diff --git a/.buildkite/ftr_configs.yml b/.buildkite/ftr_configs.yml
index c74c3d0cfcddf..f026499502e0d 100644
--- a/.buildkite/ftr_configs.yml
+++ b/.buildkite/ftr_configs.yml
@@ -223,14 +223,9 @@ enabled:
   - x-pack/test/cloud_security_posture_api/config.ts
   - x-pack/test/detection_engine_api_integration/basic/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group1/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group2/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group3/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group4/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group5/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group6/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group7/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group8/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group9/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group10/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/prebuilt_rules/config.ts
@@ -451,8 +446,18 @@ enabled:
   - x-pack/performance/journeys/apm_service_inventory.ts
   - x-pack/test/custom_branding/config.ts
   - x-pack/test/profiling_api_integration/cloud/config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/serverless.config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/ess.config.ts
+
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts
+
 
 
 
diff --git a/.buildkite/pipelines/on_merge.yml b/.buildkite/pipelines/on_merge.yml
index 815e4d9adb5e2..5c587545897f5 100644
--- a/.buildkite/pipelines/on_merge.yml
+++ b/.buildkite/pipelines/on_merge.yml
@@ -187,18 +187,6 @@ steps:
         - exit_status: '*'
           limit: 1
 
-  - command: .buildkite/scripts/steps/functional/osquery_cypress.sh
-    label: 'Osquery Cypress Tests'
-    agents:
-      queue: n2-4-spot
-    depends_on: build
-    timeout_in_minutes: 50
-    parallelism: 6
-    retry:
-      automatic:
-        - exit_status: '*'
-          limit: 1
-
   - command: '.buildkite/scripts/steps/functional/on_merge_unsupported_ftrs.sh'
     label: Trigger unsupported ftr tests
     timeout_in_minutes: 10
diff --git a/.buildkite/pipelines/on_merge_unsupported_ftrs.yml b/.buildkite/pipelines/on_merge_unsupported_ftrs.yml
index 6dee27db71659..904bed2b042ab 100644
--- a/.buildkite/pipelines/on_merge_unsupported_ftrs.yml
+++ b/.buildkite/pipelines/on_merge_unsupported_ftrs.yml
@@ -63,3 +63,15 @@ steps:
           limit: 3
         - exit_status: '*'
           limit: 1
+
+  - command: .buildkite/scripts/steps/functional/osquery_cypress.sh
+    label: 'Osquery Cypress Tests'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 50
+    parallelism: 6
+    retry:
+      automatic:
+        - exit_status: '*'
+          limit: 1
diff --git a/.buildkite/pipelines/pull_request/base.yml b/.buildkite/pipelines/pull_request/base.yml
index abc6436e7ee0a..5213dfc0e4ab1 100644
--- a/.buildkite/pipelines/pull_request/base.yml
+++ b/.buildkite/pipelines/pull_request/base.yml
@@ -187,20 +187,6 @@ steps:
         - exit_status: '*'
           limit: 1
 
-  - command: .buildkite/scripts/steps/functional/osquery_cypress.sh
-    label: 'Osquery Cypress Tests'
-    agents:
-      queue: n2-4-spot
-    depends_on: build
-    timeout_in_minutes: 50
-    parallelism: 6
-    retry:
-      automatic:
-        - exit_status: '*'
-          limit: 1
-    artifact_paths:
-      - 'target/kibana-osquery/**/*'
-
   - command: .buildkite/scripts/steps/functional/security_solution_burn.sh
     label: 'Security Solution Cypress tests, burning changed specs'
     agents:
@@ -212,39 +198,6 @@ steps:
       automatic: false
     soft_fail: true
 
-  - command: .buildkite/scripts/steps/code_generation/security_solution_codegen.sh
-    label: 'Security Solution OpenAPI codegen'
-    agents:
-      queue: n2-2-spot
-    timeout_in_minutes: 60
-    parallelism: 1
-
-  - command: .buildkite/scripts/steps/functional/osquery_cypress_burn.sh
-    label: 'Osquery Cypress Tests, burning changed specs'
-    agents:
-      queue: n2-4-spot
-    depends_on: build
-    timeout_in_minutes: 50
-    soft_fail: true
-    retry:
-      automatic: false
-    artifact_paths:
-      - 'target/kibana-osquery/**/*'
-
-  - command: .buildkite/scripts/steps/functional/security_serverless_osquery.sh
-    label: 'Serverless Osquery Cypress Tests'
-    agents:
-      queue: n2-4-spot
-    depends_on: build
-    timeout_in_minutes: 50
-    parallelism: 6
-    retry:
-      automatic:
-        - exit_status: '*'
-          limit: 1
-    artifact_paths:
-      - 'target/kibana-osquery/**/*'
-
   # status_exception: Native role management is not enabled in this Elasticsearch instance
   # - command: .buildkite/scripts/steps/functional/security_serverless_defend_workflows.sh
   #   label: 'Serverless Security Defend Workflows Cypress Tests'
diff --git a/.buildkite/pipelines/pull_request/osquery_cypress.yml b/.buildkite/pipelines/pull_request/osquery_cypress.yml
new file mode 100644
index 0000000000000..49ef00aeb8090
--- /dev/null
+++ b/.buildkite/pipelines/pull_request/osquery_cypress.yml
@@ -0,0 +1,34 @@
+steps:
+  - command: .buildkite/scripts/steps/functional/osquery_cypress.sh
+    label: 'Osquery Cypress Tests'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 50
+    parallelism: 6
+    retry:
+      automatic:
+        - exit_status: '*'
+          limit: 1
+
+  - command: .buildkite/scripts/steps/functional/security_serverless_osquery.sh
+    label: 'Serverless Osquery Cypress Tests'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 50
+    parallelism: 6
+    retry:
+      automatic:
+        - exit_status: '*'
+          limit: 1
+
+  - command: .buildkite/scripts/steps/functional/osquery_cypress_burn.sh
+    label: 'Osquery Cypress Tests, burning changed specs'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 50
+    soft_fail: true
+    retry:
+      automatic: false
diff --git a/.buildkite/pipelines/quality-gates/pipeline.tests-production-canary.yaml b/.buildkite/pipelines/quality-gates/pipeline.tests-production-canary.yaml
deleted file mode 100644
index 8b30d4e141b08..0000000000000
--- a/.buildkite/pipelines/quality-gates/pipeline.tests-production-canary.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# These pipeline steps constitute the quality gate for your service within the production-canary environment.
-# Incorporate any necessary additional logic to validate the service's integrity.
-# A failure in this pipeline build will prevent further progression to the subsequent stage.
-
-steps:
-  - label: ":pipeline::kibana::seedling: Trigger SLO check"
-    trigger: "serverless-quality-gates" # https://buildkite.com/elastic/serverless-quality-gates
-    build:
-      message: "${BUILDKITE_MESSAGE} (triggered by pipeline.tests-production-canary.yaml)"
-      env:
-        TARGET_ENV: production-canary
-        CHECK_SLO: true
-        CHECK_SLO_TAG: kibana
-    soft_fail: true
-
-  - label: ":pipeline::rocket::seedling: Trigger control-plane e2e tests"
-    trigger: "ess-k8s-production-e2e-tests" # https://buildkite.com/elastic/ess-k8s-production-e2e-tests
-    build:
-      env:
-        REGION_ID: aws-us-east-1
-        NAME_PREFIX: ci_test_kibana-promotion_
-      message: "${BUILDKITE_MESSAGE} (triggered by pipeline.tests-production-canary.yaml)"
-
-  - label: ":cookie: 24h bake time before continuing promotion"
-    command: "sleep 86400"
diff --git a/.buildkite/pipelines/quality-gates/pipeline.tests-production-noncanary.yaml b/.buildkite/pipelines/quality-gates/pipeline.tests-production-noncanary.yaml
deleted file mode 100644
index 13c974a344f98..0000000000000
--- a/.buildkite/pipelines/quality-gates/pipeline.tests-production-noncanary.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# These pipeline steps constitute the quality gate for your service within the production-noncanary environment.
-# Incorporate any necessary additional logic to validate the service's integrity.
-# A failure in this pipeline build will prevent further progression to the subsequent stage.
-
-steps:
-  - label: ":pipeline::kibana::seedling: Trigger SLO check"
-    trigger: "serverless-quality-gates" # https://buildkite.com/elastic/serverless-quality-gates
-    build:
-      message: "${BUILDKITE_MESSAGE} (triggered by pipeline.tests-production-noncanary.yaml)"
-      env:
-        TARGET_ENV: production-noncanary
-        CHECK_SLO: true
-        CHECK_SLO_TAG: kibana
-    soft_fail: true
-
-  - label: ":pipeline::rocket::seedling: Trigger control-plane e2e tests"
-    trigger: "ess-k8s-production-e2e-tests" # https://buildkite.com/elastic/ess-k8s-production-e2e-tests
-    build:
-      env:
-        REGION_ID: aws-us-east-1
-        NAME_PREFIX: ci_test_kibana-promotion_
-      message: "${BUILDKITE_MESSAGE} (triggered by pipeline.tests-production-noncanary.yaml)"
diff --git a/.buildkite/pipelines/quality-gates/pipeline.tests-production.yaml b/.buildkite/pipelines/quality-gates/pipeline.tests-production.yaml
index 4b0bb30d3084c..fd2fbac8a7b30 100644
--- a/.buildkite/pipelines/quality-gates/pipeline.tests-production.yaml
+++ b/.buildkite/pipelines/quality-gates/pipeline.tests-production.yaml
@@ -2,10 +2,6 @@
 # Incorporate any necessary additional logic to validate the service's integrity.
 # A failure in this pipeline build will prevent further progression to the subsequent stage.
 
-# DEPRECATION NOTICE:
-# PRODUCTION WILL SOON BE SPLIT INTO "CANARY" AND "NONCANARY" AND THIS FILE WILL BE DELETED.
-# ENSURE ANY CHANGE MADE TO THIS FILE IS REFLECTED IN THOSE FILES AS WELL.
-
 steps:
   - label: ":pipeline::kibana::seedling: Trigger SLO check"
     trigger: "serverless-quality-gates" # https://buildkite.com/elastic/serverless-quality-gates
@@ -18,9 +14,14 @@ steps:
     soft_fail: true
 
   - label: ":pipeline::rocket::seedling: Trigger control-plane e2e tests"
+    if: build.env("ENVIRONMENT") == "production-canary"
     trigger: "ess-k8s-production-e2e-tests" # https://buildkite.com/elastic/ess-k8s-production-e2e-tests
     build:
       env:
         REGION_ID: aws-us-east-1
         NAME_PREFIX: ci_test_kibana-promotion_
       message: "${BUILDKITE_MESSAGE} (triggered by pipeline.tests-production.yaml)"
+
+  - label: ":cookie: 24h bake time before continuing promotion"
+    if: build.env("ENVIRONMENT") == "production-canary"
+    command: "sleep 86400"
diff --git a/.buildkite/scripts/lifecycle/post_command.sh b/.buildkite/scripts/lifecycle/post_command.sh
index 01877bedbef8c..eeb7fa0ef410f 100755
--- a/.buildkite/scripts/lifecycle/post_command.sh
+++ b/.buildkite/scripts/lifecycle/post_command.sh
@@ -14,6 +14,7 @@ if [[ "$IS_TEST_EXECUTION_STEP" == "true" ]]; then
   buildkite-agent artifact upload 'target/kibana-coverage/functional/**/*'
   buildkite-agent artifact upload 'target/kibana-*'
   buildkite-agent artifact upload 'target/kibana-security-solution/**/*.png'
+  buildkite-agent artifact upload 'target/kibana-osquery/**/*.png'
   buildkite-agent artifact upload 'target/kibana-fleet/**/*.png'
   buildkite-agent artifact upload 'target/test-metrics/*'
   buildkite-agent artifact upload 'target/test-suites-ci-plan.json'
diff --git a/.buildkite/scripts/pipelines/pull_request/pipeline.ts b/.buildkite/scripts/pipelines/pull_request/pipeline.ts
index 7a7fa0f59b9c7..4d6cd774393e0 100644
--- a/.buildkite/scripts/pipelines/pull_request/pipeline.ts
+++ b/.buildkite/scripts/pipelines/pull_request/pipeline.ts
@@ -151,6 +151,14 @@ const uploadPipeline = (pipelineContent: string | object) => {
       pipeline.push(getPipeline('.buildkite/pipelines/pull_request/webpack_bundle_analyzer.yml'));
     }
 
+    if (
+      ((await doAnyChangesMatch([/^x-pack\/plugins\/osquery/, /^x-pack\/test\/osquery_cypress/])) ||
+        GITHUB_PR_LABELS.includes('ci:all-cypress-suites')) &&
+      !GITHUB_PR_LABELS.includes('ci:skip-cypress-osquery')
+    ) {
+      pipeline.push(getPipeline('.buildkite/pipelines/pull_request/osquery_cypress.yml'));
+    }
+
     if (
       (await doAnyChangesMatch([
         /\.docnav\.json$/,
diff --git a/.buildkite/scripts/steps/checks.sh b/.buildkite/scripts/steps/checks.sh
index 12077902c1c13..c2758eb52c738 100755
--- a/.buildkite/scripts/steps/checks.sh
+++ b/.buildkite/scripts/steps/checks.sh
@@ -22,3 +22,4 @@ export DISABLE_BOOTSTRAP_VALIDATION=false
 .buildkite/scripts/steps/checks/test_hardening.sh
 .buildkite/scripts/steps/checks/ftr_configs.sh
 .buildkite/scripts/steps/checks/saved_objects_compat_changes.sh
+.buildkite/scripts/steps/code_generation/security_solution_codegen.sh
diff --git a/.buildkite/scripts/steps/functional/osquery_cypress.sh b/.buildkite/scripts/steps/functional/osquery_cypress.sh
index da27c27559a45..e9a74f308fac9 100755
--- a/.buildkite/scripts/steps/functional/osquery_cypress.sh
+++ b/.buildkite/scripts/steps/functional/osquery_cypress.sh
@@ -2,10 +2,13 @@
 
 set -euo pipefail
 
-source .buildkite/scripts/common/util.sh
+source .buildkite/scripts/steps/functional/common.sh
 source .buildkite/scripts/steps/functional/common_cypress.sh
 
-.buildkite/scripts/bootstrap.sh
+# TODO: remove the line below to use build artifacts for tests.
+# in addition to remove the line, we will have to expose the kibana install dir into the downloaded build location
+# by exporting a var like:
+# export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 node scripts/build_kibana_platform_plugins.js
 
 export JOB=kibana-osquery-cypress
@@ -14,4 +17,5 @@ echo "--- Osquery Cypress tests"
 
 cd x-pack/plugins/osquery
 
-yarn --cwd x-pack/plugins/osquery cypress:run
\ No newline at end of file
+set +e
+yarn cypress:run; status=$?; yarn junit:merge || :; exit $status
diff --git a/.buildkite/scripts/steps/functional/security_serverless_osquery.sh b/.buildkite/scripts/steps/functional/security_serverless_osquery.sh
index d631424552fa8..e87251b0710c7 100755
--- a/.buildkite/scripts/steps/functional/security_serverless_osquery.sh
+++ b/.buildkite/scripts/steps/functional/security_serverless_osquery.sh
@@ -15,4 +15,7 @@ export JOB=kibana-osquery-cypress-serverless
 
 echo "--- Security Osquery Serverless Cypress"
 
-yarn --cwd x-pack/plugins/osquery cypress:serverless:run
+cd x-pack/plugins/osquery
+
+set +e
+yarn cypress:serverless:run; status=$?; yarn junit:merge || :; exit $status
diff --git a/.eslintrc.js b/.eslintrc.js
index 67cb263bcf493..700a9de2a5a76 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -924,6 +924,23 @@ module.exports = {
       ],
       rules: {
         '@kbn/telemetry/event_generating_elements_should_be_instrumented': 'error',
+      },
+    },
+    {
+      files: [
+        'x-pack/plugins/aiops/**/*.{tsx}',
+        'x-pack/plugins/apm/**/*.{tsx}',
+        'x-pack/plugins/exploratory_view/**/*.{tsx}',
+        'x-pack/plugins/infra/**/*.{tsx}',
+        'x-pack/plugins/observability/**/*.{tsx}',
+        'x-pack/plugins/observability_ai_assistant/**/*.{tsx}',
+        'x-pack/plugins/observability_onboarding/**/*.{tsx}',
+        'x-pack/plugins/observability_shared/**/*.{tsx}',
+        'x-pack/plugins/profiling/**/*.{tsx}',
+        'x-pack/plugins/synthetics/**/*.{tsx}',
+        'x-pack/plugins/ux/**/*.{tsx}',
+      ],
+      rules: {
         '@kbn/i18n/strings_should_be_translated_with_i18n': 'warn',
         '@kbn/i18n/strings_should_be_translated_with_formatted_message': 'warn',
       },
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 044ce6273292c..b07afe6135357 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -541,6 +541,7 @@ x-pack/plugins/notifications @elastic/appex-sharedux
 packages/kbn-object-versioning @elastic/appex-sharedux
 x-pack/plugins/observability_ai_assistant @elastic/obs-ai-assistant
 x-pack/packages/observability/alert_details @elastic/actionable-observability
+x-pack/packages/observability/alerting_test_data @elastic/actionable-observability
 x-pack/test/cases_api_integration/common/plugins/observability @elastic/response-ops
 x-pack/plugins/observability_log_explorer @elastic/infra-monitoring-ui
 x-pack/plugins/observability_onboarding @elastic/apm-ui
diff --git a/api_docs/actions.mdx b/api_docs/actions.mdx
index e8d53a7a433ed..f598d299b7952 100644
--- a/api_docs/actions.mdx
+++ b/api_docs/actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/actions
 title: "actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the actions plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'actions']
 ---
 import actionsObj from './actions.devdocs.json';
diff --git a/api_docs/advanced_settings.mdx b/api_docs/advanced_settings.mdx
index e8641d2346733..efdfe59fa3040 100644
--- a/api_docs/advanced_settings.mdx
+++ b/api_docs/advanced_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/advancedSettings
 title: "advancedSettings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the advancedSettings plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'advancedSettings']
 ---
 import advancedSettingsObj from './advanced_settings.devdocs.json';
diff --git a/api_docs/aiops.mdx b/api_docs/aiops.mdx
index 4fc83fdc3737d..74da23a1fa1b9 100644
--- a/api_docs/aiops.mdx
+++ b/api_docs/aiops.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/aiops
 title: "aiops"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the aiops plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'aiops']
 ---
 import aiopsObj from './aiops.devdocs.json';
diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx
index c1c6ba03ac363..02dc00b27ca13 100644
--- a/api_docs/alerting.mdx
+++ b/api_docs/alerting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/alerting
 title: "alerting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the alerting plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'alerting']
 ---
 import alertingObj from './alerting.devdocs.json';
diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx
index 07798b2d7d44c..8287d3919a991 100644
--- a/api_docs/apm.mdx
+++ b/api_docs/apm.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apm
 title: "apm"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apm plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apm']
 ---
 import apmObj from './apm.devdocs.json';
diff --git a/api_docs/apm_data_access.mdx b/api_docs/apm_data_access.mdx
index 8e21775b0d20b..d7b26fd019fce 100644
--- a/api_docs/apm_data_access.mdx
+++ b/api_docs/apm_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apmDataAccess
 title: "apmDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apmDataAccess plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apmDataAccess']
 ---
 import apmDataAccessObj from './apm_data_access.devdocs.json';
diff --git a/api_docs/asset_manager.mdx b/api_docs/asset_manager.mdx
index a79aa72f869d7..2cff2d5c0849f 100644
--- a/api_docs/asset_manager.mdx
+++ b/api_docs/asset_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/assetManager
 title: "assetManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the assetManager plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'assetManager']
 ---
 import assetManagerObj from './asset_manager.devdocs.json';
diff --git a/api_docs/banners.mdx b/api_docs/banners.mdx
index 4033d8c8c4760..83c98cab152f4 100644
--- a/api_docs/banners.mdx
+++ b/api_docs/banners.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/banners
 title: "banners"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the banners plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'banners']
 ---
 import bannersObj from './banners.devdocs.json';
diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx
index f323de530edf3..47c8f43a041c2 100644
--- a/api_docs/bfetch.mdx
+++ b/api_docs/bfetch.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/bfetch
 title: "bfetch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the bfetch plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'bfetch']
 ---
 import bfetchObj from './bfetch.devdocs.json';
diff --git a/api_docs/canvas.mdx b/api_docs/canvas.mdx
index 085a895187864..b8c88c032ee77 100644
--- a/api_docs/canvas.mdx
+++ b/api_docs/canvas.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/canvas
 title: "canvas"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the canvas plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'canvas']
 ---
 import canvasObj from './canvas.devdocs.json';
diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx
index 28259ee380be9..f2fdc68160071 100644
--- a/api_docs/cases.mdx
+++ b/api_docs/cases.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cases
 title: "cases"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cases plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cases']
 ---
 import casesObj from './cases.devdocs.json';
diff --git a/api_docs/charts.mdx b/api_docs/charts.mdx
index d4bf1e7a9e370..aee8df4a23f9a 100644
--- a/api_docs/charts.mdx
+++ b/api_docs/charts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/charts
 title: "charts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the charts plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'charts']
 ---
 import chartsObj from './charts.devdocs.json';
diff --git a/api_docs/cloud.mdx b/api_docs/cloud.mdx
index a9a30caf1a447..7b8f4eae37dae 100644
--- a/api_docs/cloud.mdx
+++ b/api_docs/cloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloud
 title: "cloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloud plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloud']
 ---
 import cloudObj from './cloud.devdocs.json';
diff --git a/api_docs/cloud_data_migration.mdx b/api_docs/cloud_data_migration.mdx
index 87b7551a39131..03d162c302217 100644
--- a/api_docs/cloud_data_migration.mdx
+++ b/api_docs/cloud_data_migration.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDataMigration
 title: "cloudDataMigration"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDataMigration plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDataMigration']
 ---
 import cloudDataMigrationObj from './cloud_data_migration.devdocs.json';
diff --git a/api_docs/cloud_defend.mdx b/api_docs/cloud_defend.mdx
index bd261cb318035..e8c7b777c983e 100644
--- a/api_docs/cloud_defend.mdx
+++ b/api_docs/cloud_defend.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDefend
 title: "cloudDefend"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDefend plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDefend']
 ---
 import cloudDefendObj from './cloud_defend.devdocs.json';
diff --git a/api_docs/cloud_experiments.mdx b/api_docs/cloud_experiments.mdx
index ca9b201336552..a2366607958b7 100644
--- a/api_docs/cloud_experiments.mdx
+++ b/api_docs/cloud_experiments.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudExperiments
 title: "cloudExperiments"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudExperiments plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudExperiments']
 ---
 import cloudExperimentsObj from './cloud_experiments.devdocs.json';
diff --git a/api_docs/cloud_security_posture.mdx b/api_docs/cloud_security_posture.mdx
index a94173f5e5c00..75b7596ba5086 100644
--- a/api_docs/cloud_security_posture.mdx
+++ b/api_docs/cloud_security_posture.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudSecurityPosture
 title: "cloudSecurityPosture"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudSecurityPosture plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudSecurityPosture']
 ---
 import cloudSecurityPostureObj from './cloud_security_posture.devdocs.json';
diff --git a/api_docs/console.mdx b/api_docs/console.mdx
index a1129f4e78245..8a3477a8dfacd 100644
--- a/api_docs/console.mdx
+++ b/api_docs/console.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/console
 title: "console"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the console plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'console']
 ---
 import consoleObj from './console.devdocs.json';
diff --git a/api_docs/content_management.mdx b/api_docs/content_management.mdx
index df4af236d4167..2488f2ac6532a 100644
--- a/api_docs/content_management.mdx
+++ b/api_docs/content_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/contentManagement
 title: "contentManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the contentManagement plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'contentManagement']
 ---
 import contentManagementObj from './content_management.devdocs.json';
diff --git a/api_docs/controls.mdx b/api_docs/controls.mdx
index c10fcafd5449d..862602ee17c6a 100644
--- a/api_docs/controls.mdx
+++ b/api_docs/controls.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/controls
 title: "controls"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the controls plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'controls']
 ---
 import controlsObj from './controls.devdocs.json';
diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx
index 7cceeeae87338..b31437b6180ad 100644
--- a/api_docs/custom_integrations.mdx
+++ b/api_docs/custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/customIntegrations
 title: "customIntegrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the customIntegrations plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'customIntegrations']
 ---
 import customIntegrationsObj from './custom_integrations.devdocs.json';
diff --git a/api_docs/dashboard.mdx b/api_docs/dashboard.mdx
index e1e2e6f161749..e39c03f52d508 100644
--- a/api_docs/dashboard.mdx
+++ b/api_docs/dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboard
 title: "dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboard plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboard']
 ---
 import dashboardObj from './dashboard.devdocs.json';
diff --git a/api_docs/dashboard_enhanced.mdx b/api_docs/dashboard_enhanced.mdx
index 6dae7ddb65e9d..ab32de268551c 100644
--- a/api_docs/dashboard_enhanced.mdx
+++ b/api_docs/dashboard_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboardEnhanced
 title: "dashboardEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboardEnhanced plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboardEnhanced']
 ---
 import dashboardEnhancedObj from './dashboard_enhanced.devdocs.json';
diff --git a/api_docs/data.mdx b/api_docs/data.mdx
index a1240cf855d3c..fce9c0d289758 100644
--- a/api_docs/data.mdx
+++ b/api_docs/data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data
 title: "data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data']
 ---
 import dataObj from './data.devdocs.json';
diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx
index 2bf79e7f68ce3..d142b7e5ff89f 100644
--- a/api_docs/data_query.mdx
+++ b/api_docs/data_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-query
 title: "data.query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.query plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.query']
 ---
 import dataQueryObj from './data_query.devdocs.json';
diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx
index c378df00f6d58..dbf6667d76ddc 100644
--- a/api_docs/data_search.mdx
+++ b/api_docs/data_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-search
 title: "data.search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.search plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.search']
 ---
 import dataSearchObj from './data_search.devdocs.json';
diff --git a/api_docs/data_view_editor.mdx b/api_docs/data_view_editor.mdx
index f96edd39eccef..fdac0998fc79d 100644
--- a/api_docs/data_view_editor.mdx
+++ b/api_docs/data_view_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewEditor
 title: "dataViewEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewEditor plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewEditor']
 ---
 import dataViewEditorObj from './data_view_editor.devdocs.json';
diff --git a/api_docs/data_view_field_editor.mdx b/api_docs/data_view_field_editor.mdx
index f075eb62cdd6f..21383a76ece72 100644
--- a/api_docs/data_view_field_editor.mdx
+++ b/api_docs/data_view_field_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewFieldEditor
 title: "dataViewFieldEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewFieldEditor plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewFieldEditor']
 ---
 import dataViewFieldEditorObj from './data_view_field_editor.devdocs.json';
diff --git a/api_docs/data_view_management.mdx b/api_docs/data_view_management.mdx
index d5bbc3317608e..eb7b2fad1faf6 100644
--- a/api_docs/data_view_management.mdx
+++ b/api_docs/data_view_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewManagement
 title: "dataViewManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewManagement plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewManagement']
 ---
 import dataViewManagementObj from './data_view_management.devdocs.json';
diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx
index 5cbdc172a2aa0..5f3de11555319 100644
--- a/api_docs/data_views.mdx
+++ b/api_docs/data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViews
 title: "dataViews"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViews plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViews']
 ---
 import dataViewsObj from './data_views.devdocs.json';
diff --git a/api_docs/data_visualizer.mdx b/api_docs/data_visualizer.mdx
index ba391b2c56639..5122172501e47 100644
--- a/api_docs/data_visualizer.mdx
+++ b/api_docs/data_visualizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataVisualizer
 title: "dataVisualizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataVisualizer plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataVisualizer']
 ---
 import dataVisualizerObj from './data_visualizer.devdocs.json';
diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx
index 0d5461d79b79a..3bd8dfaf859b0 100644
--- a/api_docs/deprecations_by_api.mdx
+++ b/api_docs/deprecations_by_api.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByApi
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-api
 title: Deprecated API usage by API
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx
index fbc91a3023b2b..8b9b3cdf5f69c 100644
--- a/api_docs/deprecations_by_plugin.mdx
+++ b/api_docs/deprecations_by_plugin.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByPlugin
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-plugin
 title: Deprecated API usage by plugin
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
diff --git a/api_docs/deprecations_by_team.mdx b/api_docs/deprecations_by_team.mdx
index a589030f4624e..fcaa5cdf99e7e 100644
--- a/api_docs/deprecations_by_team.mdx
+++ b/api_docs/deprecations_by_team.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsDueByTeam
 slug: /kibana-dev-docs/api-meta/deprecations-due-by-team
 title: Deprecated APIs due to be removed, by team
 description: Lists the teams that are referencing deprecated APIs with a remove by date.
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
diff --git a/api_docs/dev_tools.mdx b/api_docs/dev_tools.mdx
index 031af628232af..21aedd218aa4f 100644
--- a/api_docs/dev_tools.mdx
+++ b/api_docs/dev_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/devTools
 title: "devTools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the devTools plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'devTools']
 ---
 import devToolsObj from './dev_tools.devdocs.json';
diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx
index 80bbfd1f0fe0c..6062eba281e76 100644
--- a/api_docs/discover.mdx
+++ b/api_docs/discover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discover
 title: "discover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discover plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discover']
 ---
 import discoverObj from './discover.devdocs.json';
diff --git a/api_docs/discover_enhanced.mdx b/api_docs/discover_enhanced.mdx
index 6350dba94d9cb..e766717018974 100644
--- a/api_docs/discover_enhanced.mdx
+++ b/api_docs/discover_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discoverEnhanced
 title: "discoverEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discoverEnhanced plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverEnhanced']
 ---
 import discoverEnhancedObj from './discover_enhanced.devdocs.json';
diff --git a/api_docs/ecs_data_quality_dashboard.mdx b/api_docs/ecs_data_quality_dashboard.mdx
index 0f66a0e731515..2cd91fb61456f 100644
--- a/api_docs/ecs_data_quality_dashboard.mdx
+++ b/api_docs/ecs_data_quality_dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ecsDataQualityDashboard
 title: "ecsDataQualityDashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ecsDataQualityDashboard plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ecsDataQualityDashboard']
 ---
 import ecsDataQualityDashboardObj from './ecs_data_quality_dashboard.devdocs.json';
diff --git a/api_docs/elastic_assistant.mdx b/api_docs/elastic_assistant.mdx
index b3f95de80246f..90b235e6f81b7 100644
--- a/api_docs/elastic_assistant.mdx
+++ b/api_docs/elastic_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/elasticAssistant
 title: "elasticAssistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the elasticAssistant plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'elasticAssistant']
 ---
 import elasticAssistantObj from './elastic_assistant.devdocs.json';
diff --git a/api_docs/embeddable.mdx b/api_docs/embeddable.mdx
index d8bd9acd9204b..aeb1b2032f94d 100644
--- a/api_docs/embeddable.mdx
+++ b/api_docs/embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddable
 title: "embeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddable plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddable']
 ---
 import embeddableObj from './embeddable.devdocs.json';
diff --git a/api_docs/embeddable_enhanced.mdx b/api_docs/embeddable_enhanced.mdx
index b3a2c58b2c0fd..40a066617027f 100644
--- a/api_docs/embeddable_enhanced.mdx
+++ b/api_docs/embeddable_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddableEnhanced
 title: "embeddableEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddableEnhanced plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddableEnhanced']
 ---
 import embeddableEnhancedObj from './embeddable_enhanced.devdocs.json';
diff --git a/api_docs/encrypted_saved_objects.mdx b/api_docs/encrypted_saved_objects.mdx
index 71bbbf05e67ac..584cd3f07050c 100644
--- a/api_docs/encrypted_saved_objects.mdx
+++ b/api_docs/encrypted_saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/encryptedSavedObjects
 title: "encryptedSavedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the encryptedSavedObjects plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'encryptedSavedObjects']
 ---
 import encryptedSavedObjectsObj from './encrypted_saved_objects.devdocs.json';
diff --git a/api_docs/enterprise_search.mdx b/api_docs/enterprise_search.mdx
index 7b62a57120c53..f6f428690d66e 100644
--- a/api_docs/enterprise_search.mdx
+++ b/api_docs/enterprise_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/enterpriseSearch
 title: "enterpriseSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the enterpriseSearch plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'enterpriseSearch']
 ---
 import enterpriseSearchObj from './enterprise_search.devdocs.json';
diff --git a/api_docs/es_ui_shared.devdocs.json b/api_docs/es_ui_shared.devdocs.json
index 37cdf84e7503e..89ea258fe6962 100644
--- a/api_docs/es_ui_shared.devdocs.json
+++ b/api_docs/es_ui_shared.devdocs.json
@@ -527,7 +527,7 @@
         "label": "SectionLoading",
         "description": [],
         "signature": [
-          "({ inline, children, ...rest }: React.PropsWithChildren<Props>) => JSX.Element"
+          "({ inline, \"data-test-subj\": dataTestSubj, children, ...rest }: React.PropsWithChildren<Props>) => JSX.Element"
         ],
         "path": "src/plugins/es_ui_shared/public/components/section_loading/section_loading.tsx",
         "deprecated": false,
@@ -538,7 +538,7 @@
             "id": "def-public.SectionLoading.$1",
             "type": "CompoundType",
             "tags": [],
-            "label": "{ inline, children, ...rest }",
+            "label": "{\n  inline,\n  'data-test-subj': dataTestSubj,\n  children,\n  ...rest\n}",
             "description": [],
             "signature": [
               "React.PropsWithChildren<Props>"
diff --git a/api_docs/es_ui_shared.mdx b/api_docs/es_ui_shared.mdx
index e9b4556666441..c50ffd21b3ba9 100644
--- a/api_docs/es_ui_shared.mdx
+++ b/api_docs/es_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/esUiShared
 title: "esUiShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the esUiShared plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'esUiShared']
 ---
 import esUiSharedObj from './es_ui_shared.devdocs.json';
diff --git a/api_docs/event_annotation.mdx b/api_docs/event_annotation.mdx
index 5814fc1d33338..fe2b80985f59f 100644
--- a/api_docs/event_annotation.mdx
+++ b/api_docs/event_annotation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotation
 title: "eventAnnotation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotation plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotation']
 ---
 import eventAnnotationObj from './event_annotation.devdocs.json';
diff --git a/api_docs/event_annotation_listing.mdx b/api_docs/event_annotation_listing.mdx
index 17908b8f15b29..3c8ac928b35a7 100644
--- a/api_docs/event_annotation_listing.mdx
+++ b/api_docs/event_annotation_listing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotationListing
 title: "eventAnnotationListing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotationListing plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotationListing']
 ---
 import eventAnnotationListingObj from './event_annotation_listing.devdocs.json';
diff --git a/api_docs/event_log.mdx b/api_docs/event_log.mdx
index 3a7324323f21c..6655e6b39dcc2 100644
--- a/api_docs/event_log.mdx
+++ b/api_docs/event_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventLog
 title: "eventLog"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventLog plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventLog']
 ---
 import eventLogObj from './event_log.devdocs.json';
diff --git a/api_docs/exploratory_view.mdx b/api_docs/exploratory_view.mdx
index 2a62155db9b32..ba280037c0952 100644
--- a/api_docs/exploratory_view.mdx
+++ b/api_docs/exploratory_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/exploratoryView
 title: "exploratoryView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the exploratoryView plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'exploratoryView']
 ---
 import exploratoryViewObj from './exploratory_view.devdocs.json';
diff --git a/api_docs/expression_error.mdx b/api_docs/expression_error.mdx
index ec8c08805ba55..0154202e25245 100644
--- a/api_docs/expression_error.mdx
+++ b/api_docs/expression_error.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionError
 title: "expressionError"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionError plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionError']
 ---
 import expressionErrorObj from './expression_error.devdocs.json';
diff --git a/api_docs/expression_gauge.mdx b/api_docs/expression_gauge.mdx
index 18579b8249394..92548b77fc1fd 100644
--- a/api_docs/expression_gauge.mdx
+++ b/api_docs/expression_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionGauge
 title: "expressionGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionGauge plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionGauge']
 ---
 import expressionGaugeObj from './expression_gauge.devdocs.json';
diff --git a/api_docs/expression_heatmap.mdx b/api_docs/expression_heatmap.mdx
index 131b7e5bfd851..6deb1327a5ff6 100644
--- a/api_docs/expression_heatmap.mdx
+++ b/api_docs/expression_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionHeatmap
 title: "expressionHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionHeatmap plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionHeatmap']
 ---
 import expressionHeatmapObj from './expression_heatmap.devdocs.json';
diff --git a/api_docs/expression_image.mdx b/api_docs/expression_image.mdx
index 734652e90107c..f8870390ed0ed 100644
--- a/api_docs/expression_image.mdx
+++ b/api_docs/expression_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionImage
 title: "expressionImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionImage plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionImage']
 ---
 import expressionImageObj from './expression_image.devdocs.json';
diff --git a/api_docs/expression_legacy_metric_vis.mdx b/api_docs/expression_legacy_metric_vis.mdx
index 180dcc1332a96..6339f330f1e53 100644
--- a/api_docs/expression_legacy_metric_vis.mdx
+++ b/api_docs/expression_legacy_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionLegacyMetricVis
 title: "expressionLegacyMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionLegacyMetricVis plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionLegacyMetricVis']
 ---
 import expressionLegacyMetricVisObj from './expression_legacy_metric_vis.devdocs.json';
diff --git a/api_docs/expression_metric.mdx b/api_docs/expression_metric.mdx
index ad9e58cea41b3..a61cb31f6f61c 100644
--- a/api_docs/expression_metric.mdx
+++ b/api_docs/expression_metric.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetric
 title: "expressionMetric"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetric plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetric']
 ---
 import expressionMetricObj from './expression_metric.devdocs.json';
diff --git a/api_docs/expression_metric_vis.mdx b/api_docs/expression_metric_vis.mdx
index 38a0810324684..bf5b4d05c4816 100644
--- a/api_docs/expression_metric_vis.mdx
+++ b/api_docs/expression_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetricVis
 title: "expressionMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetricVis plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetricVis']
 ---
 import expressionMetricVisObj from './expression_metric_vis.devdocs.json';
diff --git a/api_docs/expression_partition_vis.mdx b/api_docs/expression_partition_vis.mdx
index 56abea0e5d685..3b1336e2c95bf 100644
--- a/api_docs/expression_partition_vis.mdx
+++ b/api_docs/expression_partition_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionPartitionVis
 title: "expressionPartitionVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionPartitionVis plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionPartitionVis']
 ---
 import expressionPartitionVisObj from './expression_partition_vis.devdocs.json';
diff --git a/api_docs/expression_repeat_image.mdx b/api_docs/expression_repeat_image.mdx
index 8ce94ac16fcee..6896cecd5e596 100644
--- a/api_docs/expression_repeat_image.mdx
+++ b/api_docs/expression_repeat_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRepeatImage
 title: "expressionRepeatImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRepeatImage plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRepeatImage']
 ---
 import expressionRepeatImageObj from './expression_repeat_image.devdocs.json';
diff --git a/api_docs/expression_reveal_image.mdx b/api_docs/expression_reveal_image.mdx
index 7a361f276babf..b78ff21638e5e 100644
--- a/api_docs/expression_reveal_image.mdx
+++ b/api_docs/expression_reveal_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRevealImage
 title: "expressionRevealImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRevealImage plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRevealImage']
 ---
 import expressionRevealImageObj from './expression_reveal_image.devdocs.json';
diff --git a/api_docs/expression_shape.mdx b/api_docs/expression_shape.mdx
index fa2dbd9822132..bb4cc8b27c60b 100644
--- a/api_docs/expression_shape.mdx
+++ b/api_docs/expression_shape.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionShape
 title: "expressionShape"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionShape plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionShape']
 ---
 import expressionShapeObj from './expression_shape.devdocs.json';
diff --git a/api_docs/expression_tagcloud.mdx b/api_docs/expression_tagcloud.mdx
index 508ae3b853683..f6ef3a5b0bd1a 100644
--- a/api_docs/expression_tagcloud.mdx
+++ b/api_docs/expression_tagcloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionTagcloud
 title: "expressionTagcloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionTagcloud plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionTagcloud']
 ---
 import expressionTagcloudObj from './expression_tagcloud.devdocs.json';
diff --git a/api_docs/expression_x_y.mdx b/api_docs/expression_x_y.mdx
index 75aca7f07e7a0..644b16e3e441e 100644
--- a/api_docs/expression_x_y.mdx
+++ b/api_docs/expression_x_y.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionXY
 title: "expressionXY"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionXY plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionXY']
 ---
 import expressionXYObj from './expression_x_y.devdocs.json';
diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx
index 197c8b9e9bc26..8166a8dff084c 100644
--- a/api_docs/expressions.mdx
+++ b/api_docs/expressions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressions
 title: "expressions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressions plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressions']
 ---
 import expressionsObj from './expressions.devdocs.json';
diff --git a/api_docs/features.mdx b/api_docs/features.mdx
index 9605228ce6245..29ef7f49f7b88 100644
--- a/api_docs/features.mdx
+++ b/api_docs/features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/features
 title: "features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the features plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'features']
 ---
 import featuresObj from './features.devdocs.json';
diff --git a/api_docs/field_formats.mdx b/api_docs/field_formats.mdx
index 99531d9ab062c..f30a4ebd3a939 100644
--- a/api_docs/field_formats.mdx
+++ b/api_docs/field_formats.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fieldFormats
 title: "fieldFormats"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fieldFormats plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fieldFormats']
 ---
 import fieldFormatsObj from './field_formats.devdocs.json';
diff --git a/api_docs/file_upload.mdx b/api_docs/file_upload.mdx
index bfca0d8647365..1d097578b94e4 100644
--- a/api_docs/file_upload.mdx
+++ b/api_docs/file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fileUpload
 title: "fileUpload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fileUpload plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fileUpload']
 ---
 import fileUploadObj from './file_upload.devdocs.json';
diff --git a/api_docs/files.mdx b/api_docs/files.mdx
index 22b0eb553905b..7eacea44c6840 100644
--- a/api_docs/files.mdx
+++ b/api_docs/files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/files
 title: "files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the files plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'files']
 ---
 import filesObj from './files.devdocs.json';
diff --git a/api_docs/files_management.mdx b/api_docs/files_management.mdx
index 31ab7e90df446..3f8ba3184b85a 100644
--- a/api_docs/files_management.mdx
+++ b/api_docs/files_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/filesManagement
 title: "filesManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the filesManagement plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'filesManagement']
 ---
 import filesManagementObj from './files_management.devdocs.json';
diff --git a/api_docs/fleet.devdocs.json b/api_docs/fleet.devdocs.json
index 6ef62450ad344..fd706a0787873 100644
--- a/api_docs/fleet.devdocs.json
+++ b/api_docs/fleet.devdocs.json
@@ -18961,15 +18961,30 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "fleet",
+            "id": "def-common.FleetServerAgent.upgrade_details",
+            "type": "Object",
+            "tags": [],
+            "label": "upgrade_details",
+            "description": [
+              "\nID of the API key the Elastic Agent must used to contact Fleet Server\n\nUpgrade state of the Elastic Agent"
+            ],
+            "signature": [
+              "AgentUpgradeDetails",
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/fleet/common/types/models/agent.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "fleet",
             "id": "def-common.FleetServerAgent.access_api_key_id",
             "type": "string",
             "tags": [],
             "label": "access_api_key_id",
-            "description": [
-              "\nID of the API key the Elastic Agent must used to contact Fleet Server"
-            ],
+            "description": [],
             "signature": [
               "string | undefined"
             ],
diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx
index e10ba0c2c95ab..95cb660c99011 100644
--- a/api_docs/fleet.mdx
+++ b/api_docs/fleet.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fleet
 title: "fleet"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fleet plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fleet']
 ---
 import fleetObj from './fleet.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) for questi
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 1208 | 3 | 1090 | 43 |
+| 1209 | 3 | 1091 | 44 |
 
 ## Client
 
diff --git a/api_docs/global_search.mdx b/api_docs/global_search.mdx
index 294043c0b4e0a..6eeaeb1623a3c 100644
--- a/api_docs/global_search.mdx
+++ b/api_docs/global_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/globalSearch
 title: "globalSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the globalSearch plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'globalSearch']
 ---
 import globalSearchObj from './global_search.devdocs.json';
diff --git a/api_docs/guided_onboarding.mdx b/api_docs/guided_onboarding.mdx
index 7ee2c22aea645..eb0e7ee5570b5 100644
--- a/api_docs/guided_onboarding.mdx
+++ b/api_docs/guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/guidedOnboarding
 title: "guidedOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the guidedOnboarding plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'guidedOnboarding']
 ---
 import guidedOnboardingObj from './guided_onboarding.devdocs.json';
diff --git a/api_docs/home.mdx b/api_docs/home.mdx
index e201218f8b108..cb91f7074f8bd 100644
--- a/api_docs/home.mdx
+++ b/api_docs/home.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/home
 title: "home"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the home plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'home']
 ---
 import homeObj from './home.devdocs.json';
diff --git a/api_docs/image_embeddable.mdx b/api_docs/image_embeddable.mdx
index bedcf9289117f..4e9e0efc05c79 100644
--- a/api_docs/image_embeddable.mdx
+++ b/api_docs/image_embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/imageEmbeddable
 title: "imageEmbeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the imageEmbeddable plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'imageEmbeddable']
 ---
 import imageEmbeddableObj from './image_embeddable.devdocs.json';
diff --git a/api_docs/index_lifecycle_management.mdx b/api_docs/index_lifecycle_management.mdx
index 4a16cc47b8562..b69e624f94a8b 100644
--- a/api_docs/index_lifecycle_management.mdx
+++ b/api_docs/index_lifecycle_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexLifecycleManagement
 title: "indexLifecycleManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexLifecycleManagement plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexLifecycleManagement']
 ---
 import indexLifecycleManagementObj from './index_lifecycle_management.devdocs.json';
diff --git a/api_docs/index_management.mdx b/api_docs/index_management.mdx
index 34fa5b65248dd..df51448155f3a 100644
--- a/api_docs/index_management.mdx
+++ b/api_docs/index_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexManagement
 title: "indexManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexManagement plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexManagement']
 ---
 import indexManagementObj from './index_management.devdocs.json';
diff --git a/api_docs/infra.mdx b/api_docs/infra.mdx
index 28a86837a0703..c35679dcf4037 100644
--- a/api_docs/infra.mdx
+++ b/api_docs/infra.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/infra
 title: "infra"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the infra plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'infra']
 ---
 import infraObj from './infra.devdocs.json';
diff --git a/api_docs/inspector.mdx b/api_docs/inspector.mdx
index 607f101785afa..5f48fad8636c5 100644
--- a/api_docs/inspector.mdx
+++ b/api_docs/inspector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/inspector
 title: "inspector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the inspector plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'inspector']
 ---
 import inspectorObj from './inspector.devdocs.json';
diff --git a/api_docs/interactive_setup.mdx b/api_docs/interactive_setup.mdx
index b861084bc6f8d..afac3ddae64ca 100644
--- a/api_docs/interactive_setup.mdx
+++ b/api_docs/interactive_setup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/interactiveSetup
 title: "interactiveSetup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the interactiveSetup plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'interactiveSetup']
 ---
 import interactiveSetupObj from './interactive_setup.devdocs.json';
diff --git a/api_docs/kbn_ace.mdx b/api_docs/kbn_ace.mdx
index f24d13ad3c1ba..94495a1b3d1cc 100644
--- a/api_docs/kbn_ace.mdx
+++ b/api_docs/kbn_ace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ace
 title: "@kbn/ace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ace plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ace']
 ---
 import kbnAceObj from './kbn_ace.devdocs.json';
diff --git a/api_docs/kbn_aiops_components.mdx b/api_docs/kbn_aiops_components.mdx
index 7f111b27796d2..00cf9cdb57229 100644
--- a/api_docs/kbn_aiops_components.mdx
+++ b/api_docs/kbn_aiops_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-components
 title: "@kbn/aiops-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-components plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-components']
 ---
 import kbnAiopsComponentsObj from './kbn_aiops_components.devdocs.json';
diff --git a/api_docs/kbn_aiops_utils.mdx b/api_docs/kbn_aiops_utils.mdx
index 21ce788f458c0..6ea3ee7fb2d6c 100644
--- a/api_docs/kbn_aiops_utils.mdx
+++ b/api_docs/kbn_aiops_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-utils
 title: "@kbn/aiops-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-utils']
 ---
 import kbnAiopsUtilsObj from './kbn_aiops_utils.devdocs.json';
diff --git a/api_docs/kbn_alerting_api_integration_helpers.mdx b/api_docs/kbn_alerting_api_integration_helpers.mdx
index bdfb82934e148..493bc1ae62a51 100644
--- a/api_docs/kbn_alerting_api_integration_helpers.mdx
+++ b/api_docs/kbn_alerting_api_integration_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerting-api-integration-helpers
 title: "@kbn/alerting-api-integration-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerting-api-integration-helpers plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerting-api-integration-helpers']
 ---
 import kbnAlertingApiIntegrationHelpersObj from './kbn_alerting_api_integration_helpers.devdocs.json';
diff --git a/api_docs/kbn_alerting_state_types.mdx b/api_docs/kbn_alerting_state_types.mdx
index 17552883bb50f..c20ba5cddaed9 100644
--- a/api_docs/kbn_alerting_state_types.mdx
+++ b/api_docs/kbn_alerting_state_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerting-state-types
 title: "@kbn/alerting-state-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerting-state-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerting-state-types']
 ---
 import kbnAlertingStateTypesObj from './kbn_alerting_state_types.devdocs.json';
diff --git a/api_docs/kbn_alerts_as_data_utils.mdx b/api_docs/kbn_alerts_as_data_utils.mdx
index c10933a2e584c..9a7f486d2fc2e 100644
--- a/api_docs/kbn_alerts_as_data_utils.mdx
+++ b/api_docs/kbn_alerts_as_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts-as-data-utils
 title: "@kbn/alerts-as-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts-as-data-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts-as-data-utils']
 ---
 import kbnAlertsAsDataUtilsObj from './kbn_alerts_as_data_utils.devdocs.json';
diff --git a/api_docs/kbn_alerts_ui_shared.mdx b/api_docs/kbn_alerts_ui_shared.mdx
index 37c648f26df25..0545defba3a2d 100644
--- a/api_docs/kbn_alerts_ui_shared.mdx
+++ b/api_docs/kbn_alerts_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts-ui-shared
 title: "@kbn/alerts-ui-shared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts-ui-shared plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts-ui-shared']
 ---
 import kbnAlertsUiSharedObj from './kbn_alerts_ui_shared.devdocs.json';
diff --git a/api_docs/kbn_analytics.mdx b/api_docs/kbn_analytics.mdx
index b45f523dcf075..600e80991fa15 100644
--- a/api_docs/kbn_analytics.mdx
+++ b/api_docs/kbn_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics
 title: "@kbn/analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics']
 ---
 import kbnAnalyticsObj from './kbn_analytics.devdocs.json';
diff --git a/api_docs/kbn_analytics_client.mdx b/api_docs/kbn_analytics_client.mdx
index 1bea59f569db6..b02eacc402536 100644
--- a/api_docs/kbn_analytics_client.mdx
+++ b/api_docs/kbn_analytics_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-client
 title: "@kbn/analytics-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-client plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-client']
 ---
 import kbnAnalyticsClientObj from './kbn_analytics_client.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
index f1b840c8cf083..dd2f6f11ae076 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-browser
 title: "@kbn/analytics-shippers-elastic-v3-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-browser']
 ---
 import kbnAnalyticsShippersElasticV3BrowserObj from './kbn_analytics_shippers_elastic_v3_browser.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
index 4fcd800fa0890..b42ce7b6db699 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-common
 title: "@kbn/analytics-shippers-elastic-v3-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-common']
 ---
 import kbnAnalyticsShippersElasticV3CommonObj from './kbn_analytics_shippers_elastic_v3_common.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
index 8f785a129d754..1fd9e36381efa 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-server
 title: "@kbn/analytics-shippers-elastic-v3-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-server']
 ---
 import kbnAnalyticsShippersElasticV3ServerObj from './kbn_analytics_shippers_elastic_v3_server.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_fullstory.mdx b/api_docs/kbn_analytics_shippers_fullstory.mdx
index c61cf4706338f..ca9d7649d4646 100644
--- a/api_docs/kbn_analytics_shippers_fullstory.mdx
+++ b/api_docs/kbn_analytics_shippers_fullstory.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-fullstory
 title: "@kbn/analytics-shippers-fullstory"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-fullstory plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-fullstory']
 ---
 import kbnAnalyticsShippersFullstoryObj from './kbn_analytics_shippers_fullstory.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_gainsight.mdx b/api_docs/kbn_analytics_shippers_gainsight.mdx
index d58bc1e0b85df..6b7fa84fe56b3 100644
--- a/api_docs/kbn_analytics_shippers_gainsight.mdx
+++ b/api_docs/kbn_analytics_shippers_gainsight.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-gainsight
 title: "@kbn/analytics-shippers-gainsight"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-gainsight plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-gainsight']
 ---
 import kbnAnalyticsShippersGainsightObj from './kbn_analytics_shippers_gainsight.devdocs.json';
diff --git a/api_docs/kbn_apm_config_loader.mdx b/api_docs/kbn_apm_config_loader.mdx
index 125cee1ce451a..85259c64bfc9e 100644
--- a/api_docs/kbn_apm_config_loader.mdx
+++ b/api_docs/kbn_apm_config_loader.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-config-loader
 title: "@kbn/apm-config-loader"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-config-loader plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-config-loader']
 ---
 import kbnApmConfigLoaderObj from './kbn_apm_config_loader.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace.mdx b/api_docs/kbn_apm_synthtrace.mdx
index aa921476251dc..e19a70b35efb9 100644
--- a/api_docs/kbn_apm_synthtrace.mdx
+++ b/api_docs/kbn_apm_synthtrace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace
 title: "@kbn/apm-synthtrace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace']
 ---
 import kbnApmSynthtraceObj from './kbn_apm_synthtrace.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace_client.mdx b/api_docs/kbn_apm_synthtrace_client.mdx
index 2c3f57d91dab8..1f6fa002fc1d8 100644
--- a/api_docs/kbn_apm_synthtrace_client.mdx
+++ b/api_docs/kbn_apm_synthtrace_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace-client
 title: "@kbn/apm-synthtrace-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace-client plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace-client']
 ---
 import kbnApmSynthtraceClientObj from './kbn_apm_synthtrace_client.devdocs.json';
diff --git a/api_docs/kbn_apm_utils.mdx b/api_docs/kbn_apm_utils.mdx
index f6c6dc1045781..083aecb32438f 100644
--- a/api_docs/kbn_apm_utils.mdx
+++ b/api_docs/kbn_apm_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-utils
 title: "@kbn/apm-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-utils']
 ---
 import kbnApmUtilsObj from './kbn_apm_utils.devdocs.json';
diff --git a/api_docs/kbn_axe_config.mdx b/api_docs/kbn_axe_config.mdx
index e0d4804415547..de84c1293db60 100644
--- a/api_docs/kbn_axe_config.mdx
+++ b/api_docs/kbn_axe_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-axe-config
 title: "@kbn/axe-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/axe-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/axe-config']
 ---
 import kbnAxeConfigObj from './kbn_axe_config.devdocs.json';
diff --git a/api_docs/kbn_cases_components.mdx b/api_docs/kbn_cases_components.mdx
index 301d820ee903e..e2bd1f02bc8e8 100644
--- a/api_docs/kbn_cases_components.mdx
+++ b/api_docs/kbn_cases_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cases-components
 title: "@kbn/cases-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cases-components plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cases-components']
 ---
 import kbnCasesComponentsObj from './kbn_cases_components.devdocs.json';
diff --git a/api_docs/kbn_cell_actions.mdx b/api_docs/kbn_cell_actions.mdx
index d7d64e7666a9c..b53e1cb30b776 100644
--- a/api_docs/kbn_cell_actions.mdx
+++ b/api_docs/kbn_cell_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cell-actions
 title: "@kbn/cell-actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cell-actions plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cell-actions']
 ---
 import kbnCellActionsObj from './kbn_cell_actions.devdocs.json';
diff --git a/api_docs/kbn_chart_expressions_common.mdx b/api_docs/kbn_chart_expressions_common.mdx
index bb1ae0ffd5a38..3df9ce29183f1 100644
--- a/api_docs/kbn_chart_expressions_common.mdx
+++ b/api_docs/kbn_chart_expressions_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-expressions-common
 title: "@kbn/chart-expressions-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-expressions-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-expressions-common']
 ---
 import kbnChartExpressionsCommonObj from './kbn_chart_expressions_common.devdocs.json';
diff --git a/api_docs/kbn_chart_icons.mdx b/api_docs/kbn_chart_icons.mdx
index 3456b88d4f68c..39dee7afff548 100644
--- a/api_docs/kbn_chart_icons.mdx
+++ b/api_docs/kbn_chart_icons.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-icons
 title: "@kbn/chart-icons"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-icons plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-icons']
 ---
 import kbnChartIconsObj from './kbn_chart_icons.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_core.mdx b/api_docs/kbn_ci_stats_core.mdx
index ed7a7345362ea..89d83f95d1cec 100644
--- a/api_docs/kbn_ci_stats_core.mdx
+++ b/api_docs/kbn_ci_stats_core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-core
 title: "@kbn/ci-stats-core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-core plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-core']
 ---
 import kbnCiStatsCoreObj from './kbn_ci_stats_core.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_performance_metrics.mdx b/api_docs/kbn_ci_stats_performance_metrics.mdx
index 857415c537340..bd1508e1eab5f 100644
--- a/api_docs/kbn_ci_stats_performance_metrics.mdx
+++ b/api_docs/kbn_ci_stats_performance_metrics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-performance-metrics
 title: "@kbn/ci-stats-performance-metrics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-performance-metrics plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-performance-metrics']
 ---
 import kbnCiStatsPerformanceMetricsObj from './kbn_ci_stats_performance_metrics.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_reporter.mdx b/api_docs/kbn_ci_stats_reporter.mdx
index 30540e5bad733..8df87e6da1ad8 100644
--- a/api_docs/kbn_ci_stats_reporter.mdx
+++ b/api_docs/kbn_ci_stats_reporter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-reporter
 title: "@kbn/ci-stats-reporter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-reporter plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-reporter']
 ---
 import kbnCiStatsReporterObj from './kbn_ci_stats_reporter.devdocs.json';
diff --git a/api_docs/kbn_cli_dev_mode.mdx b/api_docs/kbn_cli_dev_mode.mdx
index 69be9d21ab639..992b7e7245132 100644
--- a/api_docs/kbn_cli_dev_mode.mdx
+++ b/api_docs/kbn_cli_dev_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cli-dev-mode
 title: "@kbn/cli-dev-mode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cli-dev-mode plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cli-dev-mode']
 ---
 import kbnCliDevModeObj from './kbn_cli_dev_mode.devdocs.json';
diff --git a/api_docs/kbn_code_editor.mdx b/api_docs/kbn_code_editor.mdx
index f506f43cc7370..cbb4c44ad2ad7 100644
--- a/api_docs/kbn_code_editor.mdx
+++ b/api_docs/kbn_code_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor
 title: "@kbn/code-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor']
 ---
 import kbnCodeEditorObj from './kbn_code_editor.devdocs.json';
diff --git a/api_docs/kbn_code_editor_mocks.mdx b/api_docs/kbn_code_editor_mocks.mdx
index 605001160837f..c5cab8c0fbe06 100644
--- a/api_docs/kbn_code_editor_mocks.mdx
+++ b/api_docs/kbn_code_editor_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-code-editor-mocks
 title: "@kbn/code-editor-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/code-editor-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/code-editor-mocks']
 ---
 import kbnCodeEditorMocksObj from './kbn_code_editor_mocks.devdocs.json';
diff --git a/api_docs/kbn_coloring.mdx b/api_docs/kbn_coloring.mdx
index 28eb5f07578a9..73d82f26c4c18 100644
--- a/api_docs/kbn_coloring.mdx
+++ b/api_docs/kbn_coloring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-coloring
 title: "@kbn/coloring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/coloring plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/coloring']
 ---
 import kbnColoringObj from './kbn_coloring.devdocs.json';
diff --git a/api_docs/kbn_config.mdx b/api_docs/kbn_config.mdx
index 5edc888e9d765..e0797539f5634 100644
--- a/api_docs/kbn_config.mdx
+++ b/api_docs/kbn_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config
 title: "@kbn/config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config']
 ---
 import kbnConfigObj from './kbn_config.devdocs.json';
diff --git a/api_docs/kbn_config_mocks.mdx b/api_docs/kbn_config_mocks.mdx
index a7d3218217ef1..29c4e37f18c4b 100644
--- a/api_docs/kbn_config_mocks.mdx
+++ b/api_docs/kbn_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-mocks
 title: "@kbn/config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-mocks']
 ---
 import kbnConfigMocksObj from './kbn_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_config_schema.mdx b/api_docs/kbn_config_schema.mdx
index 792061cd1c992..d25f2d384f919 100644
--- a/api_docs/kbn_config_schema.mdx
+++ b/api_docs/kbn_config_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-schema
 title: "@kbn/config-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-schema plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-schema']
 ---
 import kbnConfigSchemaObj from './kbn_config_schema.devdocs.json';
diff --git a/api_docs/kbn_content_management_content_editor.mdx b/api_docs/kbn_content_management_content_editor.mdx
index 91133fcbce883..a7564002e2f80 100644
--- a/api_docs/kbn_content_management_content_editor.mdx
+++ b/api_docs/kbn_content_management_content_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-content-editor
 title: "@kbn/content-management-content-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-content-editor plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-content-editor']
 ---
 import kbnContentManagementContentEditorObj from './kbn_content_management_content_editor.devdocs.json';
diff --git a/api_docs/kbn_content_management_tabbed_table_list_view.mdx b/api_docs/kbn_content_management_tabbed_table_list_view.mdx
index 57a5dc416bebd..75996f4483896 100644
--- a/api_docs/kbn_content_management_tabbed_table_list_view.mdx
+++ b/api_docs/kbn_content_management_tabbed_table_list_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-tabbed-table-list-view
 title: "@kbn/content-management-tabbed-table-list-view"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-tabbed-table-list-view plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-tabbed-table-list-view']
 ---
 import kbnContentManagementTabbedTableListViewObj from './kbn_content_management_tabbed_table_list_view.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list_view.mdx b/api_docs/kbn_content_management_table_list_view.mdx
index cc87df2d73112..66ac0d1614cc9 100644
--- a/api_docs/kbn_content_management_table_list_view.mdx
+++ b/api_docs/kbn_content_management_table_list_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list-view
 title: "@kbn/content-management-table-list-view"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list-view plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list-view']
 ---
 import kbnContentManagementTableListViewObj from './kbn_content_management_table_list_view.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list_view_table.mdx b/api_docs/kbn_content_management_table_list_view_table.mdx
index 62e3f75d20918..306267a6abada 100644
--- a/api_docs/kbn_content_management_table_list_view_table.mdx
+++ b/api_docs/kbn_content_management_table_list_view_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list-view-table
 title: "@kbn/content-management-table-list-view-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list-view-table plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list-view-table']
 ---
 import kbnContentManagementTableListViewTableObj from './kbn_content_management_table_list_view_table.devdocs.json';
diff --git a/api_docs/kbn_content_management_utils.mdx b/api_docs/kbn_content_management_utils.mdx
index c80de7f136a3d..11155b30e699f 100644
--- a/api_docs/kbn_content_management_utils.mdx
+++ b/api_docs/kbn_content_management_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-utils
 title: "@kbn/content-management-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-utils']
 ---
 import kbnContentManagementUtilsObj from './kbn_content_management_utils.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser.mdx b/api_docs/kbn_core_analytics_browser.mdx
index 5676843336ff6..91eb8b10f3a5a 100644
--- a/api_docs/kbn_core_analytics_browser.mdx
+++ b/api_docs/kbn_core_analytics_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser
 title: "@kbn/core-analytics-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser']
 ---
 import kbnCoreAnalyticsBrowserObj from './kbn_core_analytics_browser.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_internal.mdx b/api_docs/kbn_core_analytics_browser_internal.mdx
index 71514053b4419..df656ecd61406 100644
--- a/api_docs/kbn_core_analytics_browser_internal.mdx
+++ b/api_docs/kbn_core_analytics_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-internal
 title: "@kbn/core-analytics-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-internal']
 ---
 import kbnCoreAnalyticsBrowserInternalObj from './kbn_core_analytics_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_mocks.mdx b/api_docs/kbn_core_analytics_browser_mocks.mdx
index f373c880d7ea5..ec53ba8c11877 100644
--- a/api_docs/kbn_core_analytics_browser_mocks.mdx
+++ b/api_docs/kbn_core_analytics_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-mocks
 title: "@kbn/core-analytics-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-mocks']
 ---
 import kbnCoreAnalyticsBrowserMocksObj from './kbn_core_analytics_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server.mdx b/api_docs/kbn_core_analytics_server.mdx
index 56c92d4b375f0..41d955623cb24 100644
--- a/api_docs/kbn_core_analytics_server.mdx
+++ b/api_docs/kbn_core_analytics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server
 title: "@kbn/core-analytics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server']
 ---
 import kbnCoreAnalyticsServerObj from './kbn_core_analytics_server.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_internal.mdx b/api_docs/kbn_core_analytics_server_internal.mdx
index 590486afd0b1e..9d691f27ce8e1 100644
--- a/api_docs/kbn_core_analytics_server_internal.mdx
+++ b/api_docs/kbn_core_analytics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-internal
 title: "@kbn/core-analytics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-internal']
 ---
 import kbnCoreAnalyticsServerInternalObj from './kbn_core_analytics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_mocks.mdx b/api_docs/kbn_core_analytics_server_mocks.mdx
index 523eea43000ef..aac21b064dc5c 100644
--- a/api_docs/kbn_core_analytics_server_mocks.mdx
+++ b/api_docs/kbn_core_analytics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-mocks
 title: "@kbn/core-analytics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-mocks']
 ---
 import kbnCoreAnalyticsServerMocksObj from './kbn_core_analytics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser.mdx b/api_docs/kbn_core_application_browser.mdx
index b362faa3d4596..b7facaca6d8b2 100644
--- a/api_docs/kbn_core_application_browser.mdx
+++ b/api_docs/kbn_core_application_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser
 title: "@kbn/core-application-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser']
 ---
 import kbnCoreApplicationBrowserObj from './kbn_core_application_browser.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_internal.mdx b/api_docs/kbn_core_application_browser_internal.mdx
index cdb6efd28345d..a3465ade3a3d9 100644
--- a/api_docs/kbn_core_application_browser_internal.mdx
+++ b/api_docs/kbn_core_application_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-internal
 title: "@kbn/core-application-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-internal']
 ---
 import kbnCoreApplicationBrowserInternalObj from './kbn_core_application_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_mocks.mdx b/api_docs/kbn_core_application_browser_mocks.mdx
index c514789c3612d..8a552ba93fa44 100644
--- a/api_docs/kbn_core_application_browser_mocks.mdx
+++ b/api_docs/kbn_core_application_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-mocks
 title: "@kbn/core-application-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-mocks']
 ---
 import kbnCoreApplicationBrowserMocksObj from './kbn_core_application_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_common.mdx b/api_docs/kbn_core_application_common.mdx
index 8a3f93eaa59ec..3594a96e2f42b 100644
--- a/api_docs/kbn_core_application_common.mdx
+++ b/api_docs/kbn_core_application_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-common
 title: "@kbn/core-application-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-common']
 ---
 import kbnCoreApplicationCommonObj from './kbn_core_application_common.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_internal.mdx b/api_docs/kbn_core_apps_browser_internal.mdx
index 4813860f00f82..df550f5ea06ba 100644
--- a/api_docs/kbn_core_apps_browser_internal.mdx
+++ b/api_docs/kbn_core_apps_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-internal
 title: "@kbn/core-apps-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-internal']
 ---
 import kbnCoreAppsBrowserInternalObj from './kbn_core_apps_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_mocks.mdx b/api_docs/kbn_core_apps_browser_mocks.mdx
index c8f892aa52599..ec7aa6f619889 100644
--- a/api_docs/kbn_core_apps_browser_mocks.mdx
+++ b/api_docs/kbn_core_apps_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-mocks
 title: "@kbn/core-apps-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-mocks']
 ---
 import kbnCoreAppsBrowserMocksObj from './kbn_core_apps_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_apps_server_internal.mdx b/api_docs/kbn_core_apps_server_internal.mdx
index eca63186b2634..48474b6639288 100644
--- a/api_docs/kbn_core_apps_server_internal.mdx
+++ b/api_docs/kbn_core_apps_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-server-internal
 title: "@kbn/core-apps-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-server-internal']
 ---
 import kbnCoreAppsServerInternalObj from './kbn_core_apps_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_browser_mocks.mdx b/api_docs/kbn_core_base_browser_mocks.mdx
index d2a3372d95c3e..de80610f095b2 100644
--- a/api_docs/kbn_core_base_browser_mocks.mdx
+++ b/api_docs/kbn_core_base_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-browser-mocks
 title: "@kbn/core-base-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-browser-mocks']
 ---
 import kbnCoreBaseBrowserMocksObj from './kbn_core_base_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_base_common.mdx b/api_docs/kbn_core_base_common.mdx
index 9e816e4abe739..a2fb258b8ecf0 100644
--- a/api_docs/kbn_core_base_common.mdx
+++ b/api_docs/kbn_core_base_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-common
 title: "@kbn/core-base-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-common']
 ---
 import kbnCoreBaseCommonObj from './kbn_core_base_common.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_internal.mdx b/api_docs/kbn_core_base_server_internal.mdx
index 5ffa0c34f7260..1f1a4a10877c4 100644
--- a/api_docs/kbn_core_base_server_internal.mdx
+++ b/api_docs/kbn_core_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-internal
 title: "@kbn/core-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-internal']
 ---
 import kbnCoreBaseServerInternalObj from './kbn_core_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_mocks.mdx b/api_docs/kbn_core_base_server_mocks.mdx
index f4ffec00592b0..26574c1ac8b8e 100644
--- a/api_docs/kbn_core_base_server_mocks.mdx
+++ b/api_docs/kbn_core_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-mocks
 title: "@kbn/core-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-mocks']
 ---
 import kbnCoreBaseServerMocksObj from './kbn_core_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_browser_mocks.mdx b/api_docs/kbn_core_capabilities_browser_mocks.mdx
index 257222a9dda68..927f7277a4501 100644
--- a/api_docs/kbn_core_capabilities_browser_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-browser-mocks
 title: "@kbn/core-capabilities-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-browser-mocks']
 ---
 import kbnCoreCapabilitiesBrowserMocksObj from './kbn_core_capabilities_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_common.mdx b/api_docs/kbn_core_capabilities_common.mdx
index 436d38caefead..55909f038034f 100644
--- a/api_docs/kbn_core_capabilities_common.mdx
+++ b/api_docs/kbn_core_capabilities_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-common
 title: "@kbn/core-capabilities-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-common']
 ---
 import kbnCoreCapabilitiesCommonObj from './kbn_core_capabilities_common.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server.mdx b/api_docs/kbn_core_capabilities_server.mdx
index 211bbdbc8039b..7c95419ad4f7a 100644
--- a/api_docs/kbn_core_capabilities_server.mdx
+++ b/api_docs/kbn_core_capabilities_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server
 title: "@kbn/core-capabilities-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server']
 ---
 import kbnCoreCapabilitiesServerObj from './kbn_core_capabilities_server.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server_mocks.mdx b/api_docs/kbn_core_capabilities_server_mocks.mdx
index adbe60b8d8e71..1d5474cc18045 100644
--- a/api_docs/kbn_core_capabilities_server_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server-mocks
 title: "@kbn/core-capabilities-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server-mocks']
 ---
 import kbnCoreCapabilitiesServerMocksObj from './kbn_core_capabilities_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser.mdx b/api_docs/kbn_core_chrome_browser.mdx
index 3ba5de16dc314..20859d4f6d1da 100644
--- a/api_docs/kbn_core_chrome_browser.mdx
+++ b/api_docs/kbn_core_chrome_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser
 title: "@kbn/core-chrome-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser']
 ---
 import kbnCoreChromeBrowserObj from './kbn_core_chrome_browser.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser_mocks.mdx b/api_docs/kbn_core_chrome_browser_mocks.mdx
index a9e4d04eb2c8b..b1cfb51c5948d 100644
--- a/api_docs/kbn_core_chrome_browser_mocks.mdx
+++ b/api_docs/kbn_core_chrome_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser-mocks
 title: "@kbn/core-chrome-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser-mocks']
 ---
 import kbnCoreChromeBrowserMocksObj from './kbn_core_chrome_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_config_server_internal.mdx b/api_docs/kbn_core_config_server_internal.mdx
index cf9affc14ad04..673f164bbff2f 100644
--- a/api_docs/kbn_core_config_server_internal.mdx
+++ b/api_docs/kbn_core_config_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-config-server-internal
 title: "@kbn/core-config-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-config-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-config-server-internal']
 ---
 import kbnCoreConfigServerInternalObj from './kbn_core_config_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser.mdx b/api_docs/kbn_core_custom_branding_browser.mdx
index f26b7a1c36060..239207b3fe74c 100644
--- a/api_docs/kbn_core_custom_branding_browser.mdx
+++ b/api_docs/kbn_core_custom_branding_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser
 title: "@kbn/core-custom-branding-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser']
 ---
 import kbnCoreCustomBrandingBrowserObj from './kbn_core_custom_branding_browser.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_internal.mdx b/api_docs/kbn_core_custom_branding_browser_internal.mdx
index 76964b6badf6a..55d77a39b57c6 100644
--- a/api_docs/kbn_core_custom_branding_browser_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-internal
 title: "@kbn/core-custom-branding-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-internal']
 ---
 import kbnCoreCustomBrandingBrowserInternalObj from './kbn_core_custom_branding_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_mocks.mdx b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
index 2a6f36235af7b..7440d94a14bf4 100644
--- a/api_docs/kbn_core_custom_branding_browser_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-mocks
 title: "@kbn/core-custom-branding-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-mocks']
 ---
 import kbnCoreCustomBrandingBrowserMocksObj from './kbn_core_custom_branding_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_common.mdx b/api_docs/kbn_core_custom_branding_common.mdx
index e24461f250ad1..fb56e91e952a7 100644
--- a/api_docs/kbn_core_custom_branding_common.mdx
+++ b/api_docs/kbn_core_custom_branding_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-common
 title: "@kbn/core-custom-branding-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-common']
 ---
 import kbnCoreCustomBrandingCommonObj from './kbn_core_custom_branding_common.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server.mdx b/api_docs/kbn_core_custom_branding_server.mdx
index baca4ef57edf6..ed28c0d11a862 100644
--- a/api_docs/kbn_core_custom_branding_server.mdx
+++ b/api_docs/kbn_core_custom_branding_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server
 title: "@kbn/core-custom-branding-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server']
 ---
 import kbnCoreCustomBrandingServerObj from './kbn_core_custom_branding_server.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_internal.mdx b/api_docs/kbn_core_custom_branding_server_internal.mdx
index ce67d8ade4042..b6e209392f286 100644
--- a/api_docs/kbn_core_custom_branding_server_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-internal
 title: "@kbn/core-custom-branding-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-internal']
 ---
 import kbnCoreCustomBrandingServerInternalObj from './kbn_core_custom_branding_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_mocks.mdx b/api_docs/kbn_core_custom_branding_server_mocks.mdx
index 8b9bb43e8b419..f9b96fa733557 100644
--- a/api_docs/kbn_core_custom_branding_server_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-mocks
 title: "@kbn/core-custom-branding-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-mocks']
 ---
 import kbnCoreCustomBrandingServerMocksObj from './kbn_core_custom_branding_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser.mdx b/api_docs/kbn_core_deprecations_browser.mdx
index 6e36721e6a741..1caa989923609 100644
--- a/api_docs/kbn_core_deprecations_browser.mdx
+++ b/api_docs/kbn_core_deprecations_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser
 title: "@kbn/core-deprecations-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser']
 ---
 import kbnCoreDeprecationsBrowserObj from './kbn_core_deprecations_browser.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_internal.mdx b/api_docs/kbn_core_deprecations_browser_internal.mdx
index 03b2a4c824ab3..657907431835f 100644
--- a/api_docs/kbn_core_deprecations_browser_internal.mdx
+++ b/api_docs/kbn_core_deprecations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-internal
 title: "@kbn/core-deprecations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-internal']
 ---
 import kbnCoreDeprecationsBrowserInternalObj from './kbn_core_deprecations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_mocks.mdx b/api_docs/kbn_core_deprecations_browser_mocks.mdx
index 52d72fd33b80e..0e01f49afc728 100644
--- a/api_docs/kbn_core_deprecations_browser_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-mocks
 title: "@kbn/core-deprecations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-mocks']
 ---
 import kbnCoreDeprecationsBrowserMocksObj from './kbn_core_deprecations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_common.mdx b/api_docs/kbn_core_deprecations_common.mdx
index ff79fc108cfc8..40319fb3b9d71 100644
--- a/api_docs/kbn_core_deprecations_common.mdx
+++ b/api_docs/kbn_core_deprecations_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-common
 title: "@kbn/core-deprecations-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-common']
 ---
 import kbnCoreDeprecationsCommonObj from './kbn_core_deprecations_common.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server.mdx b/api_docs/kbn_core_deprecations_server.mdx
index 63bd4fa4a0b86..c972253a1d766 100644
--- a/api_docs/kbn_core_deprecations_server.mdx
+++ b/api_docs/kbn_core_deprecations_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server
 title: "@kbn/core-deprecations-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server']
 ---
 import kbnCoreDeprecationsServerObj from './kbn_core_deprecations_server.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_internal.mdx b/api_docs/kbn_core_deprecations_server_internal.mdx
index b03523b67392f..836e2029f733f 100644
--- a/api_docs/kbn_core_deprecations_server_internal.mdx
+++ b/api_docs/kbn_core_deprecations_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-internal
 title: "@kbn/core-deprecations-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-internal']
 ---
 import kbnCoreDeprecationsServerInternalObj from './kbn_core_deprecations_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_mocks.mdx b/api_docs/kbn_core_deprecations_server_mocks.mdx
index ef26be8adf191..850e80b04028d 100644
--- a/api_docs/kbn_core_deprecations_server_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-mocks
 title: "@kbn/core-deprecations-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-mocks']
 ---
 import kbnCoreDeprecationsServerMocksObj from './kbn_core_deprecations_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser.mdx b/api_docs/kbn_core_doc_links_browser.mdx
index 79d8624097c8d..ffdd0b653c5c3 100644
--- a/api_docs/kbn_core_doc_links_browser.mdx
+++ b/api_docs/kbn_core_doc_links_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser
 title: "@kbn/core-doc-links-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser']
 ---
 import kbnCoreDocLinksBrowserObj from './kbn_core_doc_links_browser.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser_mocks.mdx b/api_docs/kbn_core_doc_links_browser_mocks.mdx
index f1574aa817481..457f1744e4a46 100644
--- a/api_docs/kbn_core_doc_links_browser_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser-mocks
 title: "@kbn/core-doc-links-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser-mocks']
 ---
 import kbnCoreDocLinksBrowserMocksObj from './kbn_core_doc_links_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server.mdx b/api_docs/kbn_core_doc_links_server.mdx
index 31078d04b6cb0..cd8ddb2c7fd9e 100644
--- a/api_docs/kbn_core_doc_links_server.mdx
+++ b/api_docs/kbn_core_doc_links_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server
 title: "@kbn/core-doc-links-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server']
 ---
 import kbnCoreDocLinksServerObj from './kbn_core_doc_links_server.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server_mocks.mdx b/api_docs/kbn_core_doc_links_server_mocks.mdx
index 11b17a2f10728..c89874205e4da 100644
--- a/api_docs/kbn_core_doc_links_server_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server-mocks
 title: "@kbn/core-doc-links-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server-mocks']
 ---
 import kbnCoreDocLinksServerMocksObj from './kbn_core_doc_links_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
index b95bf2a78edb5..640e917ab94f0 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-internal
 title: "@kbn/core-elasticsearch-client-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-internal']
 ---
 import kbnCoreElasticsearchClientServerInternalObj from './kbn_core_elasticsearch_client_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
index 18aa165132769..7ebf74b577c8f 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-mocks
 title: "@kbn/core-elasticsearch-client-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-mocks']
 ---
 import kbnCoreElasticsearchClientServerMocksObj from './kbn_core_elasticsearch_client_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server.mdx b/api_docs/kbn_core_elasticsearch_server.mdx
index 7b4d0093c0a16..662163b17bd61 100644
--- a/api_docs/kbn_core_elasticsearch_server.mdx
+++ b/api_docs/kbn_core_elasticsearch_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server
 title: "@kbn/core-elasticsearch-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server']
 ---
 import kbnCoreElasticsearchServerObj from './kbn_core_elasticsearch_server.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_internal.mdx b/api_docs/kbn_core_elasticsearch_server_internal.mdx
index 73b8ac4a3686d..a586e467e5866 100644
--- a/api_docs/kbn_core_elasticsearch_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-internal
 title: "@kbn/core-elasticsearch-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-internal']
 ---
 import kbnCoreElasticsearchServerInternalObj from './kbn_core_elasticsearch_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
index 5c2cff8503113..46e6055acad82 100644
--- a/api_docs/kbn_core_elasticsearch_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-mocks
 title: "@kbn/core-elasticsearch-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-mocks']
 ---
 import kbnCoreElasticsearchServerMocksObj from './kbn_core_elasticsearch_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_internal.mdx b/api_docs/kbn_core_environment_server_internal.mdx
index 1cbdf72a18e5d..f8a4673f8ac76 100644
--- a/api_docs/kbn_core_environment_server_internal.mdx
+++ b/api_docs/kbn_core_environment_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-internal
 title: "@kbn/core-environment-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-internal']
 ---
 import kbnCoreEnvironmentServerInternalObj from './kbn_core_environment_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_mocks.mdx b/api_docs/kbn_core_environment_server_mocks.mdx
index 6e0d9e9b46d19..11c8d6a399862 100644
--- a/api_docs/kbn_core_environment_server_mocks.mdx
+++ b/api_docs/kbn_core_environment_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-mocks
 title: "@kbn/core-environment-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-mocks']
 ---
 import kbnCoreEnvironmentServerMocksObj from './kbn_core_environment_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser.mdx b/api_docs/kbn_core_execution_context_browser.mdx
index bc1f09b82e11b..6704ea91656ec 100644
--- a/api_docs/kbn_core_execution_context_browser.mdx
+++ b/api_docs/kbn_core_execution_context_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser
 title: "@kbn/core-execution-context-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser']
 ---
 import kbnCoreExecutionContextBrowserObj from './kbn_core_execution_context_browser.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_internal.mdx b/api_docs/kbn_core_execution_context_browser_internal.mdx
index 879d622e5b6fa..5f890c4d06972 100644
--- a/api_docs/kbn_core_execution_context_browser_internal.mdx
+++ b/api_docs/kbn_core_execution_context_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-internal
 title: "@kbn/core-execution-context-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-internal']
 ---
 import kbnCoreExecutionContextBrowserInternalObj from './kbn_core_execution_context_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_mocks.mdx b/api_docs/kbn_core_execution_context_browser_mocks.mdx
index a842e3ea69246..ec04f75c8aba8 100644
--- a/api_docs/kbn_core_execution_context_browser_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-mocks
 title: "@kbn/core-execution-context-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-mocks']
 ---
 import kbnCoreExecutionContextBrowserMocksObj from './kbn_core_execution_context_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_common.mdx b/api_docs/kbn_core_execution_context_common.mdx
index 88e0567d1d09d..8b99f3c87ece3 100644
--- a/api_docs/kbn_core_execution_context_common.mdx
+++ b/api_docs/kbn_core_execution_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-common
 title: "@kbn/core-execution-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-common']
 ---
 import kbnCoreExecutionContextCommonObj from './kbn_core_execution_context_common.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server.mdx b/api_docs/kbn_core_execution_context_server.mdx
index 26c773de8c2d3..ae8a69fab1d8c 100644
--- a/api_docs/kbn_core_execution_context_server.mdx
+++ b/api_docs/kbn_core_execution_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server
 title: "@kbn/core-execution-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server']
 ---
 import kbnCoreExecutionContextServerObj from './kbn_core_execution_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_internal.mdx b/api_docs/kbn_core_execution_context_server_internal.mdx
index b7f505748ec07..c14187750d19b 100644
--- a/api_docs/kbn_core_execution_context_server_internal.mdx
+++ b/api_docs/kbn_core_execution_context_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-internal
 title: "@kbn/core-execution-context-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-internal']
 ---
 import kbnCoreExecutionContextServerInternalObj from './kbn_core_execution_context_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_mocks.mdx b/api_docs/kbn_core_execution_context_server_mocks.mdx
index 0183854b9ac49..af850f7922072 100644
--- a/api_docs/kbn_core_execution_context_server_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-mocks
 title: "@kbn/core-execution-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-mocks']
 ---
 import kbnCoreExecutionContextServerMocksObj from './kbn_core_execution_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser.mdx b/api_docs/kbn_core_fatal_errors_browser.mdx
index aa9569680a561..cf518d1280327 100644
--- a/api_docs/kbn_core_fatal_errors_browser.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser
 title: "@kbn/core-fatal-errors-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser']
 ---
 import kbnCoreFatalErrorsBrowserObj from './kbn_core_fatal_errors_browser.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
index c12a97bcd3a13..20ac5ecbe9679 100644
--- a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser-mocks
 title: "@kbn/core-fatal-errors-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser-mocks']
 ---
 import kbnCoreFatalErrorsBrowserMocksObj from './kbn_core_fatal_errors_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser.mdx b/api_docs/kbn_core_http_browser.mdx
index 891801aee23b4..a0ce404c4c0fe 100644
--- a/api_docs/kbn_core_http_browser.mdx
+++ b/api_docs/kbn_core_http_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser
 title: "@kbn/core-http-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser']
 ---
 import kbnCoreHttpBrowserObj from './kbn_core_http_browser.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_internal.mdx b/api_docs/kbn_core_http_browser_internal.mdx
index 6aa0f2e5d54cd..4e5a04a6045d5 100644
--- a/api_docs/kbn_core_http_browser_internal.mdx
+++ b/api_docs/kbn_core_http_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-internal
 title: "@kbn/core-http-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-internal']
 ---
 import kbnCoreHttpBrowserInternalObj from './kbn_core_http_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_mocks.mdx b/api_docs/kbn_core_http_browser_mocks.mdx
index 0734c13b6f495..1f6fe906524af 100644
--- a/api_docs/kbn_core_http_browser_mocks.mdx
+++ b/api_docs/kbn_core_http_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-mocks
 title: "@kbn/core-http-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-mocks']
 ---
 import kbnCoreHttpBrowserMocksObj from './kbn_core_http_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_common.mdx b/api_docs/kbn_core_http_common.mdx
index 47e399d99f048..080ad66e8f2e6 100644
--- a/api_docs/kbn_core_http_common.mdx
+++ b/api_docs/kbn_core_http_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-common
 title: "@kbn/core-http-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-common']
 ---
 import kbnCoreHttpCommonObj from './kbn_core_http_common.devdocs.json';
diff --git a/api_docs/kbn_core_http_context_server_mocks.mdx b/api_docs/kbn_core_http_context_server_mocks.mdx
index d2e55a61a6cb3..515e4eb650c33 100644
--- a/api_docs/kbn_core_http_context_server_mocks.mdx
+++ b/api_docs/kbn_core_http_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-context-server-mocks
 title: "@kbn/core-http-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-context-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-context-server-mocks']
 ---
 import kbnCoreHttpContextServerMocksObj from './kbn_core_http_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_request_handler_context_server.mdx b/api_docs/kbn_core_http_request_handler_context_server.mdx
index e4fad9d599773..b2bdfb6764663 100644
--- a/api_docs/kbn_core_http_request_handler_context_server.mdx
+++ b/api_docs/kbn_core_http_request_handler_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-request-handler-context-server
 title: "@kbn/core-http-request-handler-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-request-handler-context-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-request-handler-context-server']
 ---
 import kbnCoreHttpRequestHandlerContextServerObj from './kbn_core_http_request_handler_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server.mdx b/api_docs/kbn_core_http_resources_server.mdx
index 2d401393b92b7..11b9583f114d5 100644
--- a/api_docs/kbn_core_http_resources_server.mdx
+++ b/api_docs/kbn_core_http_resources_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server
 title: "@kbn/core-http-resources-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server']
 ---
 import kbnCoreHttpResourcesServerObj from './kbn_core_http_resources_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_internal.mdx b/api_docs/kbn_core_http_resources_server_internal.mdx
index 66f6027212e58..f5ad6a24e986e 100644
--- a/api_docs/kbn_core_http_resources_server_internal.mdx
+++ b/api_docs/kbn_core_http_resources_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-internal
 title: "@kbn/core-http-resources-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-internal']
 ---
 import kbnCoreHttpResourcesServerInternalObj from './kbn_core_http_resources_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_mocks.mdx b/api_docs/kbn_core_http_resources_server_mocks.mdx
index 9712e2de2b2f1..e34c12e8adf7b 100644
--- a/api_docs/kbn_core_http_resources_server_mocks.mdx
+++ b/api_docs/kbn_core_http_resources_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-mocks
 title: "@kbn/core-http-resources-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-mocks']
 ---
 import kbnCoreHttpResourcesServerMocksObj from './kbn_core_http_resources_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_internal.mdx b/api_docs/kbn_core_http_router_server_internal.mdx
index 8f84f1d22417b..6a8ae9925b1bd 100644
--- a/api_docs/kbn_core_http_router_server_internal.mdx
+++ b/api_docs/kbn_core_http_router_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-internal
 title: "@kbn/core-http-router-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-internal']
 ---
 import kbnCoreHttpRouterServerInternalObj from './kbn_core_http_router_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_mocks.mdx b/api_docs/kbn_core_http_router_server_mocks.mdx
index 70a77351b3ab2..30258151919d7 100644
--- a/api_docs/kbn_core_http_router_server_mocks.mdx
+++ b/api_docs/kbn_core_http_router_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-mocks
 title: "@kbn/core-http-router-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-mocks']
 ---
 import kbnCoreHttpRouterServerMocksObj from './kbn_core_http_router_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_server.devdocs.json b/api_docs/kbn_core_http_server.devdocs.json
index d88d8a1fd7250..abeeee5830cd5 100644
--- a/api_docs/kbn_core_http_server.devdocs.json
+++ b/api_docs/kbn_core_http_server.devdocs.json
@@ -3815,18 +3815,6 @@
                 "plugin": "crossClusterReplication",
                 "path": "x-pack/plugins/cross_cluster_replication/server/routes/api/cross_cluster_replication/register_stats_route.ts"
               },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts"
-              },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts"
-              },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts"
-              },
               {
                 "plugin": "elasticAssistant",
                 "path": "x-pack/plugins/elastic_assistant/server/routes/knowledge_base/get_knowledge_base_status.ts"
@@ -4859,10 +4847,6 @@
                 "plugin": "alerting",
                 "path": "x-pack/plugins/alerting/server/routes/rule_types.test.ts"
               },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
-              },
               {
                 "plugin": "elasticAssistant",
                 "path": "x-pack/plugins/elastic_assistant/server/__mocks__/server.ts"
@@ -6269,10 +6253,6 @@
                 "plugin": "crossClusterReplication",
                 "path": "x-pack/plugins/cross_cluster_replication/server/routes/api/follower_index/register_create_route.ts"
               },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts"
-              },
               {
                 "plugin": "elasticAssistant",
                 "path": "x-pack/plugins/elastic_assistant/server/routes/post_actions_connector_execute.ts"
@@ -7173,10 +7153,6 @@
                 "plugin": "alerting",
                 "path": "x-pack/plugins/alerting/server/routes/update_rule_api_key.test.ts"
               },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
-              },
               {
                 "plugin": "elasticAssistant",
                 "path": "x-pack/plugins/elastic_assistant/server/__mocks__/server.ts"
@@ -8279,10 +8255,6 @@
                 "plugin": "alerting",
                 "path": "x-pack/plugins/alerting/server/routes/update_rule.test.ts"
               },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
-              },
               {
                 "plugin": "elasticAssistant",
                 "path": "x-pack/plugins/elastic_assistant/server/__mocks__/server.ts"
@@ -8629,10 +8601,6 @@
                 "plugin": "alerting",
                 "path": "x-pack/plugins/alerting/server/routes/bulk_enable_rules.test.ts"
               },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
-              },
               {
                 "plugin": "elasticAssistant",
                 "path": "x-pack/plugins/elastic_assistant/server/__mocks__/server.ts"
@@ -9191,10 +9159,6 @@
                 "plugin": "alerting",
                 "path": "x-pack/plugins/alerting/server/routes/delete_rule.test.ts"
               },
-              {
-                "plugin": "ecsDataQualityDashboard",
-                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
-              },
               {
                 "plugin": "elasticAssistant",
                 "path": "x-pack/plugins/elastic_assistant/server/__mocks__/server.ts"
@@ -13229,6 +13193,18 @@
                 "plugin": "cloudSecurityPosture",
                 "path": "x-pack/plugins/cloud_security_posture/server/routes/detection_engine/get_detection_engine_alerts_count_by_rule_tags.ts"
               },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts"
+              },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts"
+              },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts"
+              },
               {
                 "plugin": "logsShared",
                 "path": "x-pack/plugins/logs_shared/server/lib/adapters/framework/kibana_framework_adapter.ts"
@@ -13653,6 +13629,10 @@
                 "plugin": "@kbn/core-http-router-server-internal",
                 "path": "packages/core/http/core-http-router-server-internal/src/versioned_router/core_versioned_router.test.ts"
               },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
+              },
               {
                 "plugin": "canvas",
                 "path": "x-pack/plugins/canvas/server/routes/custom_elements/find.test.ts"
@@ -13957,6 +13937,10 @@
                 "plugin": "@kbn/core-http-router-server-internal",
                 "path": "packages/core/http/core-http-router-server-internal/src/versioned_router/core_versioned_router.ts"
               },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
+              },
               {
                 "plugin": "canvas",
                 "path": "x-pack/plugins/canvas/server/routes/custom_elements/update.test.ts"
@@ -14469,6 +14453,10 @@
                 "plugin": "canvas",
                 "path": "x-pack/plugins/canvas/server/routes/workpad/import.ts"
               },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts"
+              },
               {
                 "plugin": "logsShared",
                 "path": "x-pack/plugins/logs_shared/server/lib/adapters/framework/kibana_framework_adapter.ts"
@@ -14861,6 +14849,10 @@
                 "plugin": "@kbn/core-http-router-server-internal",
                 "path": "packages/core/http/core-http-router-server-internal/src/versioned_router/core_versioned_router.test.ts"
               },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
+              },
               {
                 "plugin": "canvas",
                 "path": "x-pack/plugins/canvas/server/routes/custom_elements/create.test.ts"
@@ -14992,6 +14984,10 @@
               {
                 "plugin": "@kbn/core-http-router-server-internal",
                 "path": "packages/core/http/core-http-router-server-internal/src/versioned_router/core_versioned_router.ts"
+              },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
               }
             ],
             "returnComment": [],
@@ -15217,6 +15213,10 @@
                 "plugin": "@kbn/core-http-router-server-internal",
                 "path": "packages/core/http/core-http-router-server-internal/src/versioned_router/core_versioned_router.test.ts"
               },
+              {
+                "plugin": "ecsDataQualityDashboard",
+                "path": "x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts"
+              },
               {
                 "plugin": "canvas",
                 "path": "x-pack/plugins/canvas/server/routes/custom_elements/delete.test.ts"
diff --git a/api_docs/kbn_core_http_server.mdx b/api_docs/kbn_core_http_server.mdx
index 784d53314f9ae..a11f782478db8 100644
--- a/api_docs/kbn_core_http_server.mdx
+++ b/api_docs/kbn_core_http_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server
 title: "@kbn/core-http-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server']
 ---
 import kbnCoreHttpServerObj from './kbn_core_http_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_internal.mdx b/api_docs/kbn_core_http_server_internal.mdx
index c779d59a4f22f..e5cec103da6f0 100644
--- a/api_docs/kbn_core_http_server_internal.mdx
+++ b/api_docs/kbn_core_http_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-internal
 title: "@kbn/core-http-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-internal']
 ---
 import kbnCoreHttpServerInternalObj from './kbn_core_http_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_mocks.mdx b/api_docs/kbn_core_http_server_mocks.mdx
index 08946f1a35c9e..1bf6538f0cbc5 100644
--- a/api_docs/kbn_core_http_server_mocks.mdx
+++ b/api_docs/kbn_core_http_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-mocks
 title: "@kbn/core-http-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-mocks']
 ---
 import kbnCoreHttpServerMocksObj from './kbn_core_http_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser.mdx b/api_docs/kbn_core_i18n_browser.mdx
index c319f22f8188b..350905f033738 100644
--- a/api_docs/kbn_core_i18n_browser.mdx
+++ b/api_docs/kbn_core_i18n_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser
 title: "@kbn/core-i18n-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser']
 ---
 import kbnCoreI18nBrowserObj from './kbn_core_i18n_browser.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser_mocks.mdx b/api_docs/kbn_core_i18n_browser_mocks.mdx
index e80328a76f354..402bb38aa2738 100644
--- a/api_docs/kbn_core_i18n_browser_mocks.mdx
+++ b/api_docs/kbn_core_i18n_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser-mocks
 title: "@kbn/core-i18n-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser-mocks']
 ---
 import kbnCoreI18nBrowserMocksObj from './kbn_core_i18n_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server.mdx b/api_docs/kbn_core_i18n_server.mdx
index cc0f4898db7d0..4584c70c43048 100644
--- a/api_docs/kbn_core_i18n_server.mdx
+++ b/api_docs/kbn_core_i18n_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server
 title: "@kbn/core-i18n-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server']
 ---
 import kbnCoreI18nServerObj from './kbn_core_i18n_server.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_internal.mdx b/api_docs/kbn_core_i18n_server_internal.mdx
index d3f000f64098f..701c1ec779aca 100644
--- a/api_docs/kbn_core_i18n_server_internal.mdx
+++ b/api_docs/kbn_core_i18n_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-internal
 title: "@kbn/core-i18n-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-internal']
 ---
 import kbnCoreI18nServerInternalObj from './kbn_core_i18n_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_mocks.mdx b/api_docs/kbn_core_i18n_server_mocks.mdx
index e0ef09c6faec5..298c7da21ab88 100644
--- a/api_docs/kbn_core_i18n_server_mocks.mdx
+++ b/api_docs/kbn_core_i18n_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-mocks
 title: "@kbn/core-i18n-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-mocks']
 ---
 import kbnCoreI18nServerMocksObj from './kbn_core_i18n_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
index a7417dca1aaa1..ce20518fc04db 100644
--- a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
+++ b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-injected-metadata-browser-mocks
 title: "@kbn/core-injected-metadata-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-injected-metadata-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-injected-metadata-browser-mocks']
 ---
 import kbnCoreInjectedMetadataBrowserMocksObj from './kbn_core_injected_metadata_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_internal.mdx b/api_docs/kbn_core_integrations_browser_internal.mdx
index 3e478d6f4b53b..464b6469b51f4 100644
--- a/api_docs/kbn_core_integrations_browser_internal.mdx
+++ b/api_docs/kbn_core_integrations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-internal
 title: "@kbn/core-integrations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-internal']
 ---
 import kbnCoreIntegrationsBrowserInternalObj from './kbn_core_integrations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_mocks.mdx b/api_docs/kbn_core_integrations_browser_mocks.mdx
index bf7fd3ad46436..38b4884d99558 100644
--- a/api_docs/kbn_core_integrations_browser_mocks.mdx
+++ b/api_docs/kbn_core_integrations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-mocks
 title: "@kbn/core-integrations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-mocks']
 ---
 import kbnCoreIntegrationsBrowserMocksObj from './kbn_core_integrations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser.mdx b/api_docs/kbn_core_lifecycle_browser.mdx
index 618b28c43e99c..ad8f8724d8055 100644
--- a/api_docs/kbn_core_lifecycle_browser.mdx
+++ b/api_docs/kbn_core_lifecycle_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser
 title: "@kbn/core-lifecycle-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser']
 ---
 import kbnCoreLifecycleBrowserObj from './kbn_core_lifecycle_browser.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser_mocks.mdx b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
index 2bd868e8f8311..6574f66ea8f1d 100644
--- a/api_docs/kbn_core_lifecycle_browser_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser-mocks
 title: "@kbn/core-lifecycle-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser-mocks']
 ---
 import kbnCoreLifecycleBrowserMocksObj from './kbn_core_lifecycle_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server.mdx b/api_docs/kbn_core_lifecycle_server.mdx
index 92639f54ab8f3..e93d8bf80d46b 100644
--- a/api_docs/kbn_core_lifecycle_server.mdx
+++ b/api_docs/kbn_core_lifecycle_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server
 title: "@kbn/core-lifecycle-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server']
 ---
 import kbnCoreLifecycleServerObj from './kbn_core_lifecycle_server.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server_mocks.mdx b/api_docs/kbn_core_lifecycle_server_mocks.mdx
index 32101dc9c54aa..c3625e2986d56 100644
--- a/api_docs/kbn_core_lifecycle_server_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server-mocks
 title: "@kbn/core-lifecycle-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server-mocks']
 ---
 import kbnCoreLifecycleServerMocksObj from './kbn_core_lifecycle_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_browser_mocks.mdx b/api_docs/kbn_core_logging_browser_mocks.mdx
index dfb374ec51d07..1a78a8509f0b6 100644
--- a/api_docs/kbn_core_logging_browser_mocks.mdx
+++ b/api_docs/kbn_core_logging_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-browser-mocks
 title: "@kbn/core-logging-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-browser-mocks']
 ---
 import kbnCoreLoggingBrowserMocksObj from './kbn_core_logging_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_common_internal.mdx b/api_docs/kbn_core_logging_common_internal.mdx
index 210e8423bb0e6..814375ab0295b 100644
--- a/api_docs/kbn_core_logging_common_internal.mdx
+++ b/api_docs/kbn_core_logging_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-common-internal
 title: "@kbn/core-logging-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-common-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-common-internal']
 ---
 import kbnCoreLoggingCommonInternalObj from './kbn_core_logging_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server.mdx b/api_docs/kbn_core_logging_server.mdx
index 03cf1bb25a339..2ae4ab4762006 100644
--- a/api_docs/kbn_core_logging_server.mdx
+++ b/api_docs/kbn_core_logging_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server
 title: "@kbn/core-logging-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server']
 ---
 import kbnCoreLoggingServerObj from './kbn_core_logging_server.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_internal.mdx b/api_docs/kbn_core_logging_server_internal.mdx
index aee479ea68758..256f03d508c00 100644
--- a/api_docs/kbn_core_logging_server_internal.mdx
+++ b/api_docs/kbn_core_logging_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-internal
 title: "@kbn/core-logging-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-internal']
 ---
 import kbnCoreLoggingServerInternalObj from './kbn_core_logging_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_mocks.mdx b/api_docs/kbn_core_logging_server_mocks.mdx
index ff6c63e72cb04..0c5c6ea1c2013 100644
--- a/api_docs/kbn_core_logging_server_mocks.mdx
+++ b/api_docs/kbn_core_logging_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-mocks
 title: "@kbn/core-logging-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-mocks']
 ---
 import kbnCoreLoggingServerMocksObj from './kbn_core_logging_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_internal.mdx b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
index de421df3dd8a7..3c32d8654cda8 100644
--- a/api_docs/kbn_core_metrics_collectors_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-internal
 title: "@kbn/core-metrics-collectors-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-internal']
 ---
 import kbnCoreMetricsCollectorsServerInternalObj from './kbn_core_metrics_collectors_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
index 60a4a04ea56b0..42064e79efd02 100644
--- a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-mocks
 title: "@kbn/core-metrics-collectors-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-mocks']
 ---
 import kbnCoreMetricsCollectorsServerMocksObj from './kbn_core_metrics_collectors_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server.mdx b/api_docs/kbn_core_metrics_server.mdx
index b0a0207307e9a..0406b0483d4e5 100644
--- a/api_docs/kbn_core_metrics_server.mdx
+++ b/api_docs/kbn_core_metrics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server
 title: "@kbn/core-metrics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server']
 ---
 import kbnCoreMetricsServerObj from './kbn_core_metrics_server.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_internal.mdx b/api_docs/kbn_core_metrics_server_internal.mdx
index 8ac0e295d3010..ff772adc17989 100644
--- a/api_docs/kbn_core_metrics_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-internal
 title: "@kbn/core-metrics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-internal']
 ---
 import kbnCoreMetricsServerInternalObj from './kbn_core_metrics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_mocks.mdx b/api_docs/kbn_core_metrics_server_mocks.mdx
index 1af25d7acbd1f..b661f7823b10e 100644
--- a/api_docs/kbn_core_metrics_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-mocks
 title: "@kbn/core-metrics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-mocks']
 ---
 import kbnCoreMetricsServerMocksObj from './kbn_core_metrics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_mount_utils_browser.mdx b/api_docs/kbn_core_mount_utils_browser.mdx
index 98ae0b69dd6ce..6a966c5cc8446 100644
--- a/api_docs/kbn_core_mount_utils_browser.mdx
+++ b/api_docs/kbn_core_mount_utils_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-mount-utils-browser
 title: "@kbn/core-mount-utils-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-mount-utils-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-mount-utils-browser']
 ---
 import kbnCoreMountUtilsBrowserObj from './kbn_core_mount_utils_browser.devdocs.json';
diff --git a/api_docs/kbn_core_node_server.mdx b/api_docs/kbn_core_node_server.mdx
index ed033f477fc7d..51eeb32031b98 100644
--- a/api_docs/kbn_core_node_server.mdx
+++ b/api_docs/kbn_core_node_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server
 title: "@kbn/core-node-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server']
 ---
 import kbnCoreNodeServerObj from './kbn_core_node_server.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_internal.mdx b/api_docs/kbn_core_node_server_internal.mdx
index 9d5ad1f479b10..975cc027213f3 100644
--- a/api_docs/kbn_core_node_server_internal.mdx
+++ b/api_docs/kbn_core_node_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-internal
 title: "@kbn/core-node-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-internal']
 ---
 import kbnCoreNodeServerInternalObj from './kbn_core_node_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_mocks.mdx b/api_docs/kbn_core_node_server_mocks.mdx
index bd67e074c8327..151f94dcb9e69 100644
--- a/api_docs/kbn_core_node_server_mocks.mdx
+++ b/api_docs/kbn_core_node_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-mocks
 title: "@kbn/core-node-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-mocks']
 ---
 import kbnCoreNodeServerMocksObj from './kbn_core_node_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser.mdx b/api_docs/kbn_core_notifications_browser.mdx
index 15d358cfc2952..319d87c359ee5 100644
--- a/api_docs/kbn_core_notifications_browser.mdx
+++ b/api_docs/kbn_core_notifications_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser
 title: "@kbn/core-notifications-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser']
 ---
 import kbnCoreNotificationsBrowserObj from './kbn_core_notifications_browser.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_internal.mdx b/api_docs/kbn_core_notifications_browser_internal.mdx
index e6fe2e8ecb17d..540b22a0c93bd 100644
--- a/api_docs/kbn_core_notifications_browser_internal.mdx
+++ b/api_docs/kbn_core_notifications_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-internal
 title: "@kbn/core-notifications-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-internal']
 ---
 import kbnCoreNotificationsBrowserInternalObj from './kbn_core_notifications_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_mocks.mdx b/api_docs/kbn_core_notifications_browser_mocks.mdx
index 2f7ec4415c6c7..ae67e8b45e10e 100644
--- a/api_docs/kbn_core_notifications_browser_mocks.mdx
+++ b/api_docs/kbn_core_notifications_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-mocks
 title: "@kbn/core-notifications-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-mocks']
 ---
 import kbnCoreNotificationsBrowserMocksObj from './kbn_core_notifications_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser.mdx b/api_docs/kbn_core_overlays_browser.mdx
index beedf8d4e58f4..310141dded650 100644
--- a/api_docs/kbn_core_overlays_browser.mdx
+++ b/api_docs/kbn_core_overlays_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser
 title: "@kbn/core-overlays-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser']
 ---
 import kbnCoreOverlaysBrowserObj from './kbn_core_overlays_browser.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_internal.mdx b/api_docs/kbn_core_overlays_browser_internal.mdx
index 6367a14852e11..243f9cdafc3c3 100644
--- a/api_docs/kbn_core_overlays_browser_internal.mdx
+++ b/api_docs/kbn_core_overlays_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-internal
 title: "@kbn/core-overlays-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-internal']
 ---
 import kbnCoreOverlaysBrowserInternalObj from './kbn_core_overlays_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_mocks.mdx b/api_docs/kbn_core_overlays_browser_mocks.mdx
index b8bb68a2cfd9c..4f2563bab174d 100644
--- a/api_docs/kbn_core_overlays_browser_mocks.mdx
+++ b/api_docs/kbn_core_overlays_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-mocks
 title: "@kbn/core-overlays-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-mocks']
 ---
 import kbnCoreOverlaysBrowserMocksObj from './kbn_core_overlays_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser.mdx b/api_docs/kbn_core_plugins_browser.mdx
index 66111a0f7d657..a21591c04197b 100644
--- a/api_docs/kbn_core_plugins_browser.mdx
+++ b/api_docs/kbn_core_plugins_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser
 title: "@kbn/core-plugins-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser']
 ---
 import kbnCorePluginsBrowserObj from './kbn_core_plugins_browser.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser_mocks.mdx b/api_docs/kbn_core_plugins_browser_mocks.mdx
index 838daf6d8e1d0..5880df1e788c2 100644
--- a/api_docs/kbn_core_plugins_browser_mocks.mdx
+++ b/api_docs/kbn_core_plugins_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser-mocks
 title: "@kbn/core-plugins-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser-mocks']
 ---
 import kbnCorePluginsBrowserMocksObj from './kbn_core_plugins_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server.mdx b/api_docs/kbn_core_plugins_server.mdx
index fe89389e84e94..571ed3432c2dc 100644
--- a/api_docs/kbn_core_plugins_server.mdx
+++ b/api_docs/kbn_core_plugins_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server
 title: "@kbn/core-plugins-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server']
 ---
 import kbnCorePluginsServerObj from './kbn_core_plugins_server.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server_mocks.mdx b/api_docs/kbn_core_plugins_server_mocks.mdx
index aa7575c38a2ad..1190111cca9c0 100644
--- a/api_docs/kbn_core_plugins_server_mocks.mdx
+++ b/api_docs/kbn_core_plugins_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server-mocks
 title: "@kbn/core-plugins-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server-mocks']
 ---
 import kbnCorePluginsServerMocksObj from './kbn_core_plugins_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server.mdx b/api_docs/kbn_core_preboot_server.mdx
index 5720a448ebb24..42198e233860d 100644
--- a/api_docs/kbn_core_preboot_server.mdx
+++ b/api_docs/kbn_core_preboot_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server
 title: "@kbn/core-preboot-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server']
 ---
 import kbnCorePrebootServerObj from './kbn_core_preboot_server.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server_mocks.mdx b/api_docs/kbn_core_preboot_server_mocks.mdx
index 56a260ff8ebcd..80f08df6bbb46 100644
--- a/api_docs/kbn_core_preboot_server_mocks.mdx
+++ b/api_docs/kbn_core_preboot_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server-mocks
 title: "@kbn/core-preboot-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server-mocks']
 ---
 import kbnCorePrebootServerMocksObj from './kbn_core_preboot_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_browser_mocks.mdx b/api_docs/kbn_core_rendering_browser_mocks.mdx
index bad727a256176..a2293deeda203 100644
--- a/api_docs/kbn_core_rendering_browser_mocks.mdx
+++ b/api_docs/kbn_core_rendering_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-browser-mocks
 title: "@kbn/core-rendering-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-browser-mocks']
 ---
 import kbnCoreRenderingBrowserMocksObj from './kbn_core_rendering_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_internal.mdx b/api_docs/kbn_core_rendering_server_internal.mdx
index e54cb36eb21bc..c89c781f12213 100644
--- a/api_docs/kbn_core_rendering_server_internal.mdx
+++ b/api_docs/kbn_core_rendering_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-internal
 title: "@kbn/core-rendering-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-internal']
 ---
 import kbnCoreRenderingServerInternalObj from './kbn_core_rendering_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_mocks.mdx b/api_docs/kbn_core_rendering_server_mocks.mdx
index 72ae780f7db92..039d838d0c2ea 100644
--- a/api_docs/kbn_core_rendering_server_mocks.mdx
+++ b/api_docs/kbn_core_rendering_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-mocks
 title: "@kbn/core-rendering-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-mocks']
 ---
 import kbnCoreRenderingServerMocksObj from './kbn_core_rendering_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_root_server_internal.mdx b/api_docs/kbn_core_root_server_internal.mdx
index a0a41359baad4..e0d7426e3d74e 100644
--- a/api_docs/kbn_core_root_server_internal.mdx
+++ b/api_docs/kbn_core_root_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-root-server-internal
 title: "@kbn/core-root-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-root-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-root-server-internal']
 ---
 import kbnCoreRootServerInternalObj from './kbn_core_root_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_browser.mdx b/api_docs/kbn_core_saved_objects_api_browser.mdx
index 6eb8522aafbf2..1e7825ce8078e 100644
--- a/api_docs/kbn_core_saved_objects_api_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_api_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-browser
 title: "@kbn/core-saved-objects-api-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-browser']
 ---
 import kbnCoreSavedObjectsApiBrowserObj from './kbn_core_saved_objects_api_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server.mdx b/api_docs/kbn_core_saved_objects_api_server.mdx
index f35bc7f40cf52..8076e2f0a36ff 100644
--- a/api_docs/kbn_core_saved_objects_api_server.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server
 title: "@kbn/core-saved-objects-api-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server']
 ---
 import kbnCoreSavedObjectsApiServerObj from './kbn_core_saved_objects_api_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
index 1f3eda2b9f1b3..fa0d2d074a5e4 100644
--- a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-mocks
 title: "@kbn/core-saved-objects-api-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-mocks']
 ---
 import kbnCoreSavedObjectsApiServerMocksObj from './kbn_core_saved_objects_api_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_internal.mdx b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
index 02637ce1468c8..1a371c8ec1903 100644
--- a/api_docs/kbn_core_saved_objects_base_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-internal
 title: "@kbn/core-saved-objects-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-internal']
 ---
 import kbnCoreSavedObjectsBaseServerInternalObj from './kbn_core_saved_objects_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
index cb99f7a5dde39..8b9ecad86b3ad 100644
--- a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-mocks
 title: "@kbn/core-saved-objects-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-mocks']
 ---
 import kbnCoreSavedObjectsBaseServerMocksObj from './kbn_core_saved_objects_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser.mdx b/api_docs/kbn_core_saved_objects_browser.mdx
index 94469755b93b0..84ee2004c2a08 100644
--- a/api_docs/kbn_core_saved_objects_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser
 title: "@kbn/core-saved-objects-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser']
 ---
 import kbnCoreSavedObjectsBrowserObj from './kbn_core_saved_objects_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_internal.mdx b/api_docs/kbn_core_saved_objects_browser_internal.mdx
index 8591454a5f954..506c73cf096e8 100644
--- a/api_docs/kbn_core_saved_objects_browser_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-internal
 title: "@kbn/core-saved-objects-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-internal']
 ---
 import kbnCoreSavedObjectsBrowserInternalObj from './kbn_core_saved_objects_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_mocks.mdx b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
index 1578ff9692585..b4a82df25a195 100644
--- a/api_docs/kbn_core_saved_objects_browser_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-mocks
 title: "@kbn/core-saved-objects-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-mocks']
 ---
 import kbnCoreSavedObjectsBrowserMocksObj from './kbn_core_saved_objects_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_common.mdx b/api_docs/kbn_core_saved_objects_common.mdx
index d2c740366d231..3110041812f7f 100644
--- a/api_docs/kbn_core_saved_objects_common.mdx
+++ b/api_docs/kbn_core_saved_objects_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-common
 title: "@kbn/core-saved-objects-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-common']
 ---
 import kbnCoreSavedObjectsCommonObj from './kbn_core_saved_objects_common.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
index 56bc9e2f1c505..98a5e7a84c76e 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-internal
 title: "@kbn/core-saved-objects-import-export-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-internal']
 ---
 import kbnCoreSavedObjectsImportExportServerInternalObj from './kbn_core_saved_objects_import_export_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
index ad8e13a8a9132..52040246662ab 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-mocks
 title: "@kbn/core-saved-objects-import-export-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-mocks']
 ---
 import kbnCoreSavedObjectsImportExportServerMocksObj from './kbn_core_saved_objects_import_export_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
index 0e1271923ccfd..e22bfc4ecbaa2 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-internal
 title: "@kbn/core-saved-objects-migration-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-internal']
 ---
 import kbnCoreSavedObjectsMigrationServerInternalObj from './kbn_core_saved_objects_migration_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
index 30382ecaab6e4..11ecd6e43744a 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-mocks
 title: "@kbn/core-saved-objects-migration-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-mocks']
 ---
 import kbnCoreSavedObjectsMigrationServerMocksObj from './kbn_core_saved_objects_migration_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server.mdx b/api_docs/kbn_core_saved_objects_server.mdx
index cf5c89f57edf2..7a884888fab7d 100644
--- a/api_docs/kbn_core_saved_objects_server.mdx
+++ b/api_docs/kbn_core_saved_objects_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server
 title: "@kbn/core-saved-objects-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server']
 ---
 import kbnCoreSavedObjectsServerObj from './kbn_core_saved_objects_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_internal.mdx b/api_docs/kbn_core_saved_objects_server_internal.mdx
index d34b7c64e736a..8a6d3004d3536 100644
--- a/api_docs/kbn_core_saved_objects_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-internal
 title: "@kbn/core-saved-objects-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-internal']
 ---
 import kbnCoreSavedObjectsServerInternalObj from './kbn_core_saved_objects_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_mocks.mdx b/api_docs/kbn_core_saved_objects_server_mocks.mdx
index 115eea47a436c..2247ebd114cc3 100644
--- a/api_docs/kbn_core_saved_objects_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-mocks
 title: "@kbn/core-saved-objects-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-mocks']
 ---
 import kbnCoreSavedObjectsServerMocksObj from './kbn_core_saved_objects_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_utils_server.mdx b/api_docs/kbn_core_saved_objects_utils_server.mdx
index 79845354a5f19..69f38ebde7b95 100644
--- a/api_docs/kbn_core_saved_objects_utils_server.mdx
+++ b/api_docs/kbn_core_saved_objects_utils_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-utils-server
 title: "@kbn/core-saved-objects-utils-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-utils-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-utils-server']
 ---
 import kbnCoreSavedObjectsUtilsServerObj from './kbn_core_saved_objects_utils_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_common.mdx b/api_docs/kbn_core_status_common.mdx
index ade68aee40e81..125534579a6b6 100644
--- a/api_docs/kbn_core_status_common.mdx
+++ b/api_docs/kbn_core_status_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common
 title: "@kbn/core-status-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common']
 ---
 import kbnCoreStatusCommonObj from './kbn_core_status_common.devdocs.json';
diff --git a/api_docs/kbn_core_status_common_internal.mdx b/api_docs/kbn_core_status_common_internal.mdx
index d234c9506c779..a9747a6cedd65 100644
--- a/api_docs/kbn_core_status_common_internal.mdx
+++ b/api_docs/kbn_core_status_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common-internal
 title: "@kbn/core-status-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common-internal']
 ---
 import kbnCoreStatusCommonInternalObj from './kbn_core_status_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server.mdx b/api_docs/kbn_core_status_server.mdx
index e51f2cfe24ba8..759f90a84ae3b 100644
--- a/api_docs/kbn_core_status_server.mdx
+++ b/api_docs/kbn_core_status_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server
 title: "@kbn/core-status-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server']
 ---
 import kbnCoreStatusServerObj from './kbn_core_status_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_internal.mdx b/api_docs/kbn_core_status_server_internal.mdx
index cd8255edd256c..4dd7efdab47b0 100644
--- a/api_docs/kbn_core_status_server_internal.mdx
+++ b/api_docs/kbn_core_status_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-internal
 title: "@kbn/core-status-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-internal']
 ---
 import kbnCoreStatusServerInternalObj from './kbn_core_status_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_mocks.mdx b/api_docs/kbn_core_status_server_mocks.mdx
index 965bbab2e503e..e86cca75f4e74 100644
--- a/api_docs/kbn_core_status_server_mocks.mdx
+++ b/api_docs/kbn_core_status_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-mocks
 title: "@kbn/core-status-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-mocks']
 ---
 import kbnCoreStatusServerMocksObj from './kbn_core_status_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
index 5329336b9544b..bfa9f231ff89d 100644
--- a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
+++ b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-deprecations-getters
 title: "@kbn/core-test-helpers-deprecations-getters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-deprecations-getters plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-deprecations-getters']
 ---
 import kbnCoreTestHelpersDeprecationsGettersObj from './kbn_core_test_helpers_deprecations_getters.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
index 5532f33ab2e4e..8f458a1241998 100644
--- a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
+++ b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-http-setup-browser
 title: "@kbn/core-test-helpers-http-setup-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-http-setup-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-http-setup-browser']
 ---
 import kbnCoreTestHelpersHttpSetupBrowserObj from './kbn_core_test_helpers_http_setup_browser.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_kbn_server.mdx b/api_docs/kbn_core_test_helpers_kbn_server.mdx
index 6b29d8a99554e..57851b7d2a29b 100644
--- a/api_docs/kbn_core_test_helpers_kbn_server.mdx
+++ b/api_docs/kbn_core_test_helpers_kbn_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-kbn-server
 title: "@kbn/core-test-helpers-kbn-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-kbn-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-kbn-server']
 ---
 import kbnCoreTestHelpersKbnServerObj from './kbn_core_test_helpers_kbn_server.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_model_versions.mdx b/api_docs/kbn_core_test_helpers_model_versions.mdx
index 03770ea48bacd..3bebca901cb3b 100644
--- a/api_docs/kbn_core_test_helpers_model_versions.mdx
+++ b/api_docs/kbn_core_test_helpers_model_versions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-model-versions
 title: "@kbn/core-test-helpers-model-versions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-model-versions plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-model-versions']
 ---
 import kbnCoreTestHelpersModelVersionsObj from './kbn_core_test_helpers_model_versions.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
index 6a2c4514eb72b..1633bf97e609d 100644
--- a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
+++ b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-so-type-serializer
 title: "@kbn/core-test-helpers-so-type-serializer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-so-type-serializer plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-so-type-serializer']
 ---
 import kbnCoreTestHelpersSoTypeSerializerObj from './kbn_core_test_helpers_so_type_serializer.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_test_utils.mdx b/api_docs/kbn_core_test_helpers_test_utils.mdx
index d6f23a203c566..5b7c2a28d9f60 100644
--- a/api_docs/kbn_core_test_helpers_test_utils.mdx
+++ b/api_docs/kbn_core_test_helpers_test_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-test-utils
 title: "@kbn/core-test-helpers-test-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-test-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-test-utils']
 ---
 import kbnCoreTestHelpersTestUtilsObj from './kbn_core_test_helpers_test_utils.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser.mdx b/api_docs/kbn_core_theme_browser.mdx
index ce2024bb5248f..9758a42a8bf6d 100644
--- a/api_docs/kbn_core_theme_browser.mdx
+++ b/api_docs/kbn_core_theme_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser
 title: "@kbn/core-theme-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser']
 ---
 import kbnCoreThemeBrowserObj from './kbn_core_theme_browser.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_mocks.mdx b/api_docs/kbn_core_theme_browser_mocks.mdx
index c965febf4fb07..203acc81167ed 100644
--- a/api_docs/kbn_core_theme_browser_mocks.mdx
+++ b/api_docs/kbn_core_theme_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-mocks
 title: "@kbn/core-theme-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-mocks']
 ---
 import kbnCoreThemeBrowserMocksObj from './kbn_core_theme_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser.mdx b/api_docs/kbn_core_ui_settings_browser.mdx
index a8d9bb4f3ac0c..68c710ee4d260 100644
--- a/api_docs/kbn_core_ui_settings_browser.mdx
+++ b/api_docs/kbn_core_ui_settings_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser
 title: "@kbn/core-ui-settings-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser']
 ---
 import kbnCoreUiSettingsBrowserObj from './kbn_core_ui_settings_browser.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_internal.mdx b/api_docs/kbn_core_ui_settings_browser_internal.mdx
index ee728910e42f9..45cb836ecd635 100644
--- a/api_docs/kbn_core_ui_settings_browser_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-internal
 title: "@kbn/core-ui-settings-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-internal']
 ---
 import kbnCoreUiSettingsBrowserInternalObj from './kbn_core_ui_settings_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_mocks.mdx b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
index dbe2bc10d74ce..64410905062e0 100644
--- a/api_docs/kbn_core_ui_settings_browser_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-mocks
 title: "@kbn/core-ui-settings-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-mocks']
 ---
 import kbnCoreUiSettingsBrowserMocksObj from './kbn_core_ui_settings_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_common.mdx b/api_docs/kbn_core_ui_settings_common.mdx
index 5a25486e52518..04d83683e797b 100644
--- a/api_docs/kbn_core_ui_settings_common.mdx
+++ b/api_docs/kbn_core_ui_settings_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-common
 title: "@kbn/core-ui-settings-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-common']
 ---
 import kbnCoreUiSettingsCommonObj from './kbn_core_ui_settings_common.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server.mdx b/api_docs/kbn_core_ui_settings_server.mdx
index 9fe6627c325cd..c22e8d5c8721c 100644
--- a/api_docs/kbn_core_ui_settings_server.mdx
+++ b/api_docs/kbn_core_ui_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server
 title: "@kbn/core-ui-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server']
 ---
 import kbnCoreUiSettingsServerObj from './kbn_core_ui_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_internal.mdx b/api_docs/kbn_core_ui_settings_server_internal.mdx
index 838fcb1aae356..4f917234096f4 100644
--- a/api_docs/kbn_core_ui_settings_server_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-internal
 title: "@kbn/core-ui-settings-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-internal']
 ---
 import kbnCoreUiSettingsServerInternalObj from './kbn_core_ui_settings_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_mocks.mdx b/api_docs/kbn_core_ui_settings_server_mocks.mdx
index cc2c366472b93..b6c6b9c3d0699 100644
--- a/api_docs/kbn_core_ui_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-mocks
 title: "@kbn/core-ui-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-mocks']
 ---
 import kbnCoreUiSettingsServerMocksObj from './kbn_core_ui_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server.mdx b/api_docs/kbn_core_usage_data_server.mdx
index ecdc9f63d3f23..29dfd0acc1cdb 100644
--- a/api_docs/kbn_core_usage_data_server.mdx
+++ b/api_docs/kbn_core_usage_data_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server
 title: "@kbn/core-usage-data-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server']
 ---
 import kbnCoreUsageDataServerObj from './kbn_core_usage_data_server.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_internal.mdx b/api_docs/kbn_core_usage_data_server_internal.mdx
index b67f94f44acd6..ceff5594fb719 100644
--- a/api_docs/kbn_core_usage_data_server_internal.mdx
+++ b/api_docs/kbn_core_usage_data_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-internal
 title: "@kbn/core-usage-data-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-internal']
 ---
 import kbnCoreUsageDataServerInternalObj from './kbn_core_usage_data_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_mocks.mdx b/api_docs/kbn_core_usage_data_server_mocks.mdx
index e6a92a1ee0e10..d9ae19c2b9f08 100644
--- a/api_docs/kbn_core_usage_data_server_mocks.mdx
+++ b/api_docs/kbn_core_usage_data_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-mocks
 title: "@kbn/core-usage-data-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-mocks']
 ---
 import kbnCoreUsageDataServerMocksObj from './kbn_core_usage_data_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_user_settings_server.mdx b/api_docs/kbn_core_user_settings_server.mdx
index 121fa189456ca..22f7d233d1fe3 100644
--- a/api_docs/kbn_core_user_settings_server.mdx
+++ b/api_docs/kbn_core_user_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-settings-server
 title: "@kbn/core-user-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-settings-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-settings-server']
 ---
 import kbnCoreUserSettingsServerObj from './kbn_core_user_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_user_settings_server_internal.mdx b/api_docs/kbn_core_user_settings_server_internal.mdx
index fd8537dc850bc..803005652a87f 100644
--- a/api_docs/kbn_core_user_settings_server_internal.mdx
+++ b/api_docs/kbn_core_user_settings_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-settings-server-internal
 title: "@kbn/core-user-settings-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-settings-server-internal plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-settings-server-internal']
 ---
 import kbnCoreUserSettingsServerInternalObj from './kbn_core_user_settings_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_user_settings_server_mocks.mdx b/api_docs/kbn_core_user_settings_server_mocks.mdx
index 4922f6c1ac14a..62ecfa529b8ff 100644
--- a/api_docs/kbn_core_user_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_user_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-user-settings-server-mocks
 title: "@kbn/core-user-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-user-settings-server-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-user-settings-server-mocks']
 ---
 import kbnCoreUserSettingsServerMocksObj from './kbn_core_user_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_crypto.mdx b/api_docs/kbn_crypto.mdx
index 00ac9bcfa92b9..289fa82165a64 100644
--- a/api_docs/kbn_crypto.mdx
+++ b/api_docs/kbn_crypto.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto
 title: "@kbn/crypto"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto']
 ---
 import kbnCryptoObj from './kbn_crypto.devdocs.json';
diff --git a/api_docs/kbn_crypto_browser.mdx b/api_docs/kbn_crypto_browser.mdx
index dc7836b73f9e1..eeeb48b8a2d69 100644
--- a/api_docs/kbn_crypto_browser.mdx
+++ b/api_docs/kbn_crypto_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto-browser
 title: "@kbn/crypto-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto-browser']
 ---
 import kbnCryptoBrowserObj from './kbn_crypto_browser.devdocs.json';
diff --git a/api_docs/kbn_custom_integrations.mdx b/api_docs/kbn_custom_integrations.mdx
index 8f43e18674892..151cc49157c9b 100644
--- a/api_docs/kbn_custom_integrations.mdx
+++ b/api_docs/kbn_custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-custom-integrations
 title: "@kbn/custom-integrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/custom-integrations plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/custom-integrations']
 ---
 import kbnCustomIntegrationsObj from './kbn_custom_integrations.devdocs.json';
diff --git a/api_docs/kbn_cypress_config.mdx b/api_docs/kbn_cypress_config.mdx
index c6d5cc7e2a2f3..e7a3a2dbcc9e5 100644
--- a/api_docs/kbn_cypress_config.mdx
+++ b/api_docs/kbn_cypress_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cypress-config
 title: "@kbn/cypress-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cypress-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cypress-config']
 ---
 import kbnCypressConfigObj from './kbn_cypress_config.devdocs.json';
diff --git a/api_docs/kbn_data_service.mdx b/api_docs/kbn_data_service.mdx
index c8608795376d4..03a71fd9484f3 100644
--- a/api_docs/kbn_data_service.mdx
+++ b/api_docs/kbn_data_service.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-data-service
 title: "@kbn/data-service"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/data-service plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/data-service']
 ---
 import kbnDataServiceObj from './kbn_data_service.devdocs.json';
diff --git a/api_docs/kbn_datemath.mdx b/api_docs/kbn_datemath.mdx
index 052febf795a11..1308b7455d408 100644
--- a/api_docs/kbn_datemath.mdx
+++ b/api_docs/kbn_datemath.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-datemath
 title: "@kbn/datemath"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/datemath plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/datemath']
 ---
 import kbnDatemathObj from './kbn_datemath.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_analytics.mdx b/api_docs/kbn_deeplinks_analytics.mdx
index 439e3851d53e6..4a4998f3ad48c 100644
--- a/api_docs/kbn_deeplinks_analytics.mdx
+++ b/api_docs/kbn_deeplinks_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-analytics
 title: "@kbn/deeplinks-analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-analytics plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-analytics']
 ---
 import kbnDeeplinksAnalyticsObj from './kbn_deeplinks_analytics.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_devtools.mdx b/api_docs/kbn_deeplinks_devtools.mdx
index 79f2b1056fd0a..d72a545ea10c3 100644
--- a/api_docs/kbn_deeplinks_devtools.mdx
+++ b/api_docs/kbn_deeplinks_devtools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-devtools
 title: "@kbn/deeplinks-devtools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-devtools plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-devtools']
 ---
 import kbnDeeplinksDevtoolsObj from './kbn_deeplinks_devtools.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_management.mdx b/api_docs/kbn_deeplinks_management.mdx
index 8c0a413406b99..f863bcfd7566a 100644
--- a/api_docs/kbn_deeplinks_management.mdx
+++ b/api_docs/kbn_deeplinks_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-management
 title: "@kbn/deeplinks-management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-management plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-management']
 ---
 import kbnDeeplinksManagementObj from './kbn_deeplinks_management.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_ml.mdx b/api_docs/kbn_deeplinks_ml.mdx
index 1395ae3325cab..67a843c745d28 100644
--- a/api_docs/kbn_deeplinks_ml.mdx
+++ b/api_docs/kbn_deeplinks_ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-ml
 title: "@kbn/deeplinks-ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-ml plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-ml']
 ---
 import kbnDeeplinksMlObj from './kbn_deeplinks_ml.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_observability.mdx b/api_docs/kbn_deeplinks_observability.mdx
index 0e3a433971632..0d213c503fa85 100644
--- a/api_docs/kbn_deeplinks_observability.mdx
+++ b/api_docs/kbn_deeplinks_observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-observability
 title: "@kbn/deeplinks-observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-observability plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-observability']
 ---
 import kbnDeeplinksObservabilityObj from './kbn_deeplinks_observability.devdocs.json';
diff --git a/api_docs/kbn_deeplinks_search.mdx b/api_docs/kbn_deeplinks_search.mdx
index 4a49fb66d5417..59d0e76084db4 100644
--- a/api_docs/kbn_deeplinks_search.mdx
+++ b/api_docs/kbn_deeplinks_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-deeplinks-search
 title: "@kbn/deeplinks-search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/deeplinks-search plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/deeplinks-search']
 ---
 import kbnDeeplinksSearchObj from './kbn_deeplinks_search.devdocs.json';
diff --git a/api_docs/kbn_default_nav_analytics.mdx b/api_docs/kbn_default_nav_analytics.mdx
index 9ae22cb5eb77b..789b32261a3dc 100644
--- a/api_docs/kbn_default_nav_analytics.mdx
+++ b/api_docs/kbn_default_nav_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-analytics
 title: "@kbn/default-nav-analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-analytics plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-analytics']
 ---
 import kbnDefaultNavAnalyticsObj from './kbn_default_nav_analytics.devdocs.json';
diff --git a/api_docs/kbn_default_nav_devtools.mdx b/api_docs/kbn_default_nav_devtools.mdx
index a89ef9ace78ab..f997d6b329962 100644
--- a/api_docs/kbn_default_nav_devtools.mdx
+++ b/api_docs/kbn_default_nav_devtools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-devtools
 title: "@kbn/default-nav-devtools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-devtools plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-devtools']
 ---
 import kbnDefaultNavDevtoolsObj from './kbn_default_nav_devtools.devdocs.json';
diff --git a/api_docs/kbn_default_nav_management.mdx b/api_docs/kbn_default_nav_management.mdx
index 72711c81df54d..23089a8c2cdfd 100644
--- a/api_docs/kbn_default_nav_management.mdx
+++ b/api_docs/kbn_default_nav_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-management
 title: "@kbn/default-nav-management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-management plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-management']
 ---
 import kbnDefaultNavManagementObj from './kbn_default_nav_management.devdocs.json';
diff --git a/api_docs/kbn_default_nav_ml.mdx b/api_docs/kbn_default_nav_ml.mdx
index 2a493255e4aea..bde41cb285650 100644
--- a/api_docs/kbn_default_nav_ml.mdx
+++ b/api_docs/kbn_default_nav_ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-default-nav-ml
 title: "@kbn/default-nav-ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/default-nav-ml plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/default-nav-ml']
 ---
 import kbnDefaultNavMlObj from './kbn_default_nav_ml.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_errors.mdx b/api_docs/kbn_dev_cli_errors.mdx
index 208bc76cf1809..21b0e0cfd841d 100644
--- a/api_docs/kbn_dev_cli_errors.mdx
+++ b/api_docs/kbn_dev_cli_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-errors
 title: "@kbn/dev-cli-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-errors plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-errors']
 ---
 import kbnDevCliErrorsObj from './kbn_dev_cli_errors.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_runner.mdx b/api_docs/kbn_dev_cli_runner.mdx
index c446ea3a3da6f..04025ae09c643 100644
--- a/api_docs/kbn_dev_cli_runner.mdx
+++ b/api_docs/kbn_dev_cli_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-runner
 title: "@kbn/dev-cli-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-runner plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-runner']
 ---
 import kbnDevCliRunnerObj from './kbn_dev_cli_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_proc_runner.mdx b/api_docs/kbn_dev_proc_runner.mdx
index 8b3593fa76a15..65c1b9041d81a 100644
--- a/api_docs/kbn_dev_proc_runner.mdx
+++ b/api_docs/kbn_dev_proc_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-proc-runner
 title: "@kbn/dev-proc-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-proc-runner plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-proc-runner']
 ---
 import kbnDevProcRunnerObj from './kbn_dev_proc_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx
index 69a6c8203e932..3bb94a6741819 100644
--- a/api_docs/kbn_dev_utils.mdx
+++ b/api_docs/kbn_dev_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-utils
 title: "@kbn/dev-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-utils']
 ---
 import kbnDevUtilsObj from './kbn_dev_utils.devdocs.json';
diff --git a/api_docs/kbn_discover_utils.mdx b/api_docs/kbn_discover_utils.mdx
index 5794ae515afd7..a173d559d222e 100644
--- a/api_docs/kbn_discover_utils.mdx
+++ b/api_docs/kbn_discover_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-discover-utils
 title: "@kbn/discover-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/discover-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/discover-utils']
 ---
 import kbnDiscoverUtilsObj from './kbn_discover_utils.devdocs.json';
diff --git a/api_docs/kbn_doc_links.devdocs.json b/api_docs/kbn_doc_links.devdocs.json
index 75a7a05e00db5..cee26cb32e97f 100644
--- a/api_docs/kbn_doc_links.devdocs.json
+++ b/api_docs/kbn_doc_links.devdocs.json
@@ -188,7 +188,7 @@
             "label": "cloud",
             "description": [],
             "signature": [
-              "{ readonly indexManagement: string; }"
+              "{ readonly beatsAndLogstashConfiguration: string; readonly indexManagement: string; }"
             ],
             "path": "packages/kbn-doc-links/src/types.ts",
             "deprecated": false,
diff --git a/api_docs/kbn_doc_links.mdx b/api_docs/kbn_doc_links.mdx
index 42369cbd064a9..2e4c7fa347e88 100644
--- a/api_docs/kbn_doc_links.mdx
+++ b/api_docs/kbn_doc_links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-doc-links
 title: "@kbn/doc-links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/doc-links plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/doc-links']
 ---
 import kbnDocLinksObj from './kbn_doc_links.devdocs.json';
diff --git a/api_docs/kbn_docs_utils.mdx b/api_docs/kbn_docs_utils.mdx
index 077724c079f35..71b4cbd81c709 100644
--- a/api_docs/kbn_docs_utils.mdx
+++ b/api_docs/kbn_docs_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-docs-utils
 title: "@kbn/docs-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/docs-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/docs-utils']
 ---
 import kbnDocsUtilsObj from './kbn_docs_utils.devdocs.json';
diff --git a/api_docs/kbn_dom_drag_drop.mdx b/api_docs/kbn_dom_drag_drop.mdx
index d8e78c4e7ed19..061b47c13e746 100644
--- a/api_docs/kbn_dom_drag_drop.mdx
+++ b/api_docs/kbn_dom_drag_drop.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dom-drag-drop
 title: "@kbn/dom-drag-drop"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dom-drag-drop plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dom-drag-drop']
 ---
 import kbnDomDragDropObj from './kbn_dom_drag_drop.devdocs.json';
diff --git a/api_docs/kbn_ebt_tools.mdx b/api_docs/kbn_ebt_tools.mdx
index d2a41664d9963..0b4cc22b82563 100644
--- a/api_docs/kbn_ebt_tools.mdx
+++ b/api_docs/kbn_ebt_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ebt-tools
 title: "@kbn/ebt-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ebt-tools plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ebt-tools']
 ---
 import kbnEbtToolsObj from './kbn_ebt_tools.devdocs.json';
diff --git a/api_docs/kbn_ecs.mdx b/api_docs/kbn_ecs.mdx
index 7e19bf2b752c4..121c9653054c7 100644
--- a/api_docs/kbn_ecs.mdx
+++ b/api_docs/kbn_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs
 title: "@kbn/ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs']
 ---
 import kbnEcsObj from './kbn_ecs.devdocs.json';
diff --git a/api_docs/kbn_ecs_data_quality_dashboard.mdx b/api_docs/kbn_ecs_data_quality_dashboard.mdx
index b4bbfc4268b87..6670939a4580d 100644
--- a/api_docs/kbn_ecs_data_quality_dashboard.mdx
+++ b/api_docs/kbn_ecs_data_quality_dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs-data-quality-dashboard
 title: "@kbn/ecs-data-quality-dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs-data-quality-dashboard plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs-data-quality-dashboard']
 ---
 import kbnEcsDataQualityDashboardObj from './kbn_ecs_data_quality_dashboard.devdocs.json';
diff --git a/api_docs/kbn_elastic_assistant.mdx b/api_docs/kbn_elastic_assistant.mdx
index 4a6e9ec026c93..1b755b46a7084 100644
--- a/api_docs/kbn_elastic_assistant.mdx
+++ b/api_docs/kbn_elastic_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-elastic-assistant
 title: "@kbn/elastic-assistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/elastic-assistant plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/elastic-assistant']
 ---
 import kbnElasticAssistantObj from './kbn_elastic_assistant.devdocs.json';
diff --git a/api_docs/kbn_es.mdx b/api_docs/kbn_es.mdx
index 6d8467150869d..6fe90016c8f9c 100644
--- a/api_docs/kbn_es.mdx
+++ b/api_docs/kbn_es.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es
 title: "@kbn/es"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es']
 ---
 import kbnEsObj from './kbn_es.devdocs.json';
diff --git a/api_docs/kbn_es_archiver.mdx b/api_docs/kbn_es_archiver.mdx
index 45b31d05190d8..11e18c47f2283 100644
--- a/api_docs/kbn_es_archiver.mdx
+++ b/api_docs/kbn_es_archiver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-archiver
 title: "@kbn/es-archiver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-archiver plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-archiver']
 ---
 import kbnEsArchiverObj from './kbn_es_archiver.devdocs.json';
diff --git a/api_docs/kbn_es_errors.mdx b/api_docs/kbn_es_errors.mdx
index ca836e5a68fa5..c82d160863404 100644
--- a/api_docs/kbn_es_errors.mdx
+++ b/api_docs/kbn_es_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-errors
 title: "@kbn/es-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-errors plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-errors']
 ---
 import kbnEsErrorsObj from './kbn_es_errors.devdocs.json';
diff --git a/api_docs/kbn_es_query.mdx b/api_docs/kbn_es_query.mdx
index 6984a273d3af6..dce10c7d9cc48 100644
--- a/api_docs/kbn_es_query.mdx
+++ b/api_docs/kbn_es_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-query
 title: "@kbn/es-query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-query plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-query']
 ---
 import kbnEsQueryObj from './kbn_es_query.devdocs.json';
diff --git a/api_docs/kbn_es_types.mdx b/api_docs/kbn_es_types.mdx
index 1122fe1ce3477..75f5dafad9657 100644
--- a/api_docs/kbn_es_types.mdx
+++ b/api_docs/kbn_es_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-types
 title: "@kbn/es-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-types']
 ---
 import kbnEsTypesObj from './kbn_es_types.devdocs.json';
diff --git a/api_docs/kbn_eslint_plugin_imports.mdx b/api_docs/kbn_eslint_plugin_imports.mdx
index b4eb28b97ce35..37dd013e2e9bf 100644
--- a/api_docs/kbn_eslint_plugin_imports.mdx
+++ b/api_docs/kbn_eslint_plugin_imports.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-eslint-plugin-imports
 title: "@kbn/eslint-plugin-imports"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/eslint-plugin-imports plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/eslint-plugin-imports']
 ---
 import kbnEslintPluginImportsObj from './kbn_eslint_plugin_imports.devdocs.json';
diff --git a/api_docs/kbn_event_annotation_common.mdx b/api_docs/kbn_event_annotation_common.mdx
index 778bd22ea1f3c..842da802e8d72 100644
--- a/api_docs/kbn_event_annotation_common.mdx
+++ b/api_docs/kbn_event_annotation_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-event-annotation-common
 title: "@kbn/event-annotation-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/event-annotation-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/event-annotation-common']
 ---
 import kbnEventAnnotationCommonObj from './kbn_event_annotation_common.devdocs.json';
diff --git a/api_docs/kbn_event_annotation_components.mdx b/api_docs/kbn_event_annotation_components.mdx
index 40ff5c5b4c600..a4ed1afd55a0c 100644
--- a/api_docs/kbn_event_annotation_components.mdx
+++ b/api_docs/kbn_event_annotation_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-event-annotation-components
 title: "@kbn/event-annotation-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/event-annotation-components plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/event-annotation-components']
 ---
 import kbnEventAnnotationComponentsObj from './kbn_event_annotation_components.devdocs.json';
diff --git a/api_docs/kbn_expandable_flyout.mdx b/api_docs/kbn_expandable_flyout.mdx
index be3eb2206755e..016214c2442c6 100644
--- a/api_docs/kbn_expandable_flyout.mdx
+++ b/api_docs/kbn_expandable_flyout.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-expandable-flyout
 title: "@kbn/expandable-flyout"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/expandable-flyout plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/expandable-flyout']
 ---
 import kbnExpandableFlyoutObj from './kbn_expandable_flyout.devdocs.json';
diff --git a/api_docs/kbn_field_types.mdx b/api_docs/kbn_field_types.mdx
index 2c858b2235f65..41f15802921c4 100644
--- a/api_docs/kbn_field_types.mdx
+++ b/api_docs/kbn_field_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-types
 title: "@kbn/field-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-types']
 ---
 import kbnFieldTypesObj from './kbn_field_types.devdocs.json';
diff --git a/api_docs/kbn_field_utils.mdx b/api_docs/kbn_field_utils.mdx
index 74e00a5d67edd..2dcf45be5d961 100644
--- a/api_docs/kbn_field_utils.mdx
+++ b/api_docs/kbn_field_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-utils
 title: "@kbn/field-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-utils']
 ---
 import kbnFieldUtilsObj from './kbn_field_utils.devdocs.json';
diff --git a/api_docs/kbn_find_used_node_modules.mdx b/api_docs/kbn_find_used_node_modules.mdx
index 72e5fac960de5..b8300f07fa8c9 100644
--- a/api_docs/kbn_find_used_node_modules.mdx
+++ b/api_docs/kbn_find_used_node_modules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-find-used-node-modules
 title: "@kbn/find-used-node-modules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/find-used-node-modules plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/find-used-node-modules']
 ---
 import kbnFindUsedNodeModulesObj from './kbn_find_used_node_modules.devdocs.json';
diff --git a/api_docs/kbn_ftr_common_functional_services.mdx b/api_docs/kbn_ftr_common_functional_services.mdx
index 9ee48740b5764..d9c86fb79b923 100644
--- a/api_docs/kbn_ftr_common_functional_services.mdx
+++ b/api_docs/kbn_ftr_common_functional_services.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ftr-common-functional-services
 title: "@kbn/ftr-common-functional-services"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ftr-common-functional-services plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ftr-common-functional-services']
 ---
 import kbnFtrCommonFunctionalServicesObj from './kbn_ftr_common_functional_services.devdocs.json';
diff --git a/api_docs/kbn_generate.mdx b/api_docs/kbn_generate.mdx
index b99f419b54347..120ce5dd3c1d7 100644
--- a/api_docs/kbn_generate.mdx
+++ b/api_docs/kbn_generate.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate
 title: "@kbn/generate"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate']
 ---
 import kbnGenerateObj from './kbn_generate.devdocs.json';
diff --git a/api_docs/kbn_generate_console_definitions.mdx b/api_docs/kbn_generate_console_definitions.mdx
index fcc83b8376c8f..d7c42f6b1177e 100644
--- a/api_docs/kbn_generate_console_definitions.mdx
+++ b/api_docs/kbn_generate_console_definitions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate-console-definitions
 title: "@kbn/generate-console-definitions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate-console-definitions plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate-console-definitions']
 ---
 import kbnGenerateConsoleDefinitionsObj from './kbn_generate_console_definitions.devdocs.json';
diff --git a/api_docs/kbn_generate_csv.mdx b/api_docs/kbn_generate_csv.mdx
index bb4533189accb..407a581068629 100644
--- a/api_docs/kbn_generate_csv.mdx
+++ b/api_docs/kbn_generate_csv.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate-csv
 title: "@kbn/generate-csv"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate-csv plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate-csv']
 ---
 import kbnGenerateCsvObj from './kbn_generate_csv.devdocs.json';
diff --git a/api_docs/kbn_generate_csv_types.mdx b/api_docs/kbn_generate_csv_types.mdx
index 69eccfe98f835..fb41a7be4951d 100644
--- a/api_docs/kbn_generate_csv_types.mdx
+++ b/api_docs/kbn_generate_csv_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate-csv-types
 title: "@kbn/generate-csv-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate-csv-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate-csv-types']
 ---
 import kbnGenerateCsvTypesObj from './kbn_generate_csv_types.devdocs.json';
diff --git a/api_docs/kbn_guided_onboarding.mdx b/api_docs/kbn_guided_onboarding.mdx
index daba723741ac9..e6ff63d52d665 100644
--- a/api_docs/kbn_guided_onboarding.mdx
+++ b/api_docs/kbn_guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-guided-onboarding
 title: "@kbn/guided-onboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/guided-onboarding plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/guided-onboarding']
 ---
 import kbnGuidedOnboardingObj from './kbn_guided_onboarding.devdocs.json';
diff --git a/api_docs/kbn_handlebars.mdx b/api_docs/kbn_handlebars.mdx
index 1796d99213e7e..1edc5f33884b5 100644
--- a/api_docs/kbn_handlebars.mdx
+++ b/api_docs/kbn_handlebars.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-handlebars
 title: "@kbn/handlebars"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/handlebars plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/handlebars']
 ---
 import kbnHandlebarsObj from './kbn_handlebars.devdocs.json';
diff --git a/api_docs/kbn_hapi_mocks.mdx b/api_docs/kbn_hapi_mocks.mdx
index c835b7449e29b..bd10bc2d9a904 100644
--- a/api_docs/kbn_hapi_mocks.mdx
+++ b/api_docs/kbn_hapi_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-hapi-mocks
 title: "@kbn/hapi-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/hapi-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/hapi-mocks']
 ---
 import kbnHapiMocksObj from './kbn_hapi_mocks.devdocs.json';
diff --git a/api_docs/kbn_health_gateway_server.mdx b/api_docs/kbn_health_gateway_server.mdx
index 6e2bbcdaa7d26..05f48bf23ee11 100644
--- a/api_docs/kbn_health_gateway_server.mdx
+++ b/api_docs/kbn_health_gateway_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-health-gateway-server
 title: "@kbn/health-gateway-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/health-gateway-server plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/health-gateway-server']
 ---
 import kbnHealthGatewayServerObj from './kbn_health_gateway_server.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_card.mdx b/api_docs/kbn_home_sample_data_card.mdx
index 802384e5daf27..77bcf96808129 100644
--- a/api_docs/kbn_home_sample_data_card.mdx
+++ b/api_docs/kbn_home_sample_data_card.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-card
 title: "@kbn/home-sample-data-card"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-card plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-card']
 ---
 import kbnHomeSampleDataCardObj from './kbn_home_sample_data_card.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_tab.mdx b/api_docs/kbn_home_sample_data_tab.mdx
index 531e5dcc8bfed..b4208ba4ec2b2 100644
--- a/api_docs/kbn_home_sample_data_tab.mdx
+++ b/api_docs/kbn_home_sample_data_tab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-tab
 title: "@kbn/home-sample-data-tab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-tab plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-tab']
 ---
 import kbnHomeSampleDataTabObj from './kbn_home_sample_data_tab.devdocs.json';
diff --git a/api_docs/kbn_i18n.mdx b/api_docs/kbn_i18n.mdx
index 7c76d20f12ede..e19cdc24528aa 100644
--- a/api_docs/kbn_i18n.mdx
+++ b/api_docs/kbn_i18n.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n
 title: "@kbn/i18n"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n']
 ---
 import kbnI18nObj from './kbn_i18n.devdocs.json';
diff --git a/api_docs/kbn_i18n_react.mdx b/api_docs/kbn_i18n_react.mdx
index 9b9086ffd45dd..13abdae24ddb7 100644
--- a/api_docs/kbn_i18n_react.mdx
+++ b/api_docs/kbn_i18n_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n-react
 title: "@kbn/i18n-react"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n-react plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n-react']
 ---
 import kbnI18nReactObj from './kbn_i18n_react.devdocs.json';
diff --git a/api_docs/kbn_import_resolver.mdx b/api_docs/kbn_import_resolver.mdx
index 0cdf73959282d..15bd5a0f10a4d 100644
--- a/api_docs/kbn_import_resolver.mdx
+++ b/api_docs/kbn_import_resolver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-import-resolver
 title: "@kbn/import-resolver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/import-resolver plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/import-resolver']
 ---
 import kbnImportResolverObj from './kbn_import_resolver.devdocs.json';
diff --git a/api_docs/kbn_infra_forge.mdx b/api_docs/kbn_infra_forge.mdx
index 43674dae39aaf..f16d6856cb0af 100644
--- a/api_docs/kbn_infra_forge.mdx
+++ b/api_docs/kbn_infra_forge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-infra-forge
 title: "@kbn/infra-forge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/infra-forge plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/infra-forge']
 ---
 import kbnInfraForgeObj from './kbn_infra_forge.devdocs.json';
diff --git a/api_docs/kbn_interpreter.mdx b/api_docs/kbn_interpreter.mdx
index b9127f2abfb62..1c74c25d20736 100644
--- a/api_docs/kbn_interpreter.mdx
+++ b/api_docs/kbn_interpreter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-interpreter
 title: "@kbn/interpreter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/interpreter plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/interpreter']
 ---
 import kbnInterpreterObj from './kbn_interpreter.devdocs.json';
diff --git a/api_docs/kbn_io_ts_utils.mdx b/api_docs/kbn_io_ts_utils.mdx
index 807f4284217f9..f4e6f4f42405d 100644
--- a/api_docs/kbn_io_ts_utils.mdx
+++ b/api_docs/kbn_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-io-ts-utils
 title: "@kbn/io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/io-ts-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/io-ts-utils']
 ---
 import kbnIoTsUtilsObj from './kbn_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_jest_serializers.mdx b/api_docs/kbn_jest_serializers.mdx
index 0fd78170433ef..48666ddfc9cec 100644
--- a/api_docs/kbn_jest_serializers.mdx
+++ b/api_docs/kbn_jest_serializers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-jest-serializers
 title: "@kbn/jest-serializers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/jest-serializers plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/jest-serializers']
 ---
 import kbnJestSerializersObj from './kbn_jest_serializers.devdocs.json';
diff --git a/api_docs/kbn_journeys.mdx b/api_docs/kbn_journeys.mdx
index 7a81141e28b12..848b68a06bd6a 100644
--- a/api_docs/kbn_journeys.mdx
+++ b/api_docs/kbn_journeys.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-journeys
 title: "@kbn/journeys"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/journeys plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/journeys']
 ---
 import kbnJourneysObj from './kbn_journeys.devdocs.json';
diff --git a/api_docs/kbn_json_ast.mdx b/api_docs/kbn_json_ast.mdx
index e1ab9a890e3c0..2f019fa045986 100644
--- a/api_docs/kbn_json_ast.mdx
+++ b/api_docs/kbn_json_ast.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-json-ast
 title: "@kbn/json-ast"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/json-ast plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/json-ast']
 ---
 import kbnJsonAstObj from './kbn_json_ast.devdocs.json';
diff --git a/api_docs/kbn_kibana_manifest_schema.mdx b/api_docs/kbn_kibana_manifest_schema.mdx
index 222e4c77b7a3c..05922365f5a79 100644
--- a/api_docs/kbn_kibana_manifest_schema.mdx
+++ b/api_docs/kbn_kibana_manifest_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-kibana-manifest-schema
 title: "@kbn/kibana-manifest-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/kibana-manifest-schema plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/kibana-manifest-schema']
 ---
 import kbnKibanaManifestSchemaObj from './kbn_kibana_manifest_schema.devdocs.json';
diff --git a/api_docs/kbn_language_documentation_popover.mdx b/api_docs/kbn_language_documentation_popover.mdx
index 8c96c2f07fdd5..1d0d26cfc40b3 100644
--- a/api_docs/kbn_language_documentation_popover.mdx
+++ b/api_docs/kbn_language_documentation_popover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-language-documentation-popover
 title: "@kbn/language-documentation-popover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/language-documentation-popover plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/language-documentation-popover']
 ---
 import kbnLanguageDocumentationPopoverObj from './kbn_language_documentation_popover.devdocs.json';
diff --git a/api_docs/kbn_lens_embeddable_utils.mdx b/api_docs/kbn_lens_embeddable_utils.mdx
index ffaf394dbc42c..8f9c991cdecda 100644
--- a/api_docs/kbn_lens_embeddable_utils.mdx
+++ b/api_docs/kbn_lens_embeddable_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-lens-embeddable-utils
 title: "@kbn/lens-embeddable-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/lens-embeddable-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/lens-embeddable-utils']
 ---
 import kbnLensEmbeddableUtilsObj from './kbn_lens_embeddable_utils.devdocs.json';
diff --git a/api_docs/kbn_logging.mdx b/api_docs/kbn_logging.mdx
index 680ad1778fa9c..154560575a7f9 100644
--- a/api_docs/kbn_logging.mdx
+++ b/api_docs/kbn_logging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging
 title: "@kbn/logging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging']
 ---
 import kbnLoggingObj from './kbn_logging.devdocs.json';
diff --git a/api_docs/kbn_logging_mocks.mdx b/api_docs/kbn_logging_mocks.mdx
index 19156a0ee662d..c3bec508ab7f1 100644
--- a/api_docs/kbn_logging_mocks.mdx
+++ b/api_docs/kbn_logging_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging-mocks
 title: "@kbn/logging-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging-mocks']
 ---
 import kbnLoggingMocksObj from './kbn_logging_mocks.devdocs.json';
diff --git a/api_docs/kbn_managed_vscode_config.mdx b/api_docs/kbn_managed_vscode_config.mdx
index 4c5a8a0670f4e..4a87a3188f490 100644
--- a/api_docs/kbn_managed_vscode_config.mdx
+++ b/api_docs/kbn_managed_vscode_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-managed-vscode-config
 title: "@kbn/managed-vscode-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/managed-vscode-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/managed-vscode-config']
 ---
 import kbnManagedVscodeConfigObj from './kbn_managed_vscode_config.devdocs.json';
diff --git a/api_docs/kbn_management_cards_navigation.mdx b/api_docs/kbn_management_cards_navigation.mdx
index 33600c2a5e444..8ff5aaf0d9e99 100644
--- a/api_docs/kbn_management_cards_navigation.mdx
+++ b/api_docs/kbn_management_cards_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-cards-navigation
 title: "@kbn/management-cards-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-cards-navigation plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-cards-navigation']
 ---
 import kbnManagementCardsNavigationObj from './kbn_management_cards_navigation.devdocs.json';
diff --git a/api_docs/kbn_management_settings_application.mdx b/api_docs/kbn_management_settings_application.mdx
index 775e1bd10c9f1..44d2da6fd14cf 100644
--- a/api_docs/kbn_management_settings_application.mdx
+++ b/api_docs/kbn_management_settings_application.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-application
 title: "@kbn/management-settings-application"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-application plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-application']
 ---
 import kbnManagementSettingsApplicationObj from './kbn_management_settings_application.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_category.mdx b/api_docs/kbn_management_settings_components_field_category.mdx
index 607b8416872d8..62c9441a3eb77 100644
--- a/api_docs/kbn_management_settings_components_field_category.mdx
+++ b/api_docs/kbn_management_settings_components_field_category.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-category
 title: "@kbn/management-settings-components-field-category"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-category plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-category']
 ---
 import kbnManagementSettingsComponentsFieldCategoryObj from './kbn_management_settings_components_field_category.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_input.mdx b/api_docs/kbn_management_settings_components_field_input.mdx
index 69d7cda180831..6eb634d838a92 100644
--- a/api_docs/kbn_management_settings_components_field_input.mdx
+++ b/api_docs/kbn_management_settings_components_field_input.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-input
 title: "@kbn/management-settings-components-field-input"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-input plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-input']
 ---
 import kbnManagementSettingsComponentsFieldInputObj from './kbn_management_settings_components_field_input.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_field_row.mdx b/api_docs/kbn_management_settings_components_field_row.mdx
index cbbbef37dcd8b..b6c6f46f5bc92 100644
--- a/api_docs/kbn_management_settings_components_field_row.mdx
+++ b/api_docs/kbn_management_settings_components_field_row.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-field-row
 title: "@kbn/management-settings-components-field-row"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-field-row plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-field-row']
 ---
 import kbnManagementSettingsComponentsFieldRowObj from './kbn_management_settings_components_field_row.devdocs.json';
diff --git a/api_docs/kbn_management_settings_components_form.mdx b/api_docs/kbn_management_settings_components_form.mdx
index 4ec1cde8b5c29..46f4605160b0f 100644
--- a/api_docs/kbn_management_settings_components_form.mdx
+++ b/api_docs/kbn_management_settings_components_form.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-components-form
 title: "@kbn/management-settings-components-form"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-components-form plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-components-form']
 ---
 import kbnManagementSettingsComponentsFormObj from './kbn_management_settings_components_form.devdocs.json';
diff --git a/api_docs/kbn_management_settings_field_definition.mdx b/api_docs/kbn_management_settings_field_definition.mdx
index 05abf0dbe9b38..f0612772a9130 100644
--- a/api_docs/kbn_management_settings_field_definition.mdx
+++ b/api_docs/kbn_management_settings_field_definition.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-field-definition
 title: "@kbn/management-settings-field-definition"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-field-definition plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-field-definition']
 ---
 import kbnManagementSettingsFieldDefinitionObj from './kbn_management_settings_field_definition.devdocs.json';
diff --git a/api_docs/kbn_management_settings_ids.devdocs.json b/api_docs/kbn_management_settings_ids.devdocs.json
index ecc7289a5b4ca..af86fa04d57b9 100644
--- a/api_docs/kbn_management_settings_ids.devdocs.json
+++ b/api_docs/kbn_management_settings_ids.devdocs.json
@@ -877,21 +877,6 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "@kbn/management-settings-ids",
-        "id": "def-common.LABS_DASHBOARD_CONTROLS_ID",
-        "type": "string",
-        "tags": [],
-        "label": "LABS_DASHBOARD_CONTROLS_ID",
-        "description": [],
-        "signature": [
-          "\"labs:dashboard:dashboardControls\""
-        ],
-        "path": "packages/kbn-management/settings/setting_ids/index.ts",
-        "deprecated": false,
-        "trackAdoption": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "@kbn/management-settings-ids",
         "id": "def-common.LABS_DASHBOARD_DEFER_BELOW_FOLD_ID",
diff --git a/api_docs/kbn_management_settings_ids.mdx b/api_docs/kbn_management_settings_ids.mdx
index c880732b72c95..e5a8c6eb448e5 100644
--- a/api_docs/kbn_management_settings_ids.mdx
+++ b/api_docs/kbn_management_settings_ids.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-ids
 title: "@kbn/management-settings-ids"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-ids plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-ids']
 ---
 import kbnManagementSettingsIdsObj from './kbn_management_settings_ids.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux @elastic/platform-deployment-management](https:
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 130 | 0 | 130 | 0 |
+| 129 | 0 | 129 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_management_settings_section_registry.mdx b/api_docs/kbn_management_settings_section_registry.mdx
index 3b9e1a218084e..e6b1e32ab8793 100644
--- a/api_docs/kbn_management_settings_section_registry.mdx
+++ b/api_docs/kbn_management_settings_section_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-section-registry
 title: "@kbn/management-settings-section-registry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-section-registry plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-section-registry']
 ---
 import kbnManagementSettingsSectionRegistryObj from './kbn_management_settings_section_registry.devdocs.json';
diff --git a/api_docs/kbn_management_settings_types.mdx b/api_docs/kbn_management_settings_types.mdx
index 4bb988419f410..a353f360102ec 100644
--- a/api_docs/kbn_management_settings_types.mdx
+++ b/api_docs/kbn_management_settings_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-types
 title: "@kbn/management-settings-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-types']
 ---
 import kbnManagementSettingsTypesObj from './kbn_management_settings_types.devdocs.json';
diff --git a/api_docs/kbn_management_settings_utilities.mdx b/api_docs/kbn_management_settings_utilities.mdx
index b01ebdbac230a..ddbcb477578db 100644
--- a/api_docs/kbn_management_settings_utilities.mdx
+++ b/api_docs/kbn_management_settings_utilities.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-settings-utilities
 title: "@kbn/management-settings-utilities"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-settings-utilities plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-settings-utilities']
 ---
 import kbnManagementSettingsUtilitiesObj from './kbn_management_settings_utilities.devdocs.json';
diff --git a/api_docs/kbn_management_storybook_config.mdx b/api_docs/kbn_management_storybook_config.mdx
index 95d94828b5db2..e17fd9d2ad089 100644
--- a/api_docs/kbn_management_storybook_config.mdx
+++ b/api_docs/kbn_management_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-management-storybook-config
 title: "@kbn/management-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/management-storybook-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/management-storybook-config']
 ---
 import kbnManagementStorybookConfigObj from './kbn_management_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_mapbox_gl.mdx b/api_docs/kbn_mapbox_gl.mdx
index 0a86e03917f78..8ce869fb39d5f 100644
--- a/api_docs/kbn_mapbox_gl.mdx
+++ b/api_docs/kbn_mapbox_gl.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-mapbox-gl
 title: "@kbn/mapbox-gl"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/mapbox-gl plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mapbox-gl']
 ---
 import kbnMapboxGlObj from './kbn_mapbox_gl.devdocs.json';
diff --git a/api_docs/kbn_maps_vector_tile_utils.mdx b/api_docs/kbn_maps_vector_tile_utils.mdx
index 45ff4ac5d2a41..53b634d36c7f6 100644
--- a/api_docs/kbn_maps_vector_tile_utils.mdx
+++ b/api_docs/kbn_maps_vector_tile_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-maps-vector-tile-utils
 title: "@kbn/maps-vector-tile-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/maps-vector-tile-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/maps-vector-tile-utils']
 ---
 import kbnMapsVectorTileUtilsObj from './kbn_maps_vector_tile_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_agg_utils.mdx b/api_docs/kbn_ml_agg_utils.mdx
index bfae56ba74719..d6d3ae73c69b2 100644
--- a/api_docs/kbn_ml_agg_utils.mdx
+++ b/api_docs/kbn_ml_agg_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-agg-utils
 title: "@kbn/ml-agg-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-agg-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-agg-utils']
 ---
 import kbnMlAggUtilsObj from './kbn_ml_agg_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_anomaly_utils.mdx b/api_docs/kbn_ml_anomaly_utils.mdx
index 8c8e2328183c7..c8e93c3ddea8d 100644
--- a/api_docs/kbn_ml_anomaly_utils.mdx
+++ b/api_docs/kbn_ml_anomaly_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-anomaly-utils
 title: "@kbn/ml-anomaly-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-anomaly-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-anomaly-utils']
 ---
 import kbnMlAnomalyUtilsObj from './kbn_ml_anomaly_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_category_validator.mdx b/api_docs/kbn_ml_category_validator.mdx
index c30458b0acf95..4d3fb9af4a8a7 100644
--- a/api_docs/kbn_ml_category_validator.mdx
+++ b/api_docs/kbn_ml_category_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-category-validator
 title: "@kbn/ml-category-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-category-validator plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-category-validator']
 ---
 import kbnMlCategoryValidatorObj from './kbn_ml_category_validator.devdocs.json';
diff --git a/api_docs/kbn_ml_chi2test.mdx b/api_docs/kbn_ml_chi2test.mdx
index c0276887534e9..5dc7834d58d59 100644
--- a/api_docs/kbn_ml_chi2test.mdx
+++ b/api_docs/kbn_ml_chi2test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-chi2test
 title: "@kbn/ml-chi2test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-chi2test plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-chi2test']
 ---
 import kbnMlChi2testObj from './kbn_ml_chi2test.devdocs.json';
diff --git a/api_docs/kbn_ml_data_frame_analytics_utils.mdx b/api_docs/kbn_ml_data_frame_analytics_utils.mdx
index e794e82dfed8d..59ab90c0a6adf 100644
--- a/api_docs/kbn_ml_data_frame_analytics_utils.mdx
+++ b/api_docs/kbn_ml_data_frame_analytics_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-data-frame-analytics-utils
 title: "@kbn/ml-data-frame-analytics-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-data-frame-analytics-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-data-frame-analytics-utils']
 ---
 import kbnMlDataFrameAnalyticsUtilsObj from './kbn_ml_data_frame_analytics_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_data_grid.mdx b/api_docs/kbn_ml_data_grid.mdx
index f07e1df738435..e853c97f1a6b0 100644
--- a/api_docs/kbn_ml_data_grid.mdx
+++ b/api_docs/kbn_ml_data_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-data-grid
 title: "@kbn/ml-data-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-data-grid plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-data-grid']
 ---
 import kbnMlDataGridObj from './kbn_ml_data_grid.devdocs.json';
diff --git a/api_docs/kbn_ml_date_picker.mdx b/api_docs/kbn_ml_date_picker.mdx
index f62e4d8528a36..3492660885129 100644
--- a/api_docs/kbn_ml_date_picker.mdx
+++ b/api_docs/kbn_ml_date_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-picker
 title: "@kbn/ml-date-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-picker plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-picker']
 ---
 import kbnMlDatePickerObj from './kbn_ml_date_picker.devdocs.json';
diff --git a/api_docs/kbn_ml_date_utils.mdx b/api_docs/kbn_ml_date_utils.mdx
index 2b875575da69e..b9b793835e67d 100644
--- a/api_docs/kbn_ml_date_utils.mdx
+++ b/api_docs/kbn_ml_date_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-utils
 title: "@kbn/ml-date-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-utils']
 ---
 import kbnMlDateUtilsObj from './kbn_ml_date_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_error_utils.mdx b/api_docs/kbn_ml_error_utils.mdx
index 27d414c534ce9..04d6919d1b23d 100644
--- a/api_docs/kbn_ml_error_utils.mdx
+++ b/api_docs/kbn_ml_error_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-error-utils
 title: "@kbn/ml-error-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-error-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-error-utils']
 ---
 import kbnMlErrorUtilsObj from './kbn_ml_error_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_in_memory_table.mdx b/api_docs/kbn_ml_in_memory_table.mdx
index 03f6cbceb182a..abc4eaa0cdadd 100644
--- a/api_docs/kbn_ml_in_memory_table.mdx
+++ b/api_docs/kbn_ml_in_memory_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-in-memory-table
 title: "@kbn/ml-in-memory-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-in-memory-table plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-in-memory-table']
 ---
 import kbnMlInMemoryTableObj from './kbn_ml_in_memory_table.devdocs.json';
diff --git a/api_docs/kbn_ml_is_defined.mdx b/api_docs/kbn_ml_is_defined.mdx
index e93465d920b96..66e526559a636 100644
--- a/api_docs/kbn_ml_is_defined.mdx
+++ b/api_docs/kbn_ml_is_defined.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-defined
 title: "@kbn/ml-is-defined"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-defined plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-defined']
 ---
 import kbnMlIsDefinedObj from './kbn_ml_is_defined.devdocs.json';
diff --git a/api_docs/kbn_ml_is_populated_object.mdx b/api_docs/kbn_ml_is_populated_object.mdx
index 00eb220d3e6f5..bfe09917244e4 100644
--- a/api_docs/kbn_ml_is_populated_object.mdx
+++ b/api_docs/kbn_ml_is_populated_object.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-populated-object
 title: "@kbn/ml-is-populated-object"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-populated-object plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-populated-object']
 ---
 import kbnMlIsPopulatedObjectObj from './kbn_ml_is_populated_object.devdocs.json';
diff --git a/api_docs/kbn_ml_kibana_theme.mdx b/api_docs/kbn_ml_kibana_theme.mdx
index a377d6146b038..8f3f81cf3c505 100644
--- a/api_docs/kbn_ml_kibana_theme.mdx
+++ b/api_docs/kbn_ml_kibana_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-kibana-theme
 title: "@kbn/ml-kibana-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-kibana-theme plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-kibana-theme']
 ---
 import kbnMlKibanaThemeObj from './kbn_ml_kibana_theme.devdocs.json';
diff --git a/api_docs/kbn_ml_local_storage.mdx b/api_docs/kbn_ml_local_storage.mdx
index 679fac32be272..ffe74b9f673f4 100644
--- a/api_docs/kbn_ml_local_storage.mdx
+++ b/api_docs/kbn_ml_local_storage.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-local-storage
 title: "@kbn/ml-local-storage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-local-storage plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-local-storage']
 ---
 import kbnMlLocalStorageObj from './kbn_ml_local_storage.devdocs.json';
diff --git a/api_docs/kbn_ml_nested_property.mdx b/api_docs/kbn_ml_nested_property.mdx
index 8289bff3f047d..2b4aac21cee0c 100644
--- a/api_docs/kbn_ml_nested_property.mdx
+++ b/api_docs/kbn_ml_nested_property.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-nested-property
 title: "@kbn/ml-nested-property"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-nested-property plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-nested-property']
 ---
 import kbnMlNestedPropertyObj from './kbn_ml_nested_property.devdocs.json';
diff --git a/api_docs/kbn_ml_number_utils.mdx b/api_docs/kbn_ml_number_utils.mdx
index db521752afb3e..3a75455a6491d 100644
--- a/api_docs/kbn_ml_number_utils.mdx
+++ b/api_docs/kbn_ml_number_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-number-utils
 title: "@kbn/ml-number-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-number-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-number-utils']
 ---
 import kbnMlNumberUtilsObj from './kbn_ml_number_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_query_utils.mdx b/api_docs/kbn_ml_query_utils.mdx
index b2a9594414537..7250ccecabd5b 100644
--- a/api_docs/kbn_ml_query_utils.mdx
+++ b/api_docs/kbn_ml_query_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-query-utils
 title: "@kbn/ml-query-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-query-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-query-utils']
 ---
 import kbnMlQueryUtilsObj from './kbn_ml_query_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_random_sampler_utils.mdx b/api_docs/kbn_ml_random_sampler_utils.mdx
index 82d819de0bbbd..1e7856616884c 100644
--- a/api_docs/kbn_ml_random_sampler_utils.mdx
+++ b/api_docs/kbn_ml_random_sampler_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-random-sampler-utils
 title: "@kbn/ml-random-sampler-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-random-sampler-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-random-sampler-utils']
 ---
 import kbnMlRandomSamplerUtilsObj from './kbn_ml_random_sampler_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_route_utils.mdx b/api_docs/kbn_ml_route_utils.mdx
index 161312d725bc0..5d706d8a85b72 100644
--- a/api_docs/kbn_ml_route_utils.mdx
+++ b/api_docs/kbn_ml_route_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-route-utils
 title: "@kbn/ml-route-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-route-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-route-utils']
 ---
 import kbnMlRouteUtilsObj from './kbn_ml_route_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_runtime_field_utils.mdx b/api_docs/kbn_ml_runtime_field_utils.mdx
index ff10f9ce450d3..e52a1837efdec 100644
--- a/api_docs/kbn_ml_runtime_field_utils.mdx
+++ b/api_docs/kbn_ml_runtime_field_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-runtime-field-utils
 title: "@kbn/ml-runtime-field-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-runtime-field-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-runtime-field-utils']
 ---
 import kbnMlRuntimeFieldUtilsObj from './kbn_ml_runtime_field_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_string_hash.mdx b/api_docs/kbn_ml_string_hash.mdx
index 9c6b8a5cfbdbd..a853ed0a0b114 100644
--- a/api_docs/kbn_ml_string_hash.mdx
+++ b/api_docs/kbn_ml_string_hash.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-string-hash
 title: "@kbn/ml-string-hash"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-string-hash plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-string-hash']
 ---
 import kbnMlStringHashObj from './kbn_ml_string_hash.devdocs.json';
diff --git a/api_docs/kbn_ml_trained_models_utils.mdx b/api_docs/kbn_ml_trained_models_utils.mdx
index 8ce19c2badec4..fcb1f56dee9f1 100644
--- a/api_docs/kbn_ml_trained_models_utils.mdx
+++ b/api_docs/kbn_ml_trained_models_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-trained-models-utils
 title: "@kbn/ml-trained-models-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-trained-models-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-trained-models-utils']
 ---
 import kbnMlTrainedModelsUtilsObj from './kbn_ml_trained_models_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_url_state.mdx b/api_docs/kbn_ml_url_state.mdx
index e72e78edc2bff..043732429d6a5 100644
--- a/api_docs/kbn_ml_url_state.mdx
+++ b/api_docs/kbn_ml_url_state.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-url-state
 title: "@kbn/ml-url-state"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-url-state plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-url-state']
 ---
 import kbnMlUrlStateObj from './kbn_ml_url_state.devdocs.json';
diff --git a/api_docs/kbn_monaco.mdx b/api_docs/kbn_monaco.mdx
index a83806f0da4d5..864093ed30dc5 100644
--- a/api_docs/kbn_monaco.mdx
+++ b/api_docs/kbn_monaco.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-monaco
 title: "@kbn/monaco"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/monaco plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/monaco']
 ---
 import kbnMonacoObj from './kbn_monaco.devdocs.json';
diff --git a/api_docs/kbn_object_versioning.mdx b/api_docs/kbn_object_versioning.mdx
index 3694965ad35ba..e1c511aee3913 100644
--- a/api_docs/kbn_object_versioning.mdx
+++ b/api_docs/kbn_object_versioning.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-object-versioning
 title: "@kbn/object-versioning"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/object-versioning plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/object-versioning']
 ---
 import kbnObjectVersioningObj from './kbn_object_versioning.devdocs.json';
diff --git a/api_docs/kbn_observability_alert_details.mdx b/api_docs/kbn_observability_alert_details.mdx
index 9e6872b77b9bd..04e01a1073742 100644
--- a/api_docs/kbn_observability_alert_details.mdx
+++ b/api_docs/kbn_observability_alert_details.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-observability-alert-details
 title: "@kbn/observability-alert-details"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/observability-alert-details plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/observability-alert-details']
 ---
 import kbnObservabilityAlertDetailsObj from './kbn_observability_alert_details.devdocs.json';
diff --git a/api_docs/kbn_openapi_generator.mdx b/api_docs/kbn_openapi_generator.mdx
index adb1d9df859cb..b471610fb0237 100644
--- a/api_docs/kbn_openapi_generator.mdx
+++ b/api_docs/kbn_openapi_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-openapi-generator
 title: "@kbn/openapi-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/openapi-generator plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/openapi-generator']
 ---
 import kbnOpenapiGeneratorObj from './kbn_openapi_generator.devdocs.json';
diff --git a/api_docs/kbn_optimizer.mdx b/api_docs/kbn_optimizer.mdx
index 16c7c62b140f6..b79ea3b08a41b 100644
--- a/api_docs/kbn_optimizer.mdx
+++ b/api_docs/kbn_optimizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer
 title: "@kbn/optimizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer']
 ---
 import kbnOptimizerObj from './kbn_optimizer.devdocs.json';
diff --git a/api_docs/kbn_optimizer_webpack_helpers.mdx b/api_docs/kbn_optimizer_webpack_helpers.mdx
index 50f92353f385d..0de94fe6ca94c 100644
--- a/api_docs/kbn_optimizer_webpack_helpers.mdx
+++ b/api_docs/kbn_optimizer_webpack_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer-webpack-helpers
 title: "@kbn/optimizer-webpack-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer-webpack-helpers plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer-webpack-helpers']
 ---
 import kbnOptimizerWebpackHelpersObj from './kbn_optimizer_webpack_helpers.devdocs.json';
diff --git a/api_docs/kbn_osquery_io_ts_types.mdx b/api_docs/kbn_osquery_io_ts_types.mdx
index 34d61d993372e..de2a2a89c76a6 100644
--- a/api_docs/kbn_osquery_io_ts_types.mdx
+++ b/api_docs/kbn_osquery_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-osquery-io-ts-types
 title: "@kbn/osquery-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/osquery-io-ts-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/osquery-io-ts-types']
 ---
 import kbnOsqueryIoTsTypesObj from './kbn_osquery_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_performance_testing_dataset_extractor.mdx b/api_docs/kbn_performance_testing_dataset_extractor.mdx
index 621b9bc05229e..f7cf3fba50192 100644
--- a/api_docs/kbn_performance_testing_dataset_extractor.mdx
+++ b/api_docs/kbn_performance_testing_dataset_extractor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-performance-testing-dataset-extractor
 title: "@kbn/performance-testing-dataset-extractor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/performance-testing-dataset-extractor plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/performance-testing-dataset-extractor']
 ---
 import kbnPerformanceTestingDatasetExtractorObj from './kbn_performance_testing_dataset_extractor.devdocs.json';
diff --git a/api_docs/kbn_plugin_generator.mdx b/api_docs/kbn_plugin_generator.mdx
index 27f9fdd17416e..964b3d6380eb6 100644
--- a/api_docs/kbn_plugin_generator.mdx
+++ b/api_docs/kbn_plugin_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-generator
 title: "@kbn/plugin-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-generator plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-generator']
 ---
 import kbnPluginGeneratorObj from './kbn_plugin_generator.devdocs.json';
diff --git a/api_docs/kbn_plugin_helpers.mdx b/api_docs/kbn_plugin_helpers.mdx
index 9409382c8f169..3bf118f383598 100644
--- a/api_docs/kbn_plugin_helpers.mdx
+++ b/api_docs/kbn_plugin_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-helpers
 title: "@kbn/plugin-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-helpers plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-helpers']
 ---
 import kbnPluginHelpersObj from './kbn_plugin_helpers.devdocs.json';
diff --git a/api_docs/kbn_profiling_utils.mdx b/api_docs/kbn_profiling_utils.mdx
index 135e886dc7603..5b4174c8914fc 100644
--- a/api_docs/kbn_profiling_utils.mdx
+++ b/api_docs/kbn_profiling_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-profiling-utils
 title: "@kbn/profiling-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/profiling-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/profiling-utils']
 ---
 import kbnProfilingUtilsObj from './kbn_profiling_utils.devdocs.json';
diff --git a/api_docs/kbn_random_sampling.mdx b/api_docs/kbn_random_sampling.mdx
index ef6b5637e8be1..3d9b4ef0ba95f 100644
--- a/api_docs/kbn_random_sampling.mdx
+++ b/api_docs/kbn_random_sampling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-random-sampling
 title: "@kbn/random-sampling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/random-sampling plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/random-sampling']
 ---
 import kbnRandomSamplingObj from './kbn_random_sampling.devdocs.json';
diff --git a/api_docs/kbn_react_field.mdx b/api_docs/kbn_react_field.mdx
index 5d2455c7bba87..0d2ecb7e3b1aa 100644
--- a/api_docs/kbn_react_field.mdx
+++ b/api_docs/kbn_react_field.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-field
 title: "@kbn/react-field"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-field plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-field']
 ---
 import kbnReactFieldObj from './kbn_react_field.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_common.mdx b/api_docs/kbn_react_kibana_context_common.mdx
index 03245f883d8df..6576b0a7ddcff 100644
--- a/api_docs/kbn_react_kibana_context_common.mdx
+++ b/api_docs/kbn_react_kibana_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-common
 title: "@kbn/react-kibana-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-common']
 ---
 import kbnReactKibanaContextCommonObj from './kbn_react_kibana_context_common.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_render.mdx b/api_docs/kbn_react_kibana_context_render.mdx
index 62c70b80a207b..8fb4687c239d1 100644
--- a/api_docs/kbn_react_kibana_context_render.mdx
+++ b/api_docs/kbn_react_kibana_context_render.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-render
 title: "@kbn/react-kibana-context-render"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-render plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-render']
 ---
 import kbnReactKibanaContextRenderObj from './kbn_react_kibana_context_render.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_root.mdx b/api_docs/kbn_react_kibana_context_root.mdx
index 64506e753ceac..43ab49c010d42 100644
--- a/api_docs/kbn_react_kibana_context_root.mdx
+++ b/api_docs/kbn_react_kibana_context_root.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-root
 title: "@kbn/react-kibana-context-root"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-root plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-root']
 ---
 import kbnReactKibanaContextRootObj from './kbn_react_kibana_context_root.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_styled.mdx b/api_docs/kbn_react_kibana_context_styled.mdx
index e3bbe44bc18b6..5ace3de00d277 100644
--- a/api_docs/kbn_react_kibana_context_styled.mdx
+++ b/api_docs/kbn_react_kibana_context_styled.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-styled
 title: "@kbn/react-kibana-context-styled"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-styled plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-styled']
 ---
 import kbnReactKibanaContextStyledObj from './kbn_react_kibana_context_styled.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_context_theme.mdx b/api_docs/kbn_react_kibana_context_theme.mdx
index 7e3fa558c9c2b..985f642480e8f 100644
--- a/api_docs/kbn_react_kibana_context_theme.mdx
+++ b/api_docs/kbn_react_kibana_context_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-context-theme
 title: "@kbn/react-kibana-context-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-context-theme plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-context-theme']
 ---
 import kbnReactKibanaContextThemeObj from './kbn_react_kibana_context_theme.devdocs.json';
diff --git a/api_docs/kbn_react_kibana_mount.mdx b/api_docs/kbn_react_kibana_mount.mdx
index ad9cd22db6fc8..b827aec1f27c0 100644
--- a/api_docs/kbn_react_kibana_mount.mdx
+++ b/api_docs/kbn_react_kibana_mount.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-kibana-mount
 title: "@kbn/react-kibana-mount"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-kibana-mount plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-kibana-mount']
 ---
 import kbnReactKibanaMountObj from './kbn_react_kibana_mount.devdocs.json';
diff --git a/api_docs/kbn_repo_file_maps.mdx b/api_docs/kbn_repo_file_maps.mdx
index c2c863ac898a3..91758cbb04735 100644
--- a/api_docs/kbn_repo_file_maps.mdx
+++ b/api_docs/kbn_repo_file_maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-file-maps
 title: "@kbn/repo-file-maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-file-maps plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-file-maps']
 ---
 import kbnRepoFileMapsObj from './kbn_repo_file_maps.devdocs.json';
diff --git a/api_docs/kbn_repo_linter.mdx b/api_docs/kbn_repo_linter.mdx
index 1c83c5a7e7495..339f64c0bbc50 100644
--- a/api_docs/kbn_repo_linter.mdx
+++ b/api_docs/kbn_repo_linter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-linter
 title: "@kbn/repo-linter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-linter plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-linter']
 ---
 import kbnRepoLinterObj from './kbn_repo_linter.devdocs.json';
diff --git a/api_docs/kbn_repo_path.mdx b/api_docs/kbn_repo_path.mdx
index ef76acadbceca..2d0ea0730a03e 100644
--- a/api_docs/kbn_repo_path.mdx
+++ b/api_docs/kbn_repo_path.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-path
 title: "@kbn/repo-path"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-path plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-path']
 ---
 import kbnRepoPathObj from './kbn_repo_path.devdocs.json';
diff --git a/api_docs/kbn_repo_source_classifier.mdx b/api_docs/kbn_repo_source_classifier.mdx
index bcdb0b1bf55a3..e1c5b7b8ebaba 100644
--- a/api_docs/kbn_repo_source_classifier.mdx
+++ b/api_docs/kbn_repo_source_classifier.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-source-classifier
 title: "@kbn/repo-source-classifier"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-source-classifier plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-source-classifier']
 ---
 import kbnRepoSourceClassifierObj from './kbn_repo_source_classifier.devdocs.json';
diff --git a/api_docs/kbn_reporting_common.mdx b/api_docs/kbn_reporting_common.mdx
index f29edb9bf49ef..4ccc2b84d469b 100644
--- a/api_docs/kbn_reporting_common.mdx
+++ b/api_docs/kbn_reporting_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-reporting-common
 title: "@kbn/reporting-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/reporting-common plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/reporting-common']
 ---
 import kbnReportingCommonObj from './kbn_reporting_common.devdocs.json';
diff --git a/api_docs/kbn_resizable_layout.mdx b/api_docs/kbn_resizable_layout.mdx
index 556bbb8ca4c14..637a92a201230 100644
--- a/api_docs/kbn_resizable_layout.mdx
+++ b/api_docs/kbn_resizable_layout.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-resizable-layout
 title: "@kbn/resizable-layout"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/resizable-layout plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/resizable-layout']
 ---
 import kbnResizableLayoutObj from './kbn_resizable_layout.devdocs.json';
diff --git a/api_docs/kbn_rison.mdx b/api_docs/kbn_rison.mdx
index f1c2c6a3cb803..294ebefe9e395 100644
--- a/api_docs/kbn_rison.mdx
+++ b/api_docs/kbn_rison.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rison
 title: "@kbn/rison"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rison plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rison']
 ---
 import kbnRisonObj from './kbn_rison.devdocs.json';
diff --git a/api_docs/kbn_rrule.mdx b/api_docs/kbn_rrule.mdx
index f743a6c7a333a..6a983ac74ac8a 100644
--- a/api_docs/kbn_rrule.mdx
+++ b/api_docs/kbn_rrule.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rrule
 title: "@kbn/rrule"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rrule plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rrule']
 ---
 import kbnRruleObj from './kbn_rrule.devdocs.json';
diff --git a/api_docs/kbn_rule_data_utils.mdx b/api_docs/kbn_rule_data_utils.mdx
index 4c5c244cbaef4..073e38d1eabf2 100644
--- a/api_docs/kbn_rule_data_utils.mdx
+++ b/api_docs/kbn_rule_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rule-data-utils
 title: "@kbn/rule-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rule-data-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rule-data-utils']
 ---
 import kbnRuleDataUtilsObj from './kbn_rule_data_utils.devdocs.json';
diff --git a/api_docs/kbn_saved_objects_settings.mdx b/api_docs/kbn_saved_objects_settings.mdx
index 290cfe4a3d9d2..f842c0e6a27fd 100644
--- a/api_docs/kbn_saved_objects_settings.mdx
+++ b/api_docs/kbn_saved_objects_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-saved-objects-settings
 title: "@kbn/saved-objects-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/saved-objects-settings plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/saved-objects-settings']
 ---
 import kbnSavedObjectsSettingsObj from './kbn_saved_objects_settings.devdocs.json';
diff --git a/api_docs/kbn_search_api_panels.mdx b/api_docs/kbn_search_api_panels.mdx
index 7d0b1f461c57a..80bd8ae63c66b 100644
--- a/api_docs/kbn_search_api_panels.mdx
+++ b/api_docs/kbn_search_api_panels.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-api-panels
 title: "@kbn/search-api-panels"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-api-panels plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-api-panels']
 ---
 import kbnSearchApiPanelsObj from './kbn_search_api_panels.devdocs.json';
diff --git a/api_docs/kbn_search_connectors.devdocs.json b/api_docs/kbn_search_connectors.devdocs.json
index df053f0d16c45..8529e76a07783 100644
--- a/api_docs/kbn_search_connectors.devdocs.json
+++ b/api_docs/kbn_search_connectors.devdocs.json
@@ -11766,7 +11766,7 @@
                         "label": "ui_restrictions",
                         "description": [],
                         "signature": [
-                          "never[]"
+                          "string[]"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
@@ -13408,7 +13408,7 @@
                         "label": "ui_restrictions",
                         "description": [],
                         "signature": [
-                          "never[]"
+                          "string[]"
                         ],
                         "path": "packages/kbn-search-connectors/types/native_connectors.ts",
                         "deprecated": false,
diff --git a/api_docs/kbn_search_connectors.mdx b/api_docs/kbn_search_connectors.mdx
index 2d754ac3a65c3..839d9f822eab4 100644
--- a/api_docs/kbn_search_connectors.mdx
+++ b/api_docs/kbn_search_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-connectors
 title: "@kbn/search-connectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-connectors plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-connectors']
 ---
 import kbnSearchConnectorsObj from './kbn_search_connectors.devdocs.json';
diff --git a/api_docs/kbn_search_response_warnings.mdx b/api_docs/kbn_search_response_warnings.mdx
index c23e1ec58533f..26a2c7dbb4a1b 100644
--- a/api_docs/kbn_search_response_warnings.mdx
+++ b/api_docs/kbn_search_response_warnings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-search-response-warnings
 title: "@kbn/search-response-warnings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/search-response-warnings plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/search-response-warnings']
 ---
 import kbnSearchResponseWarningsObj from './kbn_search_response_warnings.devdocs.json';
diff --git a/api_docs/kbn_security_solution_features.mdx b/api_docs/kbn_security_solution_features.mdx
index c3a5bd57d8f47..8d4046d543b16 100644
--- a/api_docs/kbn_security_solution_features.mdx
+++ b/api_docs/kbn_security_solution_features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-features
 title: "@kbn/security-solution-features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-features plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-features']
 ---
 import kbnSecuritySolutionFeaturesObj from './kbn_security_solution_features.devdocs.json';
diff --git a/api_docs/kbn_security_solution_navigation.mdx b/api_docs/kbn_security_solution_navigation.mdx
index 691f1ba65ec66..473fc3184c24c 100644
--- a/api_docs/kbn_security_solution_navigation.mdx
+++ b/api_docs/kbn_security_solution_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-navigation
 title: "@kbn/security-solution-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-navigation plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-navigation']
 ---
 import kbnSecuritySolutionNavigationObj from './kbn_security_solution_navigation.devdocs.json';
diff --git a/api_docs/kbn_security_solution_side_nav.mdx b/api_docs/kbn_security_solution_side_nav.mdx
index 588ca64dfff18..fb1df2770b543 100644
--- a/api_docs/kbn_security_solution_side_nav.mdx
+++ b/api_docs/kbn_security_solution_side_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-side-nav
 title: "@kbn/security-solution-side-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-side-nav plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-side-nav']
 ---
 import kbnSecuritySolutionSideNavObj from './kbn_security_solution_side_nav.devdocs.json';
diff --git a/api_docs/kbn_security_solution_storybook_config.mdx b/api_docs/kbn_security_solution_storybook_config.mdx
index adfc46027aa27..58971a53d23eb 100644
--- a/api_docs/kbn_security_solution_storybook_config.mdx
+++ b/api_docs/kbn_security_solution_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-security-solution-storybook-config
 title: "@kbn/security-solution-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/security-solution-storybook-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/security-solution-storybook-config']
 ---
 import kbnSecuritySolutionStorybookConfigObj from './kbn_security_solution_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_autocomplete.mdx b/api_docs/kbn_securitysolution_autocomplete.mdx
index 76ee327c99b68..581d134caaed0 100644
--- a/api_docs/kbn_securitysolution_autocomplete.mdx
+++ b/api_docs/kbn_securitysolution_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-autocomplete
 title: "@kbn/securitysolution-autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-autocomplete plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-autocomplete']
 ---
 import kbnSecuritysolutionAutocompleteObj from './kbn_securitysolution_autocomplete.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_data_table.mdx b/api_docs/kbn_securitysolution_data_table.mdx
index dbb193fe468de..820cf495c1182 100644
--- a/api_docs/kbn_securitysolution_data_table.mdx
+++ b/api_docs/kbn_securitysolution_data_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-data-table
 title: "@kbn/securitysolution-data-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-data-table plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-data-table']
 ---
 import kbnSecuritysolutionDataTableObj from './kbn_securitysolution_data_table.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_ecs.mdx b/api_docs/kbn_securitysolution_ecs.mdx
index 76a6fe0f6f57f..da901ae0d6284 100644
--- a/api_docs/kbn_securitysolution_ecs.mdx
+++ b/api_docs/kbn_securitysolution_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-ecs
 title: "@kbn/securitysolution-ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-ecs plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-ecs']
 ---
 import kbnSecuritysolutionEcsObj from './kbn_securitysolution_ecs.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_es_utils.mdx b/api_docs/kbn_securitysolution_es_utils.mdx
index 7d0fe4828ba41..29c179a0fecaa 100644
--- a/api_docs/kbn_securitysolution_es_utils.mdx
+++ b/api_docs/kbn_securitysolution_es_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-es-utils
 title: "@kbn/securitysolution-es-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-es-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-es-utils']
 ---
 import kbnSecuritysolutionEsUtilsObj from './kbn_securitysolution_es_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_exception_list_components.mdx b/api_docs/kbn_securitysolution_exception_list_components.mdx
index d06c75f34eb45..248aad26136f0 100644
--- a/api_docs/kbn_securitysolution_exception_list_components.mdx
+++ b/api_docs/kbn_securitysolution_exception_list_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-exception-list-components
 title: "@kbn/securitysolution-exception-list-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-exception-list-components plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-exception-list-components']
 ---
 import kbnSecuritysolutionExceptionListComponentsObj from './kbn_securitysolution_exception_list_components.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_grouping.mdx b/api_docs/kbn_securitysolution_grouping.mdx
index df4bcaa7c6358..23c0ca4621bd8 100644
--- a/api_docs/kbn_securitysolution_grouping.mdx
+++ b/api_docs/kbn_securitysolution_grouping.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-grouping
 title: "@kbn/securitysolution-grouping"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-grouping plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-grouping']
 ---
 import kbnSecuritysolutionGroupingObj from './kbn_securitysolution_grouping.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_hook_utils.mdx b/api_docs/kbn_securitysolution_hook_utils.mdx
index 5c7065c3f0652..3ebd33d10ff7f 100644
--- a/api_docs/kbn_securitysolution_hook_utils.mdx
+++ b/api_docs/kbn_securitysolution_hook_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-hook-utils
 title: "@kbn/securitysolution-hook-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-hook-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-hook-utils']
 ---
 import kbnSecuritysolutionHookUtilsObj from './kbn_securitysolution_hook_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
index 17034c5f9cb7d..7d24f1cc3d852 100644
--- a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-alerting-types
 title: "@kbn/securitysolution-io-ts-alerting-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-alerting-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-alerting-types']
 ---
 import kbnSecuritysolutionIoTsAlertingTypesObj from './kbn_securitysolution_io_ts_alerting_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.mdx b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
index 9f7126511b9b6..7635c96aadd53 100644
--- a/api_docs/kbn_securitysolution_io_ts_list_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-list-types
 title: "@kbn/securitysolution-io-ts-list-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-list-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-list-types']
 ---
 import kbnSecuritysolutionIoTsListTypesObj from './kbn_securitysolution_io_ts_list_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_types.mdx b/api_docs/kbn_securitysolution_io_ts_types.mdx
index d65f324dc265a..803cb1949a31f 100644
--- a/api_docs/kbn_securitysolution_io_ts_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-types
 title: "@kbn/securitysolution-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-types']
 ---
 import kbnSecuritysolutionIoTsTypesObj from './kbn_securitysolution_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_utils.mdx b/api_docs/kbn_securitysolution_io_ts_utils.mdx
index 1812401ae1cb0..8401a1a09bee2 100644
--- a/api_docs/kbn_securitysolution_io_ts_utils.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-utils
 title: "@kbn/securitysolution-io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-utils']
 ---
 import kbnSecuritysolutionIoTsUtilsObj from './kbn_securitysolution_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_api.mdx b/api_docs/kbn_securitysolution_list_api.mdx
index 9dd34102854b4..a06b6aacb1d98 100644
--- a/api_docs/kbn_securitysolution_list_api.mdx
+++ b/api_docs/kbn_securitysolution_list_api.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-api
 title: "@kbn/securitysolution-list-api"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-api plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-api']
 ---
 import kbnSecuritysolutionListApiObj from './kbn_securitysolution_list_api.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_constants.mdx b/api_docs/kbn_securitysolution_list_constants.mdx
index 22a1f04ea6732..efa8395b4e0f9 100644
--- a/api_docs/kbn_securitysolution_list_constants.mdx
+++ b/api_docs/kbn_securitysolution_list_constants.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-constants
 title: "@kbn/securitysolution-list-constants"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-constants plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-constants']
 ---
 import kbnSecuritysolutionListConstantsObj from './kbn_securitysolution_list_constants.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_hooks.mdx b/api_docs/kbn_securitysolution_list_hooks.mdx
index f8e7c545d0509..92b3045410100 100644
--- a/api_docs/kbn_securitysolution_list_hooks.mdx
+++ b/api_docs/kbn_securitysolution_list_hooks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-hooks
 title: "@kbn/securitysolution-list-hooks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-hooks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-hooks']
 ---
 import kbnSecuritysolutionListHooksObj from './kbn_securitysolution_list_hooks.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_utils.mdx b/api_docs/kbn_securitysolution_list_utils.mdx
index a6fde3d181fc0..db461ea8e0811 100644
--- a/api_docs/kbn_securitysolution_list_utils.mdx
+++ b/api_docs/kbn_securitysolution_list_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-utils
 title: "@kbn/securitysolution-list-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-utils']
 ---
 import kbnSecuritysolutionListUtilsObj from './kbn_securitysolution_list_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_rules.mdx b/api_docs/kbn_securitysolution_rules.mdx
index 5b6422e02ce86..392d9a719ceb7 100644
--- a/api_docs/kbn_securitysolution_rules.mdx
+++ b/api_docs/kbn_securitysolution_rules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-rules
 title: "@kbn/securitysolution-rules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-rules plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-rules']
 ---
 import kbnSecuritysolutionRulesObj from './kbn_securitysolution_rules.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_t_grid.mdx b/api_docs/kbn_securitysolution_t_grid.mdx
index b91036b3309ef..0abc7d86c71e9 100644
--- a/api_docs/kbn_securitysolution_t_grid.mdx
+++ b/api_docs/kbn_securitysolution_t_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-t-grid
 title: "@kbn/securitysolution-t-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-t-grid plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-t-grid']
 ---
 import kbnSecuritysolutionTGridObj from './kbn_securitysolution_t_grid.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx
index dceae2c956a1f..a3156b9c180c7 100644
--- a/api_docs/kbn_securitysolution_utils.mdx
+++ b/api_docs/kbn_securitysolution_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-utils
 title: "@kbn/securitysolution-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-utils']
 ---
 import kbnSecuritysolutionUtilsObj from './kbn_securitysolution_utils.devdocs.json';
diff --git a/api_docs/kbn_server_http_tools.mdx b/api_docs/kbn_server_http_tools.mdx
index f0200a83cd4bc..9c99c4e6df525 100644
--- a/api_docs/kbn_server_http_tools.mdx
+++ b/api_docs/kbn_server_http_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-http-tools
 title: "@kbn/server-http-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-http-tools plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-http-tools']
 ---
 import kbnServerHttpToolsObj from './kbn_server_http_tools.devdocs.json';
diff --git a/api_docs/kbn_server_route_repository.mdx b/api_docs/kbn_server_route_repository.mdx
index 5d3f4fe785c9c..04c4106c8bdb1 100644
--- a/api_docs/kbn_server_route_repository.mdx
+++ b/api_docs/kbn_server_route_repository.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-route-repository
 title: "@kbn/server-route-repository"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-route-repository plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-route-repository']
 ---
 import kbnServerRouteRepositoryObj from './kbn_server_route_repository.devdocs.json';
diff --git a/api_docs/kbn_serverless_common_settings.mdx b/api_docs/kbn_serverless_common_settings.mdx
index 84b45e474c565..611378407b0e4 100644
--- a/api_docs/kbn_serverless_common_settings.mdx
+++ b/api_docs/kbn_serverless_common_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-common-settings
 title: "@kbn/serverless-common-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-common-settings plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-common-settings']
 ---
 import kbnServerlessCommonSettingsObj from './kbn_serverless_common_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_observability_settings.mdx b/api_docs/kbn_serverless_observability_settings.mdx
index f38b714bd8ec2..3b478084bb9ca 100644
--- a/api_docs/kbn_serverless_observability_settings.mdx
+++ b/api_docs/kbn_serverless_observability_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-observability-settings
 title: "@kbn/serverless-observability-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-observability-settings plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-observability-settings']
 ---
 import kbnServerlessObservabilitySettingsObj from './kbn_serverless_observability_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_project_switcher.mdx b/api_docs/kbn_serverless_project_switcher.mdx
index bc06e82df30a7..3946e77a11ddb 100644
--- a/api_docs/kbn_serverless_project_switcher.mdx
+++ b/api_docs/kbn_serverless_project_switcher.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-project-switcher
 title: "@kbn/serverless-project-switcher"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-project-switcher plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-project-switcher']
 ---
 import kbnServerlessProjectSwitcherObj from './kbn_serverless_project_switcher.devdocs.json';
diff --git a/api_docs/kbn_serverless_search_settings.mdx b/api_docs/kbn_serverless_search_settings.mdx
index a3dff22f7988b..5759a779a66b9 100644
--- a/api_docs/kbn_serverless_search_settings.mdx
+++ b/api_docs/kbn_serverless_search_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-search-settings
 title: "@kbn/serverless-search-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-search-settings plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-search-settings']
 ---
 import kbnServerlessSearchSettingsObj from './kbn_serverless_search_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_security_settings.mdx b/api_docs/kbn_serverless_security_settings.mdx
index 6e2eae9c6cadc..eaf113619c6f0 100644
--- a/api_docs/kbn_serverless_security_settings.mdx
+++ b/api_docs/kbn_serverless_security_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-security-settings
 title: "@kbn/serverless-security-settings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-security-settings plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-security-settings']
 ---
 import kbnServerlessSecuritySettingsObj from './kbn_serverless_security_settings.devdocs.json';
diff --git a/api_docs/kbn_serverless_storybook_config.mdx b/api_docs/kbn_serverless_storybook_config.mdx
index 1717d3a540031..a624134e71bba 100644
--- a/api_docs/kbn_serverless_storybook_config.mdx
+++ b/api_docs/kbn_serverless_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-serverless-storybook-config
 title: "@kbn/serverless-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/serverless-storybook-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/serverless-storybook-config']
 ---
 import kbnServerlessStorybookConfigObj from './kbn_serverless_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_svg.mdx b/api_docs/kbn_shared_svg.mdx
index 2bd4dd85d9954..a83cb445c1b59 100644
--- a/api_docs/kbn_shared_svg.mdx
+++ b/api_docs/kbn_shared_svg.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-svg
 title: "@kbn/shared-svg"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-svg plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-svg']
 ---
 import kbnSharedSvgObj from './kbn_shared_svg.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_solution.mdx b/api_docs/kbn_shared_ux_avatar_solution.mdx
index b64eccc7c315f..e53a2454e120a 100644
--- a/api_docs/kbn_shared_ux_avatar_solution.mdx
+++ b/api_docs/kbn_shared_ux_avatar_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-solution
 title: "@kbn/shared-ux-avatar-solution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-solution plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-solution']
 ---
 import kbnSharedUxAvatarSolutionObj from './kbn_shared_ux_avatar_solution.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
index ecde095896f1f..a0a9a70e2d492 100644
--- a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
+++ b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-user-profile-components
 title: "@kbn/shared-ux-avatar-user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-user-profile-components plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-user-profile-components']
 ---
 import kbnSharedUxAvatarUserProfileComponentsObj from './kbn_shared_ux_avatar_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
index 30a31ed84ce1a..6c0bebea78feb 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen
 title: "@kbn/shared-ux-button-exit-full-screen"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen']
 ---
 import kbnSharedUxButtonExitFullScreenObj from './kbn_shared_ux_button_exit_full_screen.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
index 07e325309bfe9..89a30741d2683 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen-mocks
 title: "@kbn/shared-ux-button-exit-full-screen-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen-mocks']
 ---
 import kbnSharedUxButtonExitFullScreenMocksObj from './kbn_shared_ux_button_exit_full_screen_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_toolbar.mdx b/api_docs/kbn_shared_ux_button_toolbar.mdx
index a82f82657435a..757cad465eca8 100644
--- a/api_docs/kbn_shared_ux_button_toolbar.mdx
+++ b/api_docs/kbn_shared_ux_button_toolbar.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-toolbar
 title: "@kbn/shared-ux-button-toolbar"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-toolbar plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-toolbar']
 ---
 import kbnSharedUxButtonToolbarObj from './kbn_shared_ux_button_toolbar.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data.mdx b/api_docs/kbn_shared_ux_card_no_data.mdx
index 44d38d6db1852..03ba2b95898aa 100644
--- a/api_docs/kbn_shared_ux_card_no_data.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data
 title: "@kbn/shared-ux-card-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data']
 ---
 import kbnSharedUxCardNoDataObj from './kbn_shared_ux_card_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
index ead25f95a88c7..16c060829c1c3 100644
--- a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data-mocks
 title: "@kbn/shared-ux-card-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data-mocks']
 ---
 import kbnSharedUxCardNoDataMocksObj from './kbn_shared_ux_card_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_chrome_navigation.mdx b/api_docs/kbn_shared_ux_chrome_navigation.mdx
index 3ac3a5e2d7c0b..604d9ade9e422 100644
--- a/api_docs/kbn_shared_ux_chrome_navigation.mdx
+++ b/api_docs/kbn_shared_ux_chrome_navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-chrome-navigation
 title: "@kbn/shared-ux-chrome-navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-chrome-navigation plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-chrome-navigation']
 ---
 import kbnSharedUxChromeNavigationObj from './kbn_shared_ux_chrome_navigation.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_context.mdx b/api_docs/kbn_shared_ux_file_context.mdx
index f642bcc0f9c5e..8f8b48bdb0b4f 100644
--- a/api_docs/kbn_shared_ux_file_context.mdx
+++ b/api_docs/kbn_shared_ux_file_context.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-context
 title: "@kbn/shared-ux-file-context"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-context plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-context']
 ---
 import kbnSharedUxFileContextObj from './kbn_shared_ux_file_context.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image.mdx b/api_docs/kbn_shared_ux_file_image.mdx
index c8114f2050fac..103c3e199e84c 100644
--- a/api_docs/kbn_shared_ux_file_image.mdx
+++ b/api_docs/kbn_shared_ux_file_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image
 title: "@kbn/shared-ux-file-image"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image']
 ---
 import kbnSharedUxFileImageObj from './kbn_shared_ux_file_image.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image_mocks.mdx b/api_docs/kbn_shared_ux_file_image_mocks.mdx
index c42e9e64f4a35..b93c4501c6567 100644
--- a/api_docs/kbn_shared_ux_file_image_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_image_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image-mocks
 title: "@kbn/shared-ux-file-image-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image-mocks']
 ---
 import kbnSharedUxFileImageMocksObj from './kbn_shared_ux_file_image_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_mocks.mdx b/api_docs/kbn_shared_ux_file_mocks.mdx
index 6581fdff9a168..e285518fbc89b 100644
--- a/api_docs/kbn_shared_ux_file_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-mocks
 title: "@kbn/shared-ux-file-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-mocks']
 ---
 import kbnSharedUxFileMocksObj from './kbn_shared_ux_file_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_picker.mdx b/api_docs/kbn_shared_ux_file_picker.mdx
index acf32839a2209..a7c692c70dd54 100644
--- a/api_docs/kbn_shared_ux_file_picker.mdx
+++ b/api_docs/kbn_shared_ux_file_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-picker
 title: "@kbn/shared-ux-file-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-picker plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-picker']
 ---
 import kbnSharedUxFilePickerObj from './kbn_shared_ux_file_picker.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_types.mdx b/api_docs/kbn_shared_ux_file_types.mdx
index b071e2b160fb2..b0f7cdcb6c223 100644
--- a/api_docs/kbn_shared_ux_file_types.mdx
+++ b/api_docs/kbn_shared_ux_file_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-types
 title: "@kbn/shared-ux-file-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-types']
 ---
 import kbnSharedUxFileTypesObj from './kbn_shared_ux_file_types.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_upload.mdx b/api_docs/kbn_shared_ux_file_upload.mdx
index e039e5689a9a6..aec87195144fb 100644
--- a/api_docs/kbn_shared_ux_file_upload.mdx
+++ b/api_docs/kbn_shared_ux_file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-upload
 title: "@kbn/shared-ux-file-upload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-upload plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-upload']
 ---
 import kbnSharedUxFileUploadObj from './kbn_shared_ux_file_upload.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_util.mdx b/api_docs/kbn_shared_ux_file_util.mdx
index da0d259722169..3aab43ab75590 100644
--- a/api_docs/kbn_shared_ux_file_util.mdx
+++ b/api_docs/kbn_shared_ux_file_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-util
 title: "@kbn/shared-ux-file-util"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-util plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-util']
 ---
 import kbnSharedUxFileUtilObj from './kbn_shared_ux_file_util.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app.mdx b/api_docs/kbn_shared_ux_link_redirect_app.mdx
index 4d4ece316f2db..cdec34b509ca8 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app
 title: "@kbn/shared-ux-link-redirect-app"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app']
 ---
 import kbnSharedUxLinkRedirectAppObj from './kbn_shared_ux_link_redirect_app.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
index 50622d414b213..dafcff0aa1e71 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app-mocks
 title: "@kbn/shared-ux-link-redirect-app-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app-mocks']
 ---
 import kbnSharedUxLinkRedirectAppMocksObj from './kbn_shared_ux_link_redirect_app_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown.mdx b/api_docs/kbn_shared_ux_markdown.mdx
index 791ec1a5912f5..438f40ee4971e 100644
--- a/api_docs/kbn_shared_ux_markdown.mdx
+++ b/api_docs/kbn_shared_ux_markdown.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown
 title: "@kbn/shared-ux-markdown"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown']
 ---
 import kbnSharedUxMarkdownObj from './kbn_shared_ux_markdown.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown_mocks.mdx b/api_docs/kbn_shared_ux_markdown_mocks.mdx
index 50243ceda1a69..cff5cc18e8622 100644
--- a/api_docs/kbn_shared_ux_markdown_mocks.mdx
+++ b/api_docs/kbn_shared_ux_markdown_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown-mocks
 title: "@kbn/shared-ux-markdown-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown-mocks']
 ---
 import kbnSharedUxMarkdownMocksObj from './kbn_shared_ux_markdown_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
index 7cafff329d8b4..bacbe59f29a7e 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data
 title: "@kbn/shared-ux-page-analytics-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data']
 ---
 import kbnSharedUxPageAnalyticsNoDataObj from './kbn_shared_ux_page_analytics_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
index 9c14e59603851..5a34147e5b2f3 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data-mocks
 title: "@kbn/shared-ux-page-analytics-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data-mocks']
 ---
 import kbnSharedUxPageAnalyticsNoDataMocksObj from './kbn_shared_ux_page_analytics_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
index 312e486e73de7..2d733c6d4424c 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data
 title: "@kbn/shared-ux-page-kibana-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data']
 ---
 import kbnSharedUxPageKibanaNoDataObj from './kbn_shared_ux_page_kibana_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
index a4f249b88185b..31bfe6ab032ca 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data-mocks
 title: "@kbn/shared-ux-page-kibana-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data-mocks']
 ---
 import kbnSharedUxPageKibanaNoDataMocksObj from './kbn_shared_ux_page_kibana_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template.mdx b/api_docs/kbn_shared_ux_page_kibana_template.mdx
index d41b2264c5e67..a928674de2ed9 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template
 title: "@kbn/shared-ux-page-kibana-template"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template']
 ---
 import kbnSharedUxPageKibanaTemplateObj from './kbn_shared_ux_page_kibana_template.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
index 77a323a3acae0..e681893812118 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template-mocks
 title: "@kbn/shared-ux-page-kibana-template-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template-mocks']
 ---
 import kbnSharedUxPageKibanaTemplateMocksObj from './kbn_shared_ux_page_kibana_template_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data.devdocs.json b/api_docs/kbn_shared_ux_page_no_data.devdocs.json
index 9aa9a10503b95..cbd11a8a06a90 100644
--- a/api_docs/kbn_shared_ux_page_no_data.devdocs.json
+++ b/api_docs/kbn_shared_ux_page_no_data.devdocs.json
@@ -27,7 +27,7 @@
         "label": "NoDataPage",
         "description": [],
         "signature": [
-          "({ solution, logo, action, docsLink, pageTitle, className, }: ",
+          "({ solution, logo, action, docsLink, pageTitle, pageDescription, className, }: ",
           "NoDataPageProps",
           ") => JSX.Element"
         ],
@@ -40,7 +40,7 @@
             "id": "def-common.NoDataPage.$1",
             "type": "Object",
             "tags": [],
-            "label": "{\n  solution,\n  logo,\n  action,\n  docsLink,\n  pageTitle,\n  className,\n}",
+            "label": "{\n  solution,\n  logo,\n  action,\n  docsLink,\n  pageTitle,\n  pageDescription,\n  className,\n}",
             "description": [],
             "signature": [
               "NoDataPageProps"
@@ -212,6 +212,22 @@
             "path": "packages/shared-ux/page/no_data/types/index.d.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/shared-ux-page-no-data",
+            "id": "def-common.NoDataPageProps.pageDescription",
+            "type": "string",
+            "tags": [],
+            "label": "pageDescription",
+            "description": [
+              "\nOptionally replace the auto-generated page description"
+            ],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/shared-ux/page/no_data/types/index.d.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/kbn_shared_ux_page_no_data.mdx b/api_docs/kbn_shared_ux_page_no_data.mdx
index a03749c4d291a..3196b3395a923 100644
--- a/api_docs/kbn_shared_ux_page_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data
 title: "@kbn/shared-ux-page-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data']
 ---
 import kbnSharedUxPageNoDataObj from './kbn_shared_ux_page_no_data.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sh
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 13 | 0 | 5 | 0 |
+| 14 | 0 | 5 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_shared_ux_page_no_data_config.mdx b/api_docs/kbn_shared_ux_page_no_data_config.mdx
index a1cb9bd43c550..163993837ea4e 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config
 title: "@kbn/shared-ux-page-no-data-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config']
 ---
 import kbnSharedUxPageNoDataConfigObj from './kbn_shared_ux_page_no_data_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
index 66bafb7b36866..6ddfaeb70e28d 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config-mocks
 title: "@kbn/shared-ux-page-no-data-config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config-mocks']
 ---
 import kbnSharedUxPageNoDataConfigMocksObj from './kbn_shared_ux_page_no_data_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
index 12c573676072c..0bcf0ba0d3d6f 100644
--- a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-mocks
 title: "@kbn/shared-ux-page-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-mocks']
 ---
 import kbnSharedUxPageNoDataMocksObj from './kbn_shared_ux_page_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_solution_nav.mdx b/api_docs/kbn_shared_ux_page_solution_nav.mdx
index acb6fed5da0b7..dd699c2a0d41d 100644
--- a/api_docs/kbn_shared_ux_page_solution_nav.mdx
+++ b/api_docs/kbn_shared_ux_page_solution_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-solution-nav
 title: "@kbn/shared-ux-page-solution-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-solution-nav plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-solution-nav']
 ---
 import kbnSharedUxPageSolutionNavObj from './kbn_shared_ux_page_solution_nav.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
index ad7e3f154d525..0ddf8229b516b 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views
 title: "@kbn/shared-ux-prompt-no-data-views"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views']
 ---
 import kbnSharedUxPromptNoDataViewsObj from './kbn_shared_ux_prompt_no_data_views.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
index 1a31f4c29b68c..fcf82ae723919 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views-mocks
 title: "@kbn/shared-ux-prompt-no-data-views-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views-mocks']
 ---
 import kbnSharedUxPromptNoDataViewsMocksObj from './kbn_shared_ux_prompt_no_data_views_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_not_found.mdx b/api_docs/kbn_shared_ux_prompt_not_found.mdx
index 8be35ce8e8d36..8115cd2a7b40d 100644
--- a/api_docs/kbn_shared_ux_prompt_not_found.mdx
+++ b/api_docs/kbn_shared_ux_prompt_not_found.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-not-found
 title: "@kbn/shared-ux-prompt-not-found"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-not-found plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-not-found']
 ---
 import kbnSharedUxPromptNotFoundObj from './kbn_shared_ux_prompt_not_found.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router.mdx b/api_docs/kbn_shared_ux_router.mdx
index 6805131f657fc..4fe95f038ad9d 100644
--- a/api_docs/kbn_shared_ux_router.mdx
+++ b/api_docs/kbn_shared_ux_router.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router
 title: "@kbn/shared-ux-router"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router']
 ---
 import kbnSharedUxRouterObj from './kbn_shared_ux_router.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router_mocks.mdx b/api_docs/kbn_shared_ux_router_mocks.mdx
index 96f78ab04d97c..96ac0cea196ae 100644
--- a/api_docs/kbn_shared_ux_router_mocks.mdx
+++ b/api_docs/kbn_shared_ux_router_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router-mocks
 title: "@kbn/shared-ux-router-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router-mocks plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router-mocks']
 ---
 import kbnSharedUxRouterMocksObj from './kbn_shared_ux_router_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_config.mdx b/api_docs/kbn_shared_ux_storybook_config.mdx
index 321893a4c6f4a..85308bd5904e2 100644
--- a/api_docs/kbn_shared_ux_storybook_config.mdx
+++ b/api_docs/kbn_shared_ux_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-config
 title: "@kbn/shared-ux-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-config']
 ---
 import kbnSharedUxStorybookConfigObj from './kbn_shared_ux_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_mock.mdx b/api_docs/kbn_shared_ux_storybook_mock.mdx
index e4d9b70139bef..3e1b629f53858 100644
--- a/api_docs/kbn_shared_ux_storybook_mock.mdx
+++ b/api_docs/kbn_shared_ux_storybook_mock.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-mock
 title: "@kbn/shared-ux-storybook-mock"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-mock plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-mock']
 ---
 import kbnSharedUxStorybookMockObj from './kbn_shared_ux_storybook_mock.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_utility.mdx b/api_docs/kbn_shared_ux_utility.mdx
index 5de8387bb9180..130e614cef7d8 100644
--- a/api_docs/kbn_shared_ux_utility.mdx
+++ b/api_docs/kbn_shared_ux_utility.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-utility
 title: "@kbn/shared-ux-utility"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-utility plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-utility']
 ---
 import kbnSharedUxUtilityObj from './kbn_shared_ux_utility.devdocs.json';
diff --git a/api_docs/kbn_slo_schema.devdocs.json b/api_docs/kbn_slo_schema.devdocs.json
index 84ef4fa26f48d..dd2e3dbef0a5a 100644
--- a/api_docs/kbn_slo_schema.devdocs.json
+++ b/api_docs/kbn_slo_schema.devdocs.json
@@ -482,7 +482,7 @@
         "label": "CreateSLOInput",
         "description": [],
         "signature": [
-          "{ name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; } & { id?: string | undefined; settings?: { syncDelay?: string | undefined; frequency?: string | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }"
+          "{ name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; } & { id?: string | undefined; settings?: { syncDelay?: string | undefined; frequency?: string | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -497,7 +497,7 @@
         "label": "CreateSLOParams",
         "description": [],
         "signature": [
-          "{ name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: ",
+          "{ name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: ",
           {
             "pluginId": "@kbn/slo-schema",
             "scope": "common",
@@ -631,7 +631,7 @@
           "\nThe response type for /internal/observability/slo/_definitions\n"
         ],
         "signature": [
-          "({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]"
+          "({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -661,7 +661,7 @@
         "label": "FindSLOResponse",
         "description": [],
         "signature": [
-          "{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }"
+          "{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -676,7 +676,7 @@
         "label": "GetPreviewDataParams",
         "description": [],
         "signature": [
-          "{ indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; }"
+          "{ indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -751,7 +751,7 @@
         "label": "GetSLOResponse",
         "description": [],
         "signature": [
-          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }"
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -796,7 +796,7 @@
         "label": "Indicator",
         "description": [],
         "signature": [
-          "{ type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }"
+          "{ type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -811,7 +811,7 @@
         "label": "IndicatorType",
         "description": [],
         "signature": [
-          "\"sli.apm.transactionDuration\" | \"sli.apm.transactionErrorRate\" | \"sli.kql.custom\" | \"sli.metric.custom\" | \"sli.histogram.custom\""
+          "\"sli.apm.transactionDuration\" | \"sli.apm.transactionErrorRate\" | \"sli.kql.custom\" | \"sli.metric.custom\" | \"sli.metric.timeslice\" | \"sli.histogram.custom\""
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -871,7 +871,7 @@
         "label": "SLOResponse",
         "description": [],
         "signature": [
-          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }"
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -886,7 +886,67 @@
         "label": "SLOWithSummaryResponse",
         "description": [],
         "signature": [
-          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }"
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.TimesclieMetricPercentileMetric",
+        "type": "Type",
+        "tags": [],
+        "label": "TimesclieMetricPercentileMetric",
+        "description": [],
+        "signature": [
+          "{ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.TimesliceMetricBasicMetricWithField",
+        "type": "Type",
+        "tags": [],
+        "label": "TimesliceMetricBasicMetricWithField",
+        "description": [],
+        "signature": [
+          "{ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.TimesliceMetricDocCountMetric",
+        "type": "Type",
+        "tags": [],
+        "label": "TimesliceMetricDocCountMetric",
+        "description": [],
+        "signature": [
+          "{ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.TimesliceMetricIndicator",
+        "type": "Type",
+        "tags": [],
+        "label": "TimesliceMetricIndicator",
+        "description": [],
+        "signature": [
+          "{ type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -916,7 +976,7 @@
         "label": "UpdateSLOInput",
         "description": [],
         "signature": [
-          "{ name?: string | undefined; description?: string | undefined; indicator?: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; } | undefined; timeWindow?: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; } | undefined; budgetingMethod?: \"occurrences\" | \"timeslices\" | undefined; objective?: ({ target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }) | undefined; settings?: { syncDelay?: string | undefined; frequency?: string | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }"
+          "{ name?: string | undefined; description?: string | undefined; indicator?: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; } | undefined; timeWindow?: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; } | undefined; budgetingMethod?: \"occurrences\" | \"timeslices\" | undefined; objective?: ({ target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }) | undefined; settings?: { syncDelay?: string | undefined; frequency?: string | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -931,7 +991,7 @@
         "label": "UpdateSLOParams",
         "description": [],
         "signature": [
-          "{ name?: string | undefined; description?: string | undefined; indicator?: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; } | undefined; timeWindow?: { duration: ",
+          "{ name?: string | undefined; description?: string | undefined; indicator?: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; } | undefined; timeWindow?: { duration: ",
           {
             "pluginId": "@kbn/slo-schema",
             "scope": "common",
@@ -986,7 +1046,7 @@
         "label": "UpdateSLOResponse",
         "description": [],
         "signature": [
-          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }"
+          "{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts",
         "deprecated": false,
@@ -1394,6 +1454,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -1990,6 +2120,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -2402,6 +2602,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -2782,25 +3052,29 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
-          "<\"sli.histogram.custom\">; params: ",
+          "<\"sli.metric.timeslice\">; params: ",
           "IntersectionC",
           "<[",
           "TypeC",
           "<{ index: ",
           "StringC",
-          "; timestampField: ",
-          "StringC",
-          "; good: ",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
           "UnionC",
           "<[",
           "IntersectionC",
           "<[",
           "TypeC",
-          "<{ field: ",
+          "<{ name: ",
           "StringC",
           "; aggregation: ",
-          "LiteralC",
-          "<\"value_count\">; }>, ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
           "PartialC",
           "<{ filter: ",
           "StringC",
@@ -2808,25 +3082,91 @@
           "IntersectionC",
           "<[",
           "TypeC",
-          "<{ field: ",
+          "<{ name: ",
           "StringC",
           "; aggregation: ",
           "LiteralC",
-          "<\"range\">; from: ",
-          "NumberC",
-          "; to: ",
-          "NumberC",
-          "; }>, ",
+          "<\"doc_count\">; }>, ",
           "PartialC",
           "<{ filter: ",
           "StringC",
-          "; }>]>]>; total: ",
-          "UnionC",
-          "<[",
+          "; }>]>, ",
           "IntersectionC",
           "<[",
           "TypeC",
-          "<{ field: ",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.histogram.custom\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; timestampField: ",
+          "StringC",
+          "; good: ",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ field: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"value_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ field: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"range\">; from: ",
+          "NumberC",
+          "; to: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>; total: ",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ field: ",
           "StringC",
           "; aggregation: ",
           "LiteralC",
@@ -3206,6 +3546,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -3758,6 +4168,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -3872,6 +4352,8 @@
           "LiteralC",
           "<\"sli.metric.custom\">, ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">, ",
+          "LiteralC",
           "<\"sli.histogram.custom\">]>"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
@@ -4413,6 +4895,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -4771,21 +5323,91 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
-          "<\"sli.histogram.custom\">; params: ",
+          "<\"sli.metric.timeslice\">; params: ",
           "IntersectionC",
           "<[",
           "TypeC",
           "<{ index: ",
           "StringC",
-          "; timestampField: ",
-          "StringC",
-          "; good: ",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
           "UnionC",
           "<[",
           "IntersectionC",
           "<[",
           "TypeC",
-          "<{ field: ",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.histogram.custom\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; timestampField: ",
+          "StringC",
+          "; good: ",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ field: ",
           "StringC",
           "; aggregation: ",
           "LiteralC",
@@ -5125,6 +5747,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -5511,6 +6203,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -5812,58 +6574,358 @@
       },
       {
         "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.timeslicesBudgetingMethodSchema",
+        "id": "def-common.timesliceMetricBasicMetricWithField",
         "type": "Object",
         "tags": [],
-        "label": "timeslicesBudgetingMethodSchema",
+        "label": "timesliceMetricBasicMetricWithField",
         "description": [],
         "signature": [
-          "LiteralC",
-          "<\"timeslices\">"
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>"
         ],
-        "path": "x-pack/packages/kbn-slo-schema/src/schema/slo.ts",
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
       },
       {
         "parentPluginId": "@kbn/slo-schema",
-        "id": "def-common.timeWindowSchema",
+        "id": "def-common.timesliceMetricComparatorMapping",
         "type": "Object",
         "tags": [],
-        "label": "timeWindowSchema",
+        "label": "timesliceMetricComparatorMapping",
         "description": [],
-        "signature": [
-          "UnionC",
-          "<[",
-          "TypeC",
-          "<{ duration: ",
-          "Type",
-          "<",
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
           {
-            "pluginId": "@kbn/slo-schema",
-            "scope": "common",
-            "docId": "kibKbnSloSchemaPluginApi",
-            "section": "def-common.Duration",
-            "text": "Duration"
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.timesliceMetricComparatorMapping.GT",
+            "type": "string",
+            "tags": [],
+            "label": "GT",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+            "deprecated": false,
+            "trackAdoption": false
           },
-          ", string, unknown>; type: ",
-          "LiteralC",
-          "<\"rolling\">; }>, ",
-          "TypeC",
-          "<{ duration: ",
-          "Type",
-          "<",
           {
-            "pluginId": "@kbn/slo-schema",
-            "scope": "common",
-            "docId": "kibKbnSloSchemaPluginApi",
-            "section": "def-common.Duration",
-            "text": "Duration"
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.timesliceMetricComparatorMapping.GTE",
+            "type": "string",
+            "tags": [],
+            "label": "GTE",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+            "deprecated": false,
+            "trackAdoption": false
           },
-          ", string, unknown>; type: ",
-          "LiteralC",
-          "<\"calendarAligned\">; }>]>"
+          {
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.timesliceMetricComparatorMapping.LT",
+            "type": "string",
+            "tags": [],
+            "label": "LT",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/slo-schema",
+            "id": "def-common.timesliceMetricComparatorMapping.LTE",
+            "type": "string",
+            "tags": [],
+            "label": "LTE",
+            "description": [],
+            "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.timesliceMetricDocCountMetric",
+        "type": "Object",
+        "tags": [],
+        "label": "timesliceMetricDocCountMetric",
+        "description": [],
+        "signature": [
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.timesliceMetricIndicatorSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "timesliceMetricIndicatorSchema",
+        "description": [],
+        "signature": [
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.timesliceMetricIndicatorTypeSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "timesliceMetricIndicatorTypeSchema",
+        "description": [],
+        "signature": [
+          "LiteralC",
+          "<\"sli.metric.timeslice\">"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.timesliceMetricMetricDef",
+        "type": "Object",
+        "tags": [],
+        "label": "timesliceMetricMetricDef",
+        "description": [],
+        "signature": [
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.timesliceMetricPercentileMetric",
+        "type": "Object",
+        "tags": [],
+        "label": "timesliceMetricPercentileMetric",
+        "description": [],
+        "signature": [
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/indicators.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.timeslicesBudgetingMethodSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "timeslicesBudgetingMethodSchema",
+        "description": [],
+        "signature": [
+          "LiteralC",
+          "<\"timeslices\">"
+        ],
+        "path": "x-pack/packages/kbn-slo-schema/src/schema/slo.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/slo-schema",
+        "id": "def-common.timeWindowSchema",
+        "type": "Object",
+        "tags": [],
+        "label": "timeWindowSchema",
+        "description": [],
+        "signature": [
+          "UnionC",
+          "<[",
+          "TypeC",
+          "<{ duration: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; type: ",
+          "LiteralC",
+          "<\"rolling\">; }>, ",
+          "TypeC",
+          "<{ duration: ",
+          "Type",
+          "<",
+          {
+            "pluginId": "@kbn/slo-schema",
+            "scope": "common",
+            "docId": "kibKbnSloSchemaPluginApi",
+            "section": "def-common.Duration",
+            "text": "Duration"
+          },
+          ", string, unknown>; type: ",
+          "LiteralC",
+          "<\"calendarAligned\">; }>]>"
         ],
         "path": "x-pack/packages/kbn-slo-schema/src/schema/time_window.ts",
         "deprecated": false,
@@ -6069,6 +7131,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -6413,6 +7545,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
diff --git a/api_docs/kbn_slo_schema.mdx b/api_docs/kbn_slo_schema.mdx
index e33b5fc5d55e9..0b94a1c7f0c52 100644
--- a/api_docs/kbn_slo_schema.mdx
+++ b/api_docs/kbn_slo_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-slo-schema
 title: "@kbn/slo-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/slo-schema plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/slo-schema']
 ---
 import kbnSloSchemaObj from './kbn_slo_schema.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/actionable-observability](https://github.com/orgs/elastic/team
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 114 | 0 | 111 | 0 |
+| 129 | 0 | 126 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_some_dev_log.mdx b/api_docs/kbn_some_dev_log.mdx
index 601f701aba6de..d3fc2ece66b32 100644
--- a/api_docs/kbn_some_dev_log.mdx
+++ b/api_docs/kbn_some_dev_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-some-dev-log
 title: "@kbn/some-dev-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/some-dev-log plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/some-dev-log']
 ---
 import kbnSomeDevLogObj from './kbn_some_dev_log.devdocs.json';
diff --git a/api_docs/kbn_std.mdx b/api_docs/kbn_std.mdx
index 360f59651ac4e..bccf9dc1abe80 100644
--- a/api_docs/kbn_std.mdx
+++ b/api_docs/kbn_std.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-std
 title: "@kbn/std"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/std plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/std']
 ---
 import kbnStdObj from './kbn_std.devdocs.json';
diff --git a/api_docs/kbn_stdio_dev_helpers.mdx b/api_docs/kbn_stdio_dev_helpers.mdx
index f80241b8a7b1b..992c81515ae93 100644
--- a/api_docs/kbn_stdio_dev_helpers.mdx
+++ b/api_docs/kbn_stdio_dev_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-stdio-dev-helpers
 title: "@kbn/stdio-dev-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/stdio-dev-helpers plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/stdio-dev-helpers']
 ---
 import kbnStdioDevHelpersObj from './kbn_stdio_dev_helpers.devdocs.json';
diff --git a/api_docs/kbn_storybook.mdx b/api_docs/kbn_storybook.mdx
index 60534bcecd03c..264d5c829f1d3 100644
--- a/api_docs/kbn_storybook.mdx
+++ b/api_docs/kbn_storybook.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-storybook
 title: "@kbn/storybook"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/storybook plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/storybook']
 ---
 import kbnStorybookObj from './kbn_storybook.devdocs.json';
diff --git a/api_docs/kbn_subscription_tracking.mdx b/api_docs/kbn_subscription_tracking.mdx
index b22526243451f..4867e5b701a0a 100644
--- a/api_docs/kbn_subscription_tracking.mdx
+++ b/api_docs/kbn_subscription_tracking.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-subscription-tracking
 title: "@kbn/subscription-tracking"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/subscription-tracking plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/subscription-tracking']
 ---
 import kbnSubscriptionTrackingObj from './kbn_subscription_tracking.devdocs.json';
diff --git a/api_docs/kbn_telemetry_tools.mdx b/api_docs/kbn_telemetry_tools.mdx
index e72a754c57868..4529c425422d5 100644
--- a/api_docs/kbn_telemetry_tools.mdx
+++ b/api_docs/kbn_telemetry_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-telemetry-tools
 title: "@kbn/telemetry-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/telemetry-tools plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/telemetry-tools']
 ---
 import kbnTelemetryToolsObj from './kbn_telemetry_tools.devdocs.json';
diff --git a/api_docs/kbn_test.mdx b/api_docs/kbn_test.mdx
index 763603520c30a..6e7f593ae72e8 100644
--- a/api_docs/kbn_test.mdx
+++ b/api_docs/kbn_test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test
 title: "@kbn/test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test']
 ---
 import kbnTestObj from './kbn_test.devdocs.json';
diff --git a/api_docs/kbn_test_jest_helpers.mdx b/api_docs/kbn_test_jest_helpers.mdx
index 6a4bb94b31940..6e6a45e378cc4 100644
--- a/api_docs/kbn_test_jest_helpers.mdx
+++ b/api_docs/kbn_test_jest_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-jest-helpers
 title: "@kbn/test-jest-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-jest-helpers plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-jest-helpers']
 ---
 import kbnTestJestHelpersObj from './kbn_test_jest_helpers.devdocs.json';
diff --git a/api_docs/kbn_test_subj_selector.mdx b/api_docs/kbn_test_subj_selector.mdx
index b305e38ed3e9f..17f6b1cf9dd8a 100644
--- a/api_docs/kbn_test_subj_selector.mdx
+++ b/api_docs/kbn_test_subj_selector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-subj-selector
 title: "@kbn/test-subj-selector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-subj-selector plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-subj-selector']
 ---
 import kbnTestSubjSelectorObj from './kbn_test_subj_selector.devdocs.json';
diff --git a/api_docs/kbn_text_based_editor.mdx b/api_docs/kbn_text_based_editor.mdx
index 998985e2fe1e1..e9a094a1089db 100644
--- a/api_docs/kbn_text_based_editor.mdx
+++ b/api_docs/kbn_text_based_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-text-based-editor
 title: "@kbn/text-based-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/text-based-editor plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/text-based-editor']
 ---
 import kbnTextBasedEditorObj from './kbn_text_based_editor.devdocs.json';
diff --git a/api_docs/kbn_tooling_log.mdx b/api_docs/kbn_tooling_log.mdx
index e498dc4f106da..4e271207f51fb 100644
--- a/api_docs/kbn_tooling_log.mdx
+++ b/api_docs/kbn_tooling_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-tooling-log
 title: "@kbn/tooling-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/tooling-log plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/tooling-log']
 ---
 import kbnToolingLogObj from './kbn_tooling_log.devdocs.json';
diff --git a/api_docs/kbn_ts_projects.mdx b/api_docs/kbn_ts_projects.mdx
index 982d3770d9518..2978d71f6f721 100644
--- a/api_docs/kbn_ts_projects.mdx
+++ b/api_docs/kbn_ts_projects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ts-projects
 title: "@kbn/ts-projects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ts-projects plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ts-projects']
 ---
 import kbnTsProjectsObj from './kbn_ts_projects.devdocs.json';
diff --git a/api_docs/kbn_typed_react_router_config.mdx b/api_docs/kbn_typed_react_router_config.mdx
index 3deb9c6c6f737..4992931859832 100644
--- a/api_docs/kbn_typed_react_router_config.mdx
+++ b/api_docs/kbn_typed_react_router_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-typed-react-router-config
 title: "@kbn/typed-react-router-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/typed-react-router-config plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/typed-react-router-config']
 ---
 import kbnTypedReactRouterConfigObj from './kbn_typed_react_router_config.devdocs.json';
diff --git a/api_docs/kbn_ui_actions_browser.mdx b/api_docs/kbn_ui_actions_browser.mdx
index 1a5640c3cf5a2..95a2a02f71700 100644
--- a/api_docs/kbn_ui_actions_browser.mdx
+++ b/api_docs/kbn_ui_actions_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-actions-browser
 title: "@kbn/ui-actions-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-actions-browser plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-actions-browser']
 ---
 import kbnUiActionsBrowserObj from './kbn_ui_actions_browser.devdocs.json';
diff --git a/api_docs/kbn_ui_shared_deps_src.mdx b/api_docs/kbn_ui_shared_deps_src.mdx
index 84387ccfad6ca..0589e914d5e0d 100644
--- a/api_docs/kbn_ui_shared_deps_src.mdx
+++ b/api_docs/kbn_ui_shared_deps_src.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-shared-deps-src
 title: "@kbn/ui-shared-deps-src"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-shared-deps-src plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-shared-deps-src']
 ---
 import kbnUiSharedDepsSrcObj from './kbn_ui_shared_deps_src.devdocs.json';
diff --git a/api_docs/kbn_ui_theme.mdx b/api_docs/kbn_ui_theme.mdx
index d2ae1c8cbd95e..84ef16967e4f0 100644
--- a/api_docs/kbn_ui_theme.mdx
+++ b/api_docs/kbn_ui_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-theme
 title: "@kbn/ui-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-theme plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-theme']
 ---
 import kbnUiThemeObj from './kbn_ui_theme.devdocs.json';
diff --git a/api_docs/kbn_unified_data_table.mdx b/api_docs/kbn_unified_data_table.mdx
index d339227876a37..aca3f99a69d6c 100644
--- a/api_docs/kbn_unified_data_table.mdx
+++ b/api_docs/kbn_unified_data_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-data-table
 title: "@kbn/unified-data-table"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-data-table plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-data-table']
 ---
 import kbnUnifiedDataTableObj from './kbn_unified_data_table.devdocs.json';
diff --git a/api_docs/kbn_unified_doc_viewer.mdx b/api_docs/kbn_unified_doc_viewer.mdx
index 8d9953d71987b..c194966799af7 100644
--- a/api_docs/kbn_unified_doc_viewer.mdx
+++ b/api_docs/kbn_unified_doc_viewer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-doc-viewer
 title: "@kbn/unified-doc-viewer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-doc-viewer plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-doc-viewer']
 ---
 import kbnUnifiedDocViewerObj from './kbn_unified_doc_viewer.devdocs.json';
diff --git a/api_docs/kbn_unified_field_list.mdx b/api_docs/kbn_unified_field_list.mdx
index 0f353e7b39a1f..046f2b9b53f0a 100644
--- a/api_docs/kbn_unified_field_list.mdx
+++ b/api_docs/kbn_unified_field_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-unified-field-list
 title: "@kbn/unified-field-list"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/unified-field-list plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/unified-field-list']
 ---
 import kbnUnifiedFieldListObj from './kbn_unified_field_list.devdocs.json';
diff --git a/api_docs/kbn_url_state.mdx b/api_docs/kbn_url_state.mdx
index 7ee704edbc2a9..59f1bcf55e22a 100644
--- a/api_docs/kbn_url_state.mdx
+++ b/api_docs/kbn_url_state.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-url-state
 title: "@kbn/url-state"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/url-state plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/url-state']
 ---
 import kbnUrlStateObj from './kbn_url_state.devdocs.json';
diff --git a/api_docs/kbn_use_tracked_promise.mdx b/api_docs/kbn_use_tracked_promise.mdx
index 113aa81acd685..3b9f8a91d0cdd 100644
--- a/api_docs/kbn_use_tracked_promise.mdx
+++ b/api_docs/kbn_use_tracked_promise.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-use-tracked-promise
 title: "@kbn/use-tracked-promise"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/use-tracked-promise plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/use-tracked-promise']
 ---
 import kbnUseTrackedPromiseObj from './kbn_use_tracked_promise.devdocs.json';
diff --git a/api_docs/kbn_user_profile_components.mdx b/api_docs/kbn_user_profile_components.mdx
index 6f321aa90f9cb..de54339151c02 100644
--- a/api_docs/kbn_user_profile_components.mdx
+++ b/api_docs/kbn_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-user-profile-components
 title: "@kbn/user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/user-profile-components plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/user-profile-components']
 ---
 import kbnUserProfileComponentsObj from './kbn_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_utility_types.mdx b/api_docs/kbn_utility_types.mdx
index d394b4e205e93..15497829701cd 100644
--- a/api_docs/kbn_utility_types.mdx
+++ b/api_docs/kbn_utility_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types
 title: "@kbn/utility-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types']
 ---
 import kbnUtilityTypesObj from './kbn_utility_types.devdocs.json';
diff --git a/api_docs/kbn_utility_types_jest.mdx b/api_docs/kbn_utility_types_jest.mdx
index 078bc8f871343..bf8b0324e8777 100644
--- a/api_docs/kbn_utility_types_jest.mdx
+++ b/api_docs/kbn_utility_types_jest.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types-jest
 title: "@kbn/utility-types-jest"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types-jest plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types-jest']
 ---
 import kbnUtilityTypesJestObj from './kbn_utility_types_jest.devdocs.json';
diff --git a/api_docs/kbn_utils.mdx b/api_docs/kbn_utils.mdx
index 6a758510c9549..aa2a7cf43f270 100644
--- a/api_docs/kbn_utils.mdx
+++ b/api_docs/kbn_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utils
 title: "@kbn/utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utils']
 ---
 import kbnUtilsObj from './kbn_utils.devdocs.json';
diff --git a/api_docs/kbn_visualization_ui_components.mdx b/api_docs/kbn_visualization_ui_components.mdx
index a5797f2ebbb34..4142559044ae1 100644
--- a/api_docs/kbn_visualization_ui_components.mdx
+++ b/api_docs/kbn_visualization_ui_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-visualization-ui-components
 title: "@kbn/visualization-ui-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/visualization-ui-components plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/visualization-ui-components']
 ---
 import kbnVisualizationUiComponentsObj from './kbn_visualization_ui_components.devdocs.json';
diff --git a/api_docs/kbn_xstate_utils.mdx b/api_docs/kbn_xstate_utils.mdx
index 39f61d949e2a3..6df7e6d4520c2 100644
--- a/api_docs/kbn_xstate_utils.mdx
+++ b/api_docs/kbn_xstate_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-xstate-utils
 title: "@kbn/xstate-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/xstate-utils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/xstate-utils']
 ---
 import kbnXstateUtilsObj from './kbn_xstate_utils.devdocs.json';
diff --git a/api_docs/kbn_yarn_lock_validator.mdx b/api_docs/kbn_yarn_lock_validator.mdx
index 0b4c4b9c7abc4..b4d528ec71f66 100644
--- a/api_docs/kbn_yarn_lock_validator.mdx
+++ b/api_docs/kbn_yarn_lock_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-yarn-lock-validator
 title: "@kbn/yarn-lock-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/yarn-lock-validator plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/yarn-lock-validator']
 ---
 import kbnYarnLockValidatorObj from './kbn_yarn_lock_validator.devdocs.json';
diff --git a/api_docs/kibana_overview.mdx b/api_docs/kibana_overview.mdx
index 990bb033de9fa..f1a1342e4dec1 100644
--- a/api_docs/kibana_overview.mdx
+++ b/api_docs/kibana_overview.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaOverview
 title: "kibanaOverview"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaOverview plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaOverview']
 ---
 import kibanaOverviewObj from './kibana_overview.devdocs.json';
diff --git a/api_docs/kibana_react.mdx b/api_docs/kibana_react.mdx
index 9f9f1f16ad307..356e6885ddb0e 100644
--- a/api_docs/kibana_react.mdx
+++ b/api_docs/kibana_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaReact
 title: "kibanaReact"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaReact plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaReact']
 ---
 import kibanaReactObj from './kibana_react.devdocs.json';
diff --git a/api_docs/kibana_utils.mdx b/api_docs/kibana_utils.mdx
index d4c39c3ce8559..00d4e387d403b 100644
--- a/api_docs/kibana_utils.mdx
+++ b/api_docs/kibana_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaUtils
 title: "kibanaUtils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaUtils plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaUtils']
 ---
 import kibanaUtilsObj from './kibana_utils.devdocs.json';
diff --git a/api_docs/kubernetes_security.mdx b/api_docs/kubernetes_security.mdx
index 5e212795a610e..9ec5362ee8f21 100644
--- a/api_docs/kubernetes_security.mdx
+++ b/api_docs/kubernetes_security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kubernetesSecurity
 title: "kubernetesSecurity"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kubernetesSecurity plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kubernetesSecurity']
 ---
 import kubernetesSecurityObj from './kubernetes_security.devdocs.json';
diff --git a/api_docs/lens.mdx b/api_docs/lens.mdx
index e6e13076d33d9..b710772b962fa 100644
--- a/api_docs/lens.mdx
+++ b/api_docs/lens.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lens
 title: "lens"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lens plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lens']
 ---
 import lensObj from './lens.devdocs.json';
diff --git a/api_docs/license_api_guard.mdx b/api_docs/license_api_guard.mdx
index f9c93353a4bda..8bc9e9b56019b 100644
--- a/api_docs/license_api_guard.mdx
+++ b/api_docs/license_api_guard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseApiGuard
 title: "licenseApiGuard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseApiGuard plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseApiGuard']
 ---
 import licenseApiGuardObj from './license_api_guard.devdocs.json';
diff --git a/api_docs/license_management.mdx b/api_docs/license_management.mdx
index 85a8d00409ba3..6db00695ad97b 100644
--- a/api_docs/license_management.mdx
+++ b/api_docs/license_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseManagement
 title: "licenseManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseManagement plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseManagement']
 ---
 import licenseManagementObj from './license_management.devdocs.json';
diff --git a/api_docs/licensing.mdx b/api_docs/licensing.mdx
index bcb050aa867b7..d52f843a6a51e 100644
--- a/api_docs/licensing.mdx
+++ b/api_docs/licensing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licensing
 title: "licensing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licensing plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licensing']
 ---
 import licensingObj from './licensing.devdocs.json';
diff --git a/api_docs/links.mdx b/api_docs/links.mdx
index d77ce47daed1d..aa096e4204efe 100644
--- a/api_docs/links.mdx
+++ b/api_docs/links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/links
 title: "links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the links plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'links']
 ---
 import linksObj from './links.devdocs.json';
diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx
index 5ecf86ee60aa6..057bc70d4f68c 100644
--- a/api_docs/lists.mdx
+++ b/api_docs/lists.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lists
 title: "lists"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lists plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lists']
 ---
 import listsObj from './lists.devdocs.json';
diff --git a/api_docs/log_explorer.mdx b/api_docs/log_explorer.mdx
index 9d6d41599a2cc..ead2caa9109eb 100644
--- a/api_docs/log_explorer.mdx
+++ b/api_docs/log_explorer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/logExplorer
 title: "logExplorer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the logExplorer plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'logExplorer']
 ---
 import logExplorerObj from './log_explorer.devdocs.json';
diff --git a/api_docs/logs_shared.mdx b/api_docs/logs_shared.mdx
index 36bdcdaa4fbce..b97b80a200796 100644
--- a/api_docs/logs_shared.mdx
+++ b/api_docs/logs_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/logsShared
 title: "logsShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the logsShared plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'logsShared']
 ---
 import logsSharedObj from './logs_shared.devdocs.json';
diff --git a/api_docs/management.mdx b/api_docs/management.mdx
index 1822e5225afbd..ed18839c0f9a5 100644
--- a/api_docs/management.mdx
+++ b/api_docs/management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/management
 title: "management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the management plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'management']
 ---
 import managementObj from './management.devdocs.json';
diff --git a/api_docs/maps.mdx b/api_docs/maps.mdx
index 2f4bccc5d6051..1c82b46486312 100644
--- a/api_docs/maps.mdx
+++ b/api_docs/maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/maps
 title: "maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the maps plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'maps']
 ---
 import mapsObj from './maps.devdocs.json';
diff --git a/api_docs/maps_ems.devdocs.json b/api_docs/maps_ems.devdocs.json
index b1ca9cb4581c9..697a5dd4c1c2f 100644
--- a/api_docs/maps_ems.devdocs.json
+++ b/api_docs/maps_ems.devdocs.json
@@ -1021,6 +1021,21 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "mapsEms",
+        "id": "def-common.DEFAULT_EMS_REST_VERSION",
+        "type": "string",
+        "tags": [],
+        "label": "DEFAULT_EMS_REST_VERSION",
+        "description": [],
+        "signature": [
+          "\"2023-10-31\""
+        ],
+        "path": "src/plugins/maps_ems/common/ems_defaults.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "mapsEms",
         "id": "def-common.DEFAULT_EMS_ROADMAP_DESATURATED_ID",
diff --git a/api_docs/maps_ems.mdx b/api_docs/maps_ems.mdx
index 1b36ada3381a7..c5244b8945b65 100644
--- a/api_docs/maps_ems.mdx
+++ b/api_docs/maps_ems.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/mapsEms
 title: "mapsEms"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the mapsEms plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mapsEms']
 ---
 import mapsEmsObj from './maps_ems.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis)
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 67 | 0 | 67 | 0 |
+| 68 | 0 | 68 | 0 |
 
 ## Client
 
diff --git a/api_docs/metrics_data_access.mdx b/api_docs/metrics_data_access.mdx
index 7842beec9380a..f5aba53735bad 100644
--- a/api_docs/metrics_data_access.mdx
+++ b/api_docs/metrics_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/metricsDataAccess
 title: "metricsDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the metricsDataAccess plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'metricsDataAccess']
 ---
 import metricsDataAccessObj from './metrics_data_access.devdocs.json';
diff --git a/api_docs/ml.mdx b/api_docs/ml.mdx
index b7909b8724407..3556b058709f8 100644
--- a/api_docs/ml.mdx
+++ b/api_docs/ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ml
 title: "ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ml plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ml']
 ---
 import mlObj from './ml.devdocs.json';
diff --git a/api_docs/monitoring.mdx b/api_docs/monitoring.mdx
index 84de0f543d4c0..9a32b39fcbf45 100644
--- a/api_docs/monitoring.mdx
+++ b/api_docs/monitoring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoring
 title: "monitoring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoring plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoring']
 ---
 import monitoringObj from './monitoring.devdocs.json';
diff --git a/api_docs/monitoring_collection.mdx b/api_docs/monitoring_collection.mdx
index 36021747f1c4f..599351943ffb5 100644
--- a/api_docs/monitoring_collection.mdx
+++ b/api_docs/monitoring_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoringCollection
 title: "monitoringCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoringCollection plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoringCollection']
 ---
 import monitoringCollectionObj from './monitoring_collection.devdocs.json';
diff --git a/api_docs/navigation.mdx b/api_docs/navigation.mdx
index a29a276eaedf0..2ea44d9a80926 100644
--- a/api_docs/navigation.mdx
+++ b/api_docs/navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/navigation
 title: "navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the navigation plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'navigation']
 ---
 import navigationObj from './navigation.devdocs.json';
diff --git a/api_docs/newsfeed.mdx b/api_docs/newsfeed.mdx
index 50862e5d7898d..7900fdb4062ad 100644
--- a/api_docs/newsfeed.mdx
+++ b/api_docs/newsfeed.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/newsfeed
 title: "newsfeed"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the newsfeed plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'newsfeed']
 ---
 import newsfeedObj from './newsfeed.devdocs.json';
diff --git a/api_docs/no_data_page.mdx b/api_docs/no_data_page.mdx
index 42f3c067fdb43..817cc99999a6a 100644
--- a/api_docs/no_data_page.mdx
+++ b/api_docs/no_data_page.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/noDataPage
 title: "noDataPage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the noDataPage plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'noDataPage']
 ---
 import noDataPageObj from './no_data_page.devdocs.json';
diff --git a/api_docs/notifications.mdx b/api_docs/notifications.mdx
index 2375ef39afb21..e3dd51d87a4b8 100644
--- a/api_docs/notifications.mdx
+++ b/api_docs/notifications.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/notifications
 title: "notifications"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the notifications plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'notifications']
 ---
 import notificationsObj from './notifications.devdocs.json';
diff --git a/api_docs/observability.devdocs.json b/api_docs/observability.devdocs.json
index a4d690ff05845..6dcd31dc1319b 100644
--- a/api_docs/observability.devdocs.json
+++ b/api_docs/observability.devdocs.json
@@ -8310,6 +8310,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -8390,7 +8460,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { body: { indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; }; }; }) => Promise<{ date: string; sliValue: number; }[]>; } & ",
+          " & { params: { body: { indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; }; }; }) => Promise<{ date: string; sliValue: number; }[]>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -8646,6 +8716,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -8814,7 +8954,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { path: { id: string; }; body: { name?: string | undefined; description?: string | undefined; indicator?: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; } | undefined; timeWindow?: { duration: ",
+          " & { params: { path: { id: string; }; body: { name?: string | undefined; description?: string | undefined; indicator?: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; } | undefined; timeWindow?: { duration: ",
           {
             "pluginId": "@kbn/slo-schema",
             "scope": "common",
@@ -8854,7 +8994,7 @@
             "section": "def-common.Duration",
             "text": "Duration"
           },
-          " | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }>; } & ",
+          " | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -8888,7 +9028,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { path: { id: string; }; } & { query?: { instanceId?: string | undefined; } | undefined; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }>; } & ",
+          " & { params: { path: { id: string; }; } & { query?: { instanceId?: string | undefined; } | undefined; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -8930,7 +9070,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params?: { query?: { kqlQuery?: string | undefined; page?: string | undefined; perPage?: string | undefined; sortBy?: \"status\" | \"error_budget_consumed\" | \"error_budget_remaining\" | \"sli_value\" | undefined; sortDirection?: \"asc\" | \"desc\" | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }>; } & ",
+          " & { params?: { query?: { kqlQuery?: string | undefined; page?: string | undefined; perPage?: string | undefined; sortBy?: \"status\" | \"error_budget_consumed\" | \"error_budget_remaining\" | \"sli_value\" | undefined; sortDirection?: \"asc\" | \"desc\" | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -8952,7 +9092,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { query: { search: string; }; }; }) => Promise<({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]>; } & ",
+          " & { params: { query: { search: string; }; }; }) => Promise<({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -9256,6 +9396,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -9428,7 +9638,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { body: { name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: ",
+          " & { params: { body: { name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: ",
           {
             "pluginId": "@kbn/slo-schema",
             "scope": "common",
@@ -9720,6 +9930,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -9800,7 +10080,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { body: { indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; }; }; }) => Promise<{ date: string; sliValue: number; }[]>; } & ",
+          " & { params: { body: { indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; }; }; }) => Promise<{ date: string; sliValue: number; }[]>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -10056,6 +10336,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -10224,7 +10574,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { path: { id: string; }; body: { name?: string | undefined; description?: string | undefined; indicator?: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; } | undefined; timeWindow?: { duration: ",
+          " & { params: { path: { id: string; }; body: { name?: string | undefined; description?: string | undefined; indicator?: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; } | undefined; timeWindow?: { duration: ",
           {
             "pluginId": "@kbn/slo-schema",
             "scope": "common",
@@ -10264,7 +10614,7 @@
             "section": "def-common.Duration",
             "text": "Duration"
           },
-          " | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }>; } & ",
+          " | undefined; } | undefined; tags?: string[] | undefined; groupBy?: string | undefined; }; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -10298,7 +10648,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { path: { id: string; }; } & { query?: { instanceId?: string | undefined; } | undefined; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }>; } & ",
+          " & { params: { path: { id: string; }; } & { query?: { instanceId?: string | undefined; } | undefined; }; }) => Promise<{ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -10340,7 +10690,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params?: { query?: { kqlQuery?: string | undefined; page?: string | undefined; perPage?: string | undefined; sortBy?: \"status\" | \"error_budget_consumed\" | \"error_budget_remaining\" | \"sli_value\" | undefined; sortDirection?: \"asc\" | \"desc\" | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }>; } & ",
+          " & { params?: { query?: { kqlQuery?: string | undefined; page?: string | undefined; perPage?: string | undefined; sortBy?: \"status\" | \"error_budget_consumed\" | \"error_budget_remaining\" | \"sli_value\" | undefined; sortDirection?: \"asc\" | \"desc\" | undefined; } | undefined; } | undefined; }) => Promise<{ page: number; perPage: number; total: number; results: ({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; } & { summary: { status: \"HEALTHY\" | \"NO_DATA\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }; })[]; }>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -10362,7 +10712,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { query: { search: string; }; }; }) => Promise<({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]>; } & ",
+          " & { params: { query: { search: string; }; }; }) => Promise<({ id: string; name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: string; type: \"rolling\"; } | { duration: string; type: \"calendarAligned\"; }; budgetingMethod: \"occurrences\" | \"timeslices\"; objective: { target: number; } & { timesliceTarget?: number | undefined; timesliceWindow?: string | undefined; }; revision: number; settings: { syncDelay: string; frequency: string; }; enabled: boolean; tags: string[]; groupBy: string; createdAt: string; updatedAt: string; } & { instanceId?: string | undefined; })[]>; } & ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -10666,6 +11016,76 @@
           "TypeC",
           "<{ type: ",
           "LiteralC",
+          "<\"sli.metric.timeslice\">; params: ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ index: ",
+          "StringC",
+          "; metric: ",
+          "TypeC",
+          "<{ metrics: ",
+          "ArrayC",
+          "<",
+          "UnionC",
+          "<[",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "KeyofC",
+          "<{ avg: boolean; max: boolean; min: boolean; sum: boolean; cardinality: boolean; last_value: boolean; std_deviation: boolean; }>; field: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"doc_count\">; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>, ",
+          "IntersectionC",
+          "<[",
+          "TypeC",
+          "<{ name: ",
+          "StringC",
+          "; aggregation: ",
+          "LiteralC",
+          "<\"percentile\">; field: ",
+          "StringC",
+          "; percentile: ",
+          "NumberC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>]>>; equation: ",
+          "StringC",
+          "; threshold: ",
+          "NumberC",
+          "; comparator: ",
+          "KeyofC",
+          "<{ GT: string; GTE: string; LT: string; LTE: string; }>; }>; timestampField: ",
+          "StringC",
+          "; }>, ",
+          "PartialC",
+          "<{ filter: ",
+          "StringC",
+          "; }>]>; }>, ",
+          "TypeC",
+          "<{ type: ",
+          "LiteralC",
           "<\"sli.histogram.custom\">; params: ",
           "IntersectionC",
           "<[",
@@ -10838,7 +11258,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          " & { params: { body: { name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: ",
+          " & { params: { body: { name: string; description: string; indicator: { type: \"sli.apm.transactionDuration\"; params: { environment: string; service: string; transactionType: string; transactionName: string; threshold: number; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.apm.transactionErrorRate\"; params: { environment: string; service: string; transactionType: string; transactionName: string; index: string; } & { filter?: string | undefined; }; } | { type: \"sli.kql.custom\"; params: { index: string; good: string; total: string; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.custom\"; params: { index: string; good: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; total: { metrics: ({ name: string; aggregation: \"sum\"; field: string; } & { filter?: string | undefined; })[]; equation: string; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.metric.timeslice\"; params: { index: string; metric: { metrics: (({ name: string; aggregation: \"min\" | \"max\" | \"sum\" | \"avg\" | \"cardinality\" | \"last_value\" | \"std_deviation\"; field: string; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"doc_count\"; } & { filter?: string | undefined; }) | ({ name: string; aggregation: \"percentile\"; field: string; percentile: number; } & { filter?: string | undefined; }))[]; equation: string; threshold: number; comparator: \"GT\" | \"GTE\" | \"LT\" | \"LTE\"; }; timestampField: string; } & { filter?: string | undefined; }; } | { type: \"sli.histogram.custom\"; params: { index: string; timestampField: string; good: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); total: ({ field: string; aggregation: \"value_count\"; } & { filter?: string | undefined; }) | ({ field: string; aggregation: \"range\"; from: number; to: number; } & { filter?: string | undefined; }); } & { filter?: string | undefined; }; }; timeWindow: { duration: ",
           {
             "pluginId": "@kbn/slo-schema",
             "scope": "common",
diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx
index 1f2dd6d435511..a8c34f4991531 100644
--- a/api_docs/observability.mdx
+++ b/api_docs/observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observability
 title: "observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observability plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observability']
 ---
 import observabilityObj from './observability.devdocs.json';
diff --git a/api_docs/observability_a_i_assistant.mdx b/api_docs/observability_a_i_assistant.mdx
index 2961a6a81c6ce..416537167873a 100644
--- a/api_docs/observability_a_i_assistant.mdx
+++ b/api_docs/observability_a_i_assistant.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityAIAssistant
 title: "observabilityAIAssistant"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityAIAssistant plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityAIAssistant']
 ---
 import observabilityAIAssistantObj from './observability_a_i_assistant.devdocs.json';
diff --git a/api_docs/observability_log_explorer.mdx b/api_docs/observability_log_explorer.mdx
index c54d8e6f367c7..ab026979c2c7c 100644
--- a/api_docs/observability_log_explorer.mdx
+++ b/api_docs/observability_log_explorer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityLogExplorer
 title: "observabilityLogExplorer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityLogExplorer plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityLogExplorer']
 ---
 import observabilityLogExplorerObj from './observability_log_explorer.devdocs.json';
diff --git a/api_docs/observability_onboarding.mdx b/api_docs/observability_onboarding.mdx
index 62bb7c343f76b..7011f6731c70e 100644
--- a/api_docs/observability_onboarding.mdx
+++ b/api_docs/observability_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityOnboarding
 title: "observabilityOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityOnboarding plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityOnboarding']
 ---
 import observabilityOnboardingObj from './observability_onboarding.devdocs.json';
diff --git a/api_docs/observability_shared.mdx b/api_docs/observability_shared.mdx
index 1f3ea1fdcdef8..7f19843924287 100644
--- a/api_docs/observability_shared.mdx
+++ b/api_docs/observability_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observabilityShared
 title: "observabilityShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observabilityShared plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observabilityShared']
 ---
 import observabilitySharedObj from './observability_shared.devdocs.json';
diff --git a/api_docs/osquery.mdx b/api_docs/osquery.mdx
index d2e98c6f29bc8..08b6c3de2f400 100644
--- a/api_docs/osquery.mdx
+++ b/api_docs/osquery.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/osquery
 title: "osquery"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the osquery plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'osquery']
 ---
 import osqueryObj from './osquery.devdocs.json';
diff --git a/api_docs/painless_lab.mdx b/api_docs/painless_lab.mdx
index afffae5c91e52..a6ef5e8abf069 100644
--- a/api_docs/painless_lab.mdx
+++ b/api_docs/painless_lab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/painlessLab
 title: "painlessLab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the painlessLab plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'painlessLab']
 ---
 import painlessLabObj from './painless_lab.devdocs.json';
diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx
index ff30adf2672fc..f4d2592ee81bb 100644
--- a/api_docs/plugin_directory.mdx
+++ b/api_docs/plugin_directory.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsPluginDirectory
 slug: /kibana-dev-docs/api-meta/plugin-api-directory
 title: Directory
 description: Directory of public APIs available through plugins or packages.
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -21,7 +21,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | API Count | Any Count | Missing comments | Missing exports |
 |--------------|----------|-----------------|--------|
-| 75848 | 223 | 64648 | 1583 |
+| 75857 | 223 | 64656 | 1584 |
 
 ## Plugin Directory
 
@@ -95,7 +95,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibFileUploadPluginApi" text="fileUpload"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | The file upload plugin contains components and services for uploading a file, analyzing its data, and then importing the data into an Elasticsearch index. Supported file types include CSV, TSV, newline-delimited JSON and GeoJSON. | 59 | 0 | 59 | 2 |
 | <DocLink id="kibFilesPluginApi" text="files"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | File upload, download, sharing, and serving over HTTP implementation in Kibana. | 239 | 0 | 24 | 9 |
 | <DocLink id="kibFilesManagementPluginApi" text="filesManagement"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | Simple UI for managing files in Kibana | 2 | 0 | 2 | 0 |
-| <DocLink id="kibFleetPluginApi" text="fleet"/> | [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1208 | 3 | 1090 | 43 |
+| <DocLink id="kibFleetPluginApi" text="fleet"/> | [@elastic/fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1209 | 3 | 1091 | 44 |
 | ftrApis | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibGlobalSearchPluginApi" text="globalSearch"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 68 | 0 | 14 | 5 |
 | globalSearchBar | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 0 | 0 | 0 | 0 |
@@ -128,7 +128,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | logstash | [@elastic/logstash](https://github.com/orgs/elastic/teams/logstash) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibManagementPluginApi" text="management"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 47 | 0 | 47 | 7 |
 | <DocLink id="kibMapsPluginApi" text="maps"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 259 | 0 | 258 | 28 |
-| <DocLink id="kibMapsEmsPluginApi" text="mapsEms"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 67 | 0 | 67 | 0 |
+| <DocLink id="kibMapsEmsPluginApi" text="mapsEms"/> | [@elastic/kibana-gis](https://github.com/orgs/elastic/teams/kibana-gis) | - | 68 | 0 | 68 | 0 |
 | <DocLink id="kibMetricsDataAccessPluginApi" text="metricsDataAccess"/> | [@elastic/infra-monitoring-ui](https://github.com/orgs/elastic/teams/infra-monitoring-ui) | Exposes utilities for accessing metrics data | 16 | 0 | 16 | 0 |
 | <DocLink id="kibMlPluginApi" text="ml"/> | [@elastic/ml-ui](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the machine learning features provided by Elastic. | 150 | 3 | 64 | 33 |
 | <DocLink id="kibMonitoringPluginApi" text="monitoring"/> | [@elastic/infra-monitoring-ui](https://github.com/orgs/elastic/teams/infra-monitoring-ui) | - | 15 | 3 | 13 | 1 |
@@ -144,7 +144,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibObservabilitySharedPluginApi" text="observabilityShared"/> | [@elastic/observability-ui](https://github.com/orgs/elastic/teams/observability-ui) | - | 291 | 1 | 288 | 15 |
 | <DocLink id="kibOsqueryPluginApi" text="osquery"/> | [@elastic/security-defend-workflows](https://github.com/orgs/elastic/teams/security-defend-workflows) | - | 24 | 0 | 24 | 7 |
 | <DocLink id="kibPainlessLabPluginApi" text="painlessLab"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 2 | 0 | 2 | 0 |
-| <DocLink id="kibPresentationUtilPluginApi" text="presentationUtil"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Presentation Utility Plugin is a set of common, shared components and toolkits for solutions within the Presentation space, (e.g. Dashboards, Canvas). | 227 | 2 | 172 | 11 |
+| <DocLink id="kibPresentationUtilPluginApi" text="presentationUtil"/> | [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Presentation Utility Plugin is a set of common, shared components and toolkits for solutions within the Presentation space, (e.g. Dashboards, Canvas). | 219 | 2 | 164 | 11 |
 | <DocLink id="kibProfilingPluginApi" text="profiling"/> | [@elastic/profiling-ui](https://github.com/orgs/elastic/teams/profiling-ui) | - | 16 | 1 | 16 | 0 |
 | <DocLink id="kibProfilingDataAccessPluginApi" text="profilingDataAccess"/> | [@elastic/profiling-ui](https://github.com/orgs/elastic/teams/profiling-ui) | - | 21 | 0 | 21 | 6 |
 | <DocLink id="kibRemoteClustersPluginApi" text="remoteClusters"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 23 | 0 | 23 | 0 |
@@ -485,7 +485,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnManagementSettingsComponentsFieldRowPluginApi" text="@kbn/management-settings-components-field-row"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 23 | 0 | 7 | 0 |
 | <DocLink id="kibKbnManagementSettingsComponentsFormPluginApi" text="@kbn/management-settings-components-form"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 8 | 0 | 2 | 3 |
 | <DocLink id="kibKbnManagementSettingsFieldDefinitionPluginApi" text="@kbn/management-settings-field-definition"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 45 | 0 | 0 | 0 |
-| <DocLink id="kibKbnManagementSettingsIdsPluginApi" text="@kbn/management-settings-ids"/> | [@elastic/appex-sharedux @elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/appex-sharedux ) | - | 130 | 0 | 130 | 0 |
+| <DocLink id="kibKbnManagementSettingsIdsPluginApi" text="@kbn/management-settings-ids"/> | [@elastic/appex-sharedux @elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/appex-sharedux ) | - | 129 | 0 | 129 | 0 |
 | <DocLink id="kibKbnManagementSettingsSectionRegistryPluginApi" text="@kbn/management-settings-section-registry"/> | [@elastic/appex-sharedux @elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/appex-sharedux ) | - | 20 | 0 | 11 | 0 |
 | <DocLink id="kibKbnManagementSettingsTypesPluginApi" text="@kbn/management-settings-types"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 81 | 0 | 3 | 0 |
 | <DocLink id="kibKbnManagementSettingsUtilitiesPluginApi" text="@kbn/management-settings-utilities"/> | [@elastic/platform-deployment-management](https://github.com/orgs/elastic/teams/platform-deployment-management) | - | 54 | 0 | 6 | 0 |
@@ -604,7 +604,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnSharedUxPageKibanaNoDataMocksPluginApi" text="@kbn/shared-ux-page-kibana-no-data-mocks"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 25 | 0 | 24 | 0 |
 | <DocLink id="kibKbnSharedUxPageKibanaTemplatePluginApi" text="@kbn/shared-ux-page-kibana-template"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 11 | 0 | 6 | 0 |
 | <DocLink id="kibKbnSharedUxPageKibanaTemplateMocksPluginApi" text="@kbn/shared-ux-page-kibana-template-mocks"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 43 | 5 | 43 | 2 |
-| <DocLink id="kibKbnSharedUxPageNoDataPluginApi" text="@kbn/shared-ux-page-no-data"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 13 | 0 | 5 | 0 |
+| <DocLink id="kibKbnSharedUxPageNoDataPluginApi" text="@kbn/shared-ux-page-no-data"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 14 | 0 | 5 | 0 |
 | <DocLink id="kibKbnSharedUxPageNoDataConfigPluginApi" text="@kbn/shared-ux-page-no-data-config"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 11 | 0 | 9 | 0 |
 | <DocLink id="kibKbnSharedUxPageNoDataConfigMocksPluginApi" text="@kbn/shared-ux-page-no-data-config-mocks"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 24 | 0 | 24 | 0 |
 | <DocLink id="kibKbnSharedUxPageNoDataMocksPluginApi" text="@kbn/shared-ux-page-no-data-mocks"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 27 | 0 | 26 | 0 |
@@ -617,7 +617,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnSharedUxStorybookConfigPluginApi" text="@kbn/shared-ux-storybook-config"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 2 | 0 | 0 | 0 |
 | <DocLink id="kibKbnSharedUxStorybookMockPluginApi" text="@kbn/shared-ux-storybook-mock"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 15 | 0 | 4 | 0 |
 | <DocLink id="kibKbnSharedUxUtilityPluginApi" text="@kbn/shared-ux-utility"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/appex-sharedux) | - | 9 | 0 | 3 | 0 |
-| <DocLink id="kibKbnSloSchemaPluginApi" text="@kbn/slo-schema"/> | [@elastic/actionable-observability](https://github.com/orgs/elastic/teams/actionable-observability) | - | 114 | 0 | 111 | 0 |
+| <DocLink id="kibKbnSloSchemaPluginApi" text="@kbn/slo-schema"/> | [@elastic/actionable-observability](https://github.com/orgs/elastic/teams/actionable-observability) | - | 129 | 0 | 126 | 0 |
 | <DocLink id="kibKbnSomeDevLogPluginApi" text="@kbn/some-dev-log"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 20 | 0 | 12 | 0 |
 | <DocLink id="kibKbnStdPluginApi" text="@kbn/std"/> | [@elastic/kibana-core](https://github.com/orgs/elastic/teams/kibana-core) | - | 102 | 2 | 65 | 1 |
 | <DocLink id="kibKbnStdioDevHelpersPluginApi" text="@kbn/stdio-dev-helpers"/> | [@elastic/kibana-operations](https://github.com/orgs/elastic/teams/kibana-operations) | - | 4 | 0 | 2 | 0 |
diff --git a/api_docs/presentation_util.devdocs.json b/api_docs/presentation_util.devdocs.json
index 91660f313ddef..6a4ce95f96a32 100644
--- a/api_docs/presentation_util.devdocs.json
+++ b/api_docs/presentation_util.devdocs.json
@@ -1543,7 +1543,7 @@
             "label": "isProjectEnabled",
             "description": [],
             "signature": [
-              "(id: \"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\") => boolean"
+              "(id: \"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\") => boolean"
             ],
             "path": "src/plugins/presentation_util/public/services/labs/types.ts",
             "deprecated": false,
@@ -1557,7 +1557,7 @@
                 "label": "id",
                 "description": [],
                 "signature": [
-                  "\"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
+                  "\"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
                 ],
                 "path": "src/plugins/presentation_util/public/services/labs/types.ts",
                 "deprecated": false,
@@ -1575,7 +1575,7 @@
             "label": "getProjectIDs",
             "description": [],
             "signature": [
-              "() => readonly [\"labs:dashboard:deferBelowFold\", \"labs:dashboard:dashboardControls\", \"labs:canvas:byValueEmbeddable\", \"labs:dashboard:linksPanel\"]"
+              "() => readonly [\"labs:dashboard:deferBelowFold\", \"labs:canvas:byValueEmbeddable\", \"labs:dashboard:linksPanel\"]"
             ],
             "path": "src/plugins/presentation_util/public/services/labs/types.ts",
             "deprecated": false,
@@ -1591,7 +1591,7 @@
             "label": "getProject",
             "description": [],
             "signature": [
-              "(id: \"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\") => ",
+              "(id: \"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\") => ",
               {
                 "pluginId": "presentationUtil",
                 "scope": "common",
@@ -1612,7 +1612,7 @@
                 "label": "id",
                 "description": [],
                 "signature": [
-                  "\"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
+                  "\"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
                 ],
                 "path": "src/plugins/presentation_util/public/services/labs/types.ts",
                 "deprecated": false,
@@ -1630,7 +1630,7 @@
             "label": "getProjects",
             "description": [],
             "signature": [
-              "(solutions?: (\"canvas\" | \"dashboard\" | \"presentation\")[] | undefined) => Record<\"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\", ",
+              "(solutions?: (\"canvas\" | \"dashboard\" | \"presentation\")[] | undefined) => Record<\"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\", ",
               {
                 "pluginId": "presentationUtil",
                 "scope": "common",
@@ -1670,7 +1670,7 @@
             "label": "setProjectStatus",
             "description": [],
             "signature": [
-              "(id: \"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\", env: \"kibana\" | \"browser\" | \"session\", status: boolean) => void"
+              "(id: \"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\", env: \"kibana\" | \"browser\" | \"session\", status: boolean) => void"
             ],
             "path": "src/plugins/presentation_util/public/services/labs/types.ts",
             "deprecated": false,
@@ -1684,7 +1684,7 @@
                 "label": "id",
                 "description": [],
                 "signature": [
-                  "\"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
+                  "\"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
                 ],
                 "path": "src/plugins/presentation_util/public/services/labs/types.ts",
                 "deprecated": false,
@@ -3079,7 +3079,7 @@
         "label": "getProjectIDs",
         "description": [],
         "signature": [
-          "() => readonly [\"labs:dashboard:deferBelowFold\", \"labs:dashboard:dashboardControls\", \"labs:canvas:byValueEmbeddable\", \"labs:dashboard:linksPanel\"]"
+          "() => readonly [\"labs:dashboard:deferBelowFold\", \"labs:canvas:byValueEmbeddable\", \"labs:dashboard:linksPanel\"]"
         ],
         "path": "src/plugins/presentation_util/common/labs.ts",
         "deprecated": false,
@@ -3381,7 +3381,7 @@
             "label": "id",
             "description": [],
             "signature": [
-              "\"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
+              "\"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
             ],
             "path": "src/plugins/presentation_util/common/labs.ts",
             "deprecated": false,
@@ -3595,7 +3595,7 @@
         "label": "ProjectID",
         "description": [],
         "signature": [
-          "\"labs:dashboard:deferBelowFold\" | \"labs:dashboard:dashboardControls\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
+          "\"labs:dashboard:deferBelowFold\" | \"labs:canvas:byValueEmbeddable\" | \"labs:dashboard:linksPanel\""
         ],
         "path": "src/plugins/presentation_util/common/labs.ts",
         "deprecated": false,
@@ -3688,7 +3688,7 @@
         "label": "projectIDs",
         "description": [],
         "signature": [
-          "readonly [\"labs:dashboard:deferBelowFold\", \"labs:dashboard:dashboardControls\", \"labs:canvas:byValueEmbeddable\", \"labs:dashboard:linksPanel\"]"
+          "readonly [\"labs:dashboard:deferBelowFold\", \"labs:canvas:byValueEmbeddable\", \"labs:dashboard:linksPanel\"]"
         ],
         "path": "src/plugins/presentation_util/common/labs.ts",
         "deprecated": false,
@@ -3813,111 +3813,6 @@
               }
             ]
           },
-          {
-            "parentPluginId": "presentationUtil",
-            "id": "def-common.projects.DASHBOARD_CONTROLS",
-            "type": "Object",
-            "tags": [],
-            "label": "[DASHBOARD_CONTROLS]",
-            "description": [],
-            "path": "src/plugins/presentation_util/common/labs.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "presentationUtil",
-                "id": "def-common.projects.DASHBOARD_CONTROLS.id",
-                "type": "string",
-                "tags": [],
-                "label": "id",
-                "description": [],
-                "signature": [
-                  "\"labs:dashboard:dashboardControls\""
-                ],
-                "path": "src/plugins/presentation_util/common/labs.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "presentationUtil",
-                "id": "def-common.projects.DASHBOARD_CONTROLS.isActive",
-                "type": "boolean",
-                "tags": [],
-                "label": "isActive",
-                "description": [],
-                "signature": [
-                  "true"
-                ],
-                "path": "src/plugins/presentation_util/common/labs.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "presentationUtil",
-                "id": "def-common.projects.DASHBOARD_CONTROLS.isDisplayed",
-                "type": "boolean",
-                "tags": [],
-                "label": "isDisplayed",
-                "description": [],
-                "signature": [
-                  "true"
-                ],
-                "path": "src/plugins/presentation_util/common/labs.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "presentationUtil",
-                "id": "def-common.projects.DASHBOARD_CONTROLS.environments",
-                "type": "Array",
-                "tags": [],
-                "label": "environments",
-                "description": [],
-                "signature": [
-                  "(\"kibana\" | \"browser\" | \"session\")[]"
-                ],
-                "path": "src/plugins/presentation_util/common/labs.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "presentationUtil",
-                "id": "def-common.projects.DASHBOARD_CONTROLS.name",
-                "type": "string",
-                "tags": [],
-                "label": "name",
-                "description": [],
-                "path": "src/plugins/presentation_util/common/labs.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "presentationUtil",
-                "id": "def-common.projects.DASHBOARD_CONTROLS.description",
-                "type": "string",
-                "tags": [],
-                "label": "description",
-                "description": [],
-                "path": "src/plugins/presentation_util/common/labs.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              },
-              {
-                "parentPluginId": "presentationUtil",
-                "id": "def-common.projects.DASHBOARD_CONTROLS.solutions",
-                "type": "Array",
-                "tags": [],
-                "label": "solutions",
-                "description": [],
-                "signature": [
-                  "\"dashboard\"[]"
-                ],
-                "path": "src/plugins/presentation_util/common/labs.ts",
-                "deprecated": false,
-                "trackAdoption": false
-              }
-            ]
-          },
           {
             "parentPluginId": "presentationUtil",
             "id": "def-common.projects.DASHBOARD_LINKS_PANEL",
diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx
index cc37678a7e8c4..36bea637e3894 100644
--- a/api_docs/presentation_util.mdx
+++ b/api_docs/presentation_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/presentationUtil
 title: "presentationUtil"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the presentationUtil plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationUtil']
 ---
 import presentationUtilObj from './presentation_util.devdocs.json';
@@ -21,7 +21,7 @@ Contact [@elastic/kibana-presentation](https://github.com/orgs/elastic/teams/kib
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 227 | 2 | 172 | 11 |
+| 219 | 2 | 164 | 11 |
 
 ## Client
 
diff --git a/api_docs/profiling.devdocs.json b/api_docs/profiling.devdocs.json
index f3e6f3535e41b..6889fdd47e14e 100644
--- a/api_docs/profiling.devdocs.json
+++ b/api_docs/profiling.devdocs.json
@@ -38,7 +38,7 @@
         "label": "PackageInputType",
         "description": [],
         "signature": [
-          "{ readonly host?: string | undefined; readonly tls_enabled?: boolean | undefined; readonly tls_supported_protocols?: string[] | undefined; readonly tls_certificate_path?: string | undefined; readonly tls_key_path?: string | undefined; }"
+          "{ readonly telemetry?: boolean | undefined; readonly host?: string | undefined; readonly tls_enabled?: boolean | undefined; readonly tls_supported_protocols?: string[] | undefined; readonly tls_certificate_path?: string | undefined; readonly tls_key_path?: string | undefined; }"
         ],
         "path": "x-pack/plugins/profiling/server/index.ts",
         "deprecated": false,
@@ -53,7 +53,7 @@
         "label": "ProfilingConfig",
         "description": [],
         "signature": [
-          "{ readonly elasticsearch?: Readonly<{} & { username: string; hosts: string; password: string; }> | undefined; readonly symbolizer?: Readonly<{ host?: string | undefined; tls_enabled?: boolean | undefined; tls_supported_protocols?: string[] | undefined; tls_certificate_path?: string | undefined; tls_key_path?: string | undefined; } & {}> | undefined; readonly collector?: Readonly<{ host?: string | undefined; tls_enabled?: boolean | undefined; tls_supported_protocols?: string[] | undefined; tls_certificate_path?: string | undefined; tls_key_path?: string | undefined; } & {}> | undefined; readonly enabled: boolean; }"
+          "{ readonly elasticsearch?: Readonly<{} & { username: string; hosts: string; password: string; }> | undefined; readonly symbolizer?: Readonly<{ telemetry?: boolean | undefined; host?: string | undefined; tls_enabled?: boolean | undefined; tls_supported_protocols?: string[] | undefined; tls_certificate_path?: string | undefined; tls_key_path?: string | undefined; } & {}> | undefined; readonly collector?: Readonly<{ telemetry?: boolean | undefined; host?: string | undefined; tls_enabled?: boolean | undefined; tls_supported_protocols?: string[] | undefined; tls_certificate_path?: string | undefined; tls_key_path?: string | undefined; } & {}> | undefined; readonly enabled: boolean; }"
         ],
         "path": "x-pack/plugins/profiling/server/index.ts",
         "deprecated": false,
diff --git a/api_docs/profiling.mdx b/api_docs/profiling.mdx
index afd424fe7a360..dd5f7f756c786 100644
--- a/api_docs/profiling.mdx
+++ b/api_docs/profiling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profiling
 title: "profiling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profiling plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profiling']
 ---
 import profilingObj from './profiling.devdocs.json';
diff --git a/api_docs/profiling_data_access.mdx b/api_docs/profiling_data_access.mdx
index 5a747bb6dbd24..9914e54e13825 100644
--- a/api_docs/profiling_data_access.mdx
+++ b/api_docs/profiling_data_access.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profilingDataAccess
 title: "profilingDataAccess"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profilingDataAccess plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profilingDataAccess']
 ---
 import profilingDataAccessObj from './profiling_data_access.devdocs.json';
diff --git a/api_docs/remote_clusters.mdx b/api_docs/remote_clusters.mdx
index 5dda7460e7b38..8e5ee24aa5497 100644
--- a/api_docs/remote_clusters.mdx
+++ b/api_docs/remote_clusters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/remoteClusters
 title: "remoteClusters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the remoteClusters plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'remoteClusters']
 ---
 import remoteClustersObj from './remote_clusters.devdocs.json';
diff --git a/api_docs/reporting.mdx b/api_docs/reporting.mdx
index d41d3a8d59c9c..2304babb907ab 100644
--- a/api_docs/reporting.mdx
+++ b/api_docs/reporting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/reporting
 title: "reporting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the reporting plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'reporting']
 ---
 import reportingObj from './reporting.devdocs.json';
diff --git a/api_docs/rollup.mdx b/api_docs/rollup.mdx
index b7bcb9ec392bd..0b48aca31d420 100644
--- a/api_docs/rollup.mdx
+++ b/api_docs/rollup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/rollup
 title: "rollup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the rollup plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'rollup']
 ---
 import rollupObj from './rollup.devdocs.json';
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index c18803a2717b5..4bf6ec08ffddc 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ruleRegistry
 title: "ruleRegistry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ruleRegistry plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ruleRegistry']
 ---
 import ruleRegistryObj from './rule_registry.devdocs.json';
diff --git a/api_docs/runtime_fields.mdx b/api_docs/runtime_fields.mdx
index c1277008f8005..896ce6fa44bb9 100644
--- a/api_docs/runtime_fields.mdx
+++ b/api_docs/runtime_fields.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/runtimeFields
 title: "runtimeFields"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the runtimeFields plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'runtimeFields']
 ---
 import runtimeFieldsObj from './runtime_fields.devdocs.json';
diff --git a/api_docs/saved_objects.mdx b/api_docs/saved_objects.mdx
index 80d8aaedfb67c..439ea2fff556a 100644
--- a/api_docs/saved_objects.mdx
+++ b/api_docs/saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjects
 title: "savedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjects plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjects']
 ---
 import savedObjectsObj from './saved_objects.devdocs.json';
diff --git a/api_docs/saved_objects_finder.mdx b/api_docs/saved_objects_finder.mdx
index da82bb6d1b2f7..5f499d7bb62da 100644
--- a/api_docs/saved_objects_finder.mdx
+++ b/api_docs/saved_objects_finder.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsFinder
 title: "savedObjectsFinder"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsFinder plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsFinder']
 ---
 import savedObjectsFinderObj from './saved_objects_finder.devdocs.json';
diff --git a/api_docs/saved_objects_management.mdx b/api_docs/saved_objects_management.mdx
index 7191dcb6890cc..62e05fbc6de9d 100644
--- a/api_docs/saved_objects_management.mdx
+++ b/api_docs/saved_objects_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsManagement
 title: "savedObjectsManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsManagement plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsManagement']
 ---
 import savedObjectsManagementObj from './saved_objects_management.devdocs.json';
diff --git a/api_docs/saved_objects_tagging.mdx b/api_docs/saved_objects_tagging.mdx
index 36fcc83f23076..df4caeb535b3a 100644
--- a/api_docs/saved_objects_tagging.mdx
+++ b/api_docs/saved_objects_tagging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTagging
 title: "savedObjectsTagging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTagging plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTagging']
 ---
 import savedObjectsTaggingObj from './saved_objects_tagging.devdocs.json';
diff --git a/api_docs/saved_objects_tagging_oss.mdx b/api_docs/saved_objects_tagging_oss.mdx
index 31ee8d4fe7f0a..9941d053c1973 100644
--- a/api_docs/saved_objects_tagging_oss.mdx
+++ b/api_docs/saved_objects_tagging_oss.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTaggingOss
 title: "savedObjectsTaggingOss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTaggingOss plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTaggingOss']
 ---
 import savedObjectsTaggingOssObj from './saved_objects_tagging_oss.devdocs.json';
diff --git a/api_docs/saved_search.mdx b/api_docs/saved_search.mdx
index 7a89810328e82..08855b04fb4d5 100644
--- a/api_docs/saved_search.mdx
+++ b/api_docs/saved_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedSearch
 title: "savedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedSearch plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedSearch']
 ---
 import savedSearchObj from './saved_search.devdocs.json';
diff --git a/api_docs/screenshot_mode.mdx b/api_docs/screenshot_mode.mdx
index 500a8534117a1..7777811d6bd48 100644
--- a/api_docs/screenshot_mode.mdx
+++ b/api_docs/screenshot_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotMode
 title: "screenshotMode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotMode plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotMode']
 ---
 import screenshotModeObj from './screenshot_mode.devdocs.json';
diff --git a/api_docs/screenshotting.mdx b/api_docs/screenshotting.mdx
index 683f642a63c8c..a9000224992a6 100644
--- a/api_docs/screenshotting.mdx
+++ b/api_docs/screenshotting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotting
 title: "screenshotting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotting plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotting']
 ---
 import screenshottingObj from './screenshotting.devdocs.json';
diff --git a/api_docs/security.mdx b/api_docs/security.mdx
index e0914d3a0f545..c6e7131ab9b44 100644
--- a/api_docs/security.mdx
+++ b/api_docs/security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/security
 title: "security"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the security plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'security']
 ---
 import securityObj from './security.devdocs.json';
diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx
index fa6840750f7ac..e2ae0f6b77616 100644
--- a/api_docs/security_solution.mdx
+++ b/api_docs/security_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolution
 title: "securitySolution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolution plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolution']
 ---
 import securitySolutionObj from './security_solution.devdocs.json';
diff --git a/api_docs/security_solution_ess.mdx b/api_docs/security_solution_ess.mdx
index 65204810bf06b..fb12c4740c65a 100644
--- a/api_docs/security_solution_ess.mdx
+++ b/api_docs/security_solution_ess.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolutionEss
 title: "securitySolutionEss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolutionEss plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolutionEss']
 ---
 import securitySolutionEssObj from './security_solution_ess.devdocs.json';
diff --git a/api_docs/security_solution_serverless.mdx b/api_docs/security_solution_serverless.mdx
index f18f68ddcd89b..a94f1a91a3524 100644
--- a/api_docs/security_solution_serverless.mdx
+++ b/api_docs/security_solution_serverless.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolutionServerless
 title: "securitySolutionServerless"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolutionServerless plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolutionServerless']
 ---
 import securitySolutionServerlessObj from './security_solution_serverless.devdocs.json';
diff --git a/api_docs/serverless.mdx b/api_docs/serverless.mdx
index 9e8e39c4eff2f..03d3ecb8e21e9 100644
--- a/api_docs/serverless.mdx
+++ b/api_docs/serverless.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverless
 title: "serverless"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverless plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverless']
 ---
 import serverlessObj from './serverless.devdocs.json';
diff --git a/api_docs/serverless_observability.mdx b/api_docs/serverless_observability.mdx
index 4ba9d4516947e..6d566a7dd18eb 100644
--- a/api_docs/serverless_observability.mdx
+++ b/api_docs/serverless_observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverlessObservability
 title: "serverlessObservability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverlessObservability plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverlessObservability']
 ---
 import serverlessObservabilityObj from './serverless_observability.devdocs.json';
diff --git a/api_docs/serverless_search.mdx b/api_docs/serverless_search.mdx
index 1c6243dd3e5e4..9ce17a4384fb8 100644
--- a/api_docs/serverless_search.mdx
+++ b/api_docs/serverless_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/serverlessSearch
 title: "serverlessSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the serverlessSearch plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'serverlessSearch']
 ---
 import serverlessSearchObj from './serverless_search.devdocs.json';
diff --git a/api_docs/session_view.mdx b/api_docs/session_view.mdx
index 2ec3157b94ac0..11dd3ed299b86 100644
--- a/api_docs/session_view.mdx
+++ b/api_docs/session_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/sessionView
 title: "sessionView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the sessionView plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sessionView']
 ---
 import sessionViewObj from './session_view.devdocs.json';
diff --git a/api_docs/share.mdx b/api_docs/share.mdx
index a31883bcb1840..128e6c80f863a 100644
--- a/api_docs/share.mdx
+++ b/api_docs/share.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/share
 title: "share"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the share plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'share']
 ---
 import shareObj from './share.devdocs.json';
diff --git a/api_docs/snapshot_restore.mdx b/api_docs/snapshot_restore.mdx
index 32c52eaa951b1..4a0d1e447511d 100644
--- a/api_docs/snapshot_restore.mdx
+++ b/api_docs/snapshot_restore.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/snapshotRestore
 title: "snapshotRestore"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the snapshotRestore plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'snapshotRestore']
 ---
 import snapshotRestoreObj from './snapshot_restore.devdocs.json';
diff --git a/api_docs/spaces.mdx b/api_docs/spaces.mdx
index 02ff50607c619..0b88498825239 100644
--- a/api_docs/spaces.mdx
+++ b/api_docs/spaces.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/spaces
 title: "spaces"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the spaces plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'spaces']
 ---
 import spacesObj from './spaces.devdocs.json';
diff --git a/api_docs/stack_alerts.mdx b/api_docs/stack_alerts.mdx
index 6ce70ad9b2266..b3f29202870c1 100644
--- a/api_docs/stack_alerts.mdx
+++ b/api_docs/stack_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackAlerts
 title: "stackAlerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackAlerts plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackAlerts']
 ---
 import stackAlertsObj from './stack_alerts.devdocs.json';
diff --git a/api_docs/stack_connectors.mdx b/api_docs/stack_connectors.mdx
index 33ef37c292981..e4425b153a248 100644
--- a/api_docs/stack_connectors.mdx
+++ b/api_docs/stack_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackConnectors
 title: "stackConnectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackConnectors plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackConnectors']
 ---
 import stackConnectorsObj from './stack_connectors.devdocs.json';
diff --git a/api_docs/task_manager.mdx b/api_docs/task_manager.mdx
index fb4f7a55f8546..6c89d01595531 100644
--- a/api_docs/task_manager.mdx
+++ b/api_docs/task_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/taskManager
 title: "taskManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the taskManager plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'taskManager']
 ---
 import taskManagerObj from './task_manager.devdocs.json';
diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx
index be86cc25eaee9..b450df0b84cf1 100644
--- a/api_docs/telemetry.mdx
+++ b/api_docs/telemetry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetry
 title: "telemetry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetry plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetry']
 ---
 import telemetryObj from './telemetry.devdocs.json';
diff --git a/api_docs/telemetry_collection_manager.mdx b/api_docs/telemetry_collection_manager.mdx
index 2f08803e9e8b2..54fa854541196 100644
--- a/api_docs/telemetry_collection_manager.mdx
+++ b/api_docs/telemetry_collection_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionManager
 title: "telemetryCollectionManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionManager plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionManager']
 ---
 import telemetryCollectionManagerObj from './telemetry_collection_manager.devdocs.json';
diff --git a/api_docs/telemetry_collection_xpack.mdx b/api_docs/telemetry_collection_xpack.mdx
index 47b3e7b690e4d..3bbf43d16218c 100644
--- a/api_docs/telemetry_collection_xpack.mdx
+++ b/api_docs/telemetry_collection_xpack.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionXpack
 title: "telemetryCollectionXpack"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionXpack plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionXpack']
 ---
 import telemetryCollectionXpackObj from './telemetry_collection_xpack.devdocs.json';
diff --git a/api_docs/telemetry_management_section.mdx b/api_docs/telemetry_management_section.mdx
index 052f6706031c6..9030dc06710ee 100644
--- a/api_docs/telemetry_management_section.mdx
+++ b/api_docs/telemetry_management_section.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryManagementSection
 title: "telemetryManagementSection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryManagementSection plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryManagementSection']
 ---
 import telemetryManagementSectionObj from './telemetry_management_section.devdocs.json';
diff --git a/api_docs/text_based_languages.mdx b/api_docs/text_based_languages.mdx
index 1cceb7aff2261..0564eea2132b2 100644
--- a/api_docs/text_based_languages.mdx
+++ b/api_docs/text_based_languages.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/textBasedLanguages
 title: "textBasedLanguages"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the textBasedLanguages plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'textBasedLanguages']
 ---
 import textBasedLanguagesObj from './text_based_languages.devdocs.json';
diff --git a/api_docs/threat_intelligence.mdx b/api_docs/threat_intelligence.mdx
index 6f2fbdf049fa1..b58ee3df6e625 100644
--- a/api_docs/threat_intelligence.mdx
+++ b/api_docs/threat_intelligence.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/threatIntelligence
 title: "threatIntelligence"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the threatIntelligence plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'threatIntelligence']
 ---
 import threatIntelligenceObj from './threat_intelligence.devdocs.json';
diff --git a/api_docs/timelines.mdx b/api_docs/timelines.mdx
index b6402e947711f..9314ca84e996d 100644
--- a/api_docs/timelines.mdx
+++ b/api_docs/timelines.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/timelines
 title: "timelines"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the timelines plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'timelines']
 ---
 import timelinesObj from './timelines.devdocs.json';
diff --git a/api_docs/transform.mdx b/api_docs/transform.mdx
index 5047c0facd21e..eafa2122bebbd 100644
--- a/api_docs/transform.mdx
+++ b/api_docs/transform.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/transform
 title: "transform"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the transform plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'transform']
 ---
 import transformObj from './transform.devdocs.json';
diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx
index a77aafebb5afd..5a4bec974db92 100644
--- a/api_docs/triggers_actions_ui.mdx
+++ b/api_docs/triggers_actions_ui.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/triggersActionsUi
 title: "triggersActionsUi"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the triggersActionsUi plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'triggersActionsUi']
 ---
 import triggersActionsUiObj from './triggers_actions_ui.devdocs.json';
diff --git a/api_docs/ui_actions.mdx b/api_docs/ui_actions.mdx
index 158859e2154f3..4f5485b484ae5 100644
--- a/api_docs/ui_actions.mdx
+++ b/api_docs/ui_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActions
 title: "uiActions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActions plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActions']
 ---
 import uiActionsObj from './ui_actions.devdocs.json';
diff --git a/api_docs/ui_actions_enhanced.mdx b/api_docs/ui_actions_enhanced.mdx
index 3a22305dcc133..fb201cb1ffa35 100644
--- a/api_docs/ui_actions_enhanced.mdx
+++ b/api_docs/ui_actions_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActionsEnhanced
 title: "uiActionsEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActionsEnhanced plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActionsEnhanced']
 ---
 import uiActionsEnhancedObj from './ui_actions_enhanced.devdocs.json';
diff --git a/api_docs/unified_doc_viewer.mdx b/api_docs/unified_doc_viewer.mdx
index 7279ef7969fb7..eecfa3715e4b9 100644
--- a/api_docs/unified_doc_viewer.mdx
+++ b/api_docs/unified_doc_viewer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedDocViewer
 title: "unifiedDocViewer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedDocViewer plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedDocViewer']
 ---
 import unifiedDocViewerObj from './unified_doc_viewer.devdocs.json';
diff --git a/api_docs/unified_histogram.mdx b/api_docs/unified_histogram.mdx
index 4f2ff48629358..1d8886c83fdfe 100644
--- a/api_docs/unified_histogram.mdx
+++ b/api_docs/unified_histogram.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedHistogram
 title: "unifiedHistogram"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedHistogram plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedHistogram']
 ---
 import unifiedHistogramObj from './unified_histogram.devdocs.json';
diff --git a/api_docs/unified_search.mdx b/api_docs/unified_search.mdx
index 716bf96728f17..5bc0db815e546 100644
--- a/api_docs/unified_search.mdx
+++ b/api_docs/unified_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch
 title: "unifiedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch']
 ---
 import unifiedSearchObj from './unified_search.devdocs.json';
diff --git a/api_docs/unified_search_autocomplete.mdx b/api_docs/unified_search_autocomplete.mdx
index 20aa367104dcf..bc152247c68ee 100644
--- a/api_docs/unified_search_autocomplete.mdx
+++ b/api_docs/unified_search_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch-autocomplete
 title: "unifiedSearch.autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch.autocomplete plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch.autocomplete']
 ---
 import unifiedSearchAutocompleteObj from './unified_search_autocomplete.devdocs.json';
diff --git a/api_docs/uptime.mdx b/api_docs/uptime.mdx
index 7ad6d527b374b..e29055b1b9950 100644
--- a/api_docs/uptime.mdx
+++ b/api_docs/uptime.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uptime
 title: "uptime"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uptime plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uptime']
 ---
 import uptimeObj from './uptime.devdocs.json';
diff --git a/api_docs/url_forwarding.mdx b/api_docs/url_forwarding.mdx
index 4ba133a68689c..5f0570c3fa0d5 100644
--- a/api_docs/url_forwarding.mdx
+++ b/api_docs/url_forwarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/urlForwarding
 title: "urlForwarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the urlForwarding plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'urlForwarding']
 ---
 import urlForwardingObj from './url_forwarding.devdocs.json';
diff --git a/api_docs/usage_collection.mdx b/api_docs/usage_collection.mdx
index e0f179e68ff10..2004fffdf9203 100644
--- a/api_docs/usage_collection.mdx
+++ b/api_docs/usage_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/usageCollection
 title: "usageCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the usageCollection plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'usageCollection']
 ---
 import usageCollectionