event_log_test"
+          }
+        ],
+        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
+        "version": "8.0.0"
+      },
+      "message": "test 2020-10-28T15:19:55.962Z"
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/event_log_legacy_ids/mappings.json b/x-pack/test/functional/es_archives/event_log_legacy_ids/mappings.json
new file mode 100644
index 0000000000000..564a9e56a7853
--- /dev/null
+++ b/x-pack/test/functional/es_archives/event_log_legacy_ids/mappings.json
@@ -0,0 +1,579 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "eaf6f5841dbf4cb5e3045860f75f53ca",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "app_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_daily": "43b8830d5d0df85a6823d290885fc9fd",
+          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_transactional": "3d1b76c39bfb2cc8296b024d73854724",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
+          "cases": "477f214ff61acc3af26a7b7818e380c1",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "cases-configure": "387c5f3a3bda7e0ae0dd4e106f914a69",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "config": "c63748b75f39d0c54de12d12c1ccbc20",
+          "dashboard": "40554caf09725935e2c02e02563a2d07",
+          "endpoint:user-artifact": "4a11183eee21e6fbad864f7a30b39ad0",
+          "endpoint:user-artifact-manifest": "a0d7b04ad405eed54d76e279c3727862",
+          "enterprise_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "epm-packages": "2b83397e3eaaaa8ef15e38813f3721c3",
+          "event_log_test": "bef808d4a9c27f204ffbda3359233931",
+          "exception-list": "67f055ab8c10abd7b2ebfd969b836788",
+          "exception-list-agnostic": "67f055ab8c10abd7b2ebfd969b836788",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "fleet-agent-actions": "9511b565b1cc6441a42033db3d5de8e9",
+          "fleet-agent-events": "e20a508b6e805189356be381dbfac8db",
+          "fleet-agents": "cb661e8ede2b640c42c8e5ef99db0683",
+          "fleet-enrollment-api-keys": "a69ef7ae661dab31561d6c6f052ef2a7",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "45915a1ad866812242df474eb0479052",
+          "infrastructure-ui-source": "3d1b76c39bfb2cc8296b024d73854724",
+          "ingest-agent-policies": "8b0733cce189659593659dad8db426f0",
+          "ingest-outputs": "8854f34453a47e26f86a29f8f3b80b4e",
+          "ingest-package-policies": "f74dfe498e1849267cda41580b2be110",
+          "ingest_manager_settings": "02a03095f0e05b7a538fa801b88a217f",
+          "inventory-view": "3d1b76c39bfb2cc8296b024d73854724",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "52346cfec69ff7b47d5f0c12361a2797",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "4a05b35c3a3a58fbc72dd0202dc3487f",
+          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
+          "metrics-explorer-view": "3d1b76c39bfb2cc8296b024d73854724",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "monitoring-telemetry": "2669d5ec15e82391cf58df4294ee9c68",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "originId": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "43012c7ebc4cb57054e0a490e4b43023",
+          "search-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "siem-detection-engine-rule-actions": "6569b288c169539db10cb262bf79de18",
+          "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
+          "siem-ui-timeline": "d12c5474364d737d17252acf1dc4585c",
+          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
+          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "215107c281839ea9b3ad5f6419819763",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "uptime-dynamic-settings": "3d1b76c39bfb2cc8296b024d73854724",
+          "url": "c7f66a0df8b1b52f17c28c4adb111105",
+          "visualization": "f819cf6636b75c9e76ba733a0c6ef355",
+          "workplace_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "config": {
+          "dynamic": "false",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "event_log_test": {
+          "type": "object"
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-telemetry": {
+          "properties": {
+            "file_data_visualizer": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "monitoring-telemetry": {
+          "properties": {
+            "reportedClusterUuids": {
+              "type": "keyword"
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "originId": {
+          "type": "keyword"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "index": false,
+              "type": "text"
+            }
+          }
+        },
+        "workplace_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana-event-log-7.9.0": {
+        "is_write_index": true
+      }
+    },
+    "index": ".kibana-event-log-7.9.0-000001",
+    "mappings": {
+      "dynamic": "false",
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "message": {
+              "norms": false,
+              "type": "text"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "type": "date"
+            }
+          }
+        },
+        "kibana": {
+          "properties": {
+            "alerting": {
+              "properties": {
+                "instance_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "saved_objects": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "namespace": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "server_uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "meta": {
+            "isArray": "true"
+          },
+          "type": "keyword"
+        },
+        "user": {
+          "properties": {
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "lifecycle": {
+          "name": "kibana-event-log-policy",
+          "rollover_alias": ".kibana-event-log-7.9.0"
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana-event-log-8.0.0": {
+        "is_write_index": true
+      }
+    },
+    "index": ".kibana-event-log-8.0.0-000001",
+    "mappings": {
+      "dynamic": "false",
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "message": {
+              "norms": false,
+              "type": "text"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "type": "date"
+            }
+          }
+        },
+        "kibana": {
+          "properties": {
+            "alerting": {
+              "properties": {
+                "instance_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "saved_objects": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "namespace": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "server_uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "type": "version"
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "meta": {
+            "isArray": "true"
+          },
+          "type": "keyword"
+        },
+        "user": {
+          "properties": {
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "lifecycle": {
+          "name": "kibana-event-log-policy",
+          "rollover_alias": ".kibana-event-log-8.0.0"
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/es_archives/event_log_multiple_indicies/data.json b/x-pack/test/functional/es_archives/event_log_multiple_indicies/data.json
index 4e871f6308b77..70bb1d8551a10 100644
--- a/x-pack/test/functional/es_archives/event_log_multiple_indicies/data.json
+++ b/x-pack/test/functional/es_archives/event_log_multiple_indicies/data.json
@@ -202,7 +202,8 @@
             "type": "event_log_test"
           }
         ],
-        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d"
+        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
+        "version": "8.0.0"
       },
       "message": "test 2020-10-28T15:19:55.913Z"
     }
@@ -234,7 +235,8 @@
             "type": "event_log_test"
           }
         ],
-        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d"
+        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
+        "version": "8.0.0"
       },
       "message": "test 2020-10-28T15:19:55.938Z"
     }
@@ -266,7 +268,8 @@
             "type": "event_log_test"
           }
         ],
-        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d"
+        "server_uuid": "5b2de169-2785-441b-ae8c-186a1936b17d",
+        "version": "8.0.0"
       },
       "message": "test 2020-10-28T15:19:55.962Z"
     }
diff --git a/x-pack/test/functional/es_archives/event_log_multiple_indicies/mappings.json b/x-pack/test/functional/es_archives/event_log_multiple_indicies/mappings.json
index e9a709138256a..15382fb2524fe 100644
--- a/x-pack/test/functional/es_archives/event_log_multiple_indicies/mappings.json
+++ b/x-pack/test/functional/es_archives/event_log_multiple_indicies/mappings.json
@@ -397,7 +397,7 @@
             "server_uuid": {
               "ignore_above": 1024,
               "type": "keyword"
-            }
+            }     
           }
         },
         "message": {
@@ -531,6 +531,9 @@
             "server_uuid": {
               "ignore_above": 1024,
               "type": "keyword"
+            },
+            "version": {
+              "type": "version"
             }
           }
         },
diff --git a/x-pack/test/functional/es_archives/infra/alerts_test_data/data.json.gz b/x-pack/test/functional/es_archives/infra/alerts_test_data/data.json.gz
new file mode 100644
index 0000000000000..1c76205f4caa2
Binary files /dev/null and b/x-pack/test/functional/es_archives/infra/alerts_test_data/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/infra/alerts_test_data/mappings.json b/x-pack/test/functional/es_archives/infra/alerts_test_data/mappings.json
new file mode 100644
index 0000000000000..10ff43edb7d88
--- /dev/null
+++ b/x-pack/test/functional/es_archives/infra/alerts_test_data/mappings.json
@@ -0,0 +1,28 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "alerts-test-data",
+    "mappings": {
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "env": {
+          "ignore_above": 256,
+          "type": "keyword"
+        },
+        "value": {
+          "type": "long"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts b/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
index 27da58972556d..5424d7068529e 100644
--- a/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
+++ b/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
@@ -167,7 +167,7 @@ export default function ({ getService }: FtrProviderContext) {
 
         const {
           body: { data, total },
-        } = await findEvents(undefined, id, {});
+        } = await findEventsByIds(undefined, [id], {}, [id]);
 
         expect(data.length).to.be(6);
         expect(total).to.be(6);
@@ -184,6 +184,51 @@ export default function ({ getService }: FtrProviderContext) {
         await esArchiver.unload('x-pack/test/functional/es_archives/event_log_multiple_indicies');
       });
     });
+
+    describe(`Legacy Ids`, () => {
+      before(async () => {
+        await esArchiver.load('x-pack/test/functional/es_archives/event_log_legacy_ids');
+      });
+      after(async () => {
+        await esArchiver.unload('x-pack/test/functional/es_archives/event_log_legacy_ids');
+      });
+      it('should support search event by ids and legacyIds', async () => {
+        const legacyId = `521f2511-5cd1-44fd-95df-e0df83e354d5`;
+        const id = `621f2511-5cd1-44fd-95df-e0df83e354d5`;
+
+        const {
+          body: { data, total },
+        } = await findEventsByIds(undefined, [id], {}, [legacyId]);
+
+        expect(data.length).to.be(5);
+        expect(total).to.be(5);
+
+        expect(data.map((foundEvent: IEvent) => foundEvent?.message)).to.eql([
+          'test 2020-10-28T15:19:55.913Z',
+          'test legacy 2020-10-28T15:19:55.913Z',
+          'test 2020-10-28T15:19:55.938Z',
+          'test legacy 2020-10-28T15:19:55.962Z',
+          'test 2020-10-28T15:19:55.962Z',
+        ]);
+      });
+
+      it('should search event only by ids if no legacyIds are provided', async () => {
+        const id = `621f2511-5cd1-44fd-95df-e0df83e354d5`;
+
+        const {
+          body: { data, total },
+        } = await findEventsByIds(undefined, [id], {});
+
+        expect(data.length).to.be(3);
+        expect(total).to.be(3);
+
+        expect(data.map((foundEvent: IEvent) => foundEvent?.message)).to.eql([
+          'test 2020-10-28T15:19:55.913Z',
+          'test 2020-10-28T15:19:55.938Z',
+          'test 2020-10-28T15:19:55.962Z',
+        ]);
+      });
+    });
   });
 
   async function findEvents(
@@ -204,6 +249,32 @@ export default function ({ getService }: FtrProviderContext) {
     return await supertest.get(url).set('kbn-xsrf', 'foo').expect(200);
   }
 
+  async function findEventsByIds(
+    namespace: string | undefined,
+    ids: string[],
+    query: Record<string, any> = {},
+    legacyIds: string[] = []
+  ) {
+    const urlPrefix = urlPrefixFromNamespace(namespace);
+    const url = `${urlPrefix}/api/event_log/event_log_test/_find${
+      isEmpty(query)
+        ? ''
+        : `?${Object.entries(query)
+            .map(([key, val]) => `${key}=${val}`)
+            .join('&')}`
+    }`;
+    await delay(1000); // wait for buffer to be written
+    log.debug(`Finding Events for Saved Object with ${url}`);
+    return await supertest
+      .post(url)
+      .set('kbn-xsrf', 'foo')
+      .send({
+        ids,
+        legacyIds,
+      })
+      .expect(200);
+  }
+
   function assertEventsFromApiMatchCreatedEvents(
     foundEvents: IValidatedEvent[],
     expectedEvents: IEvent[]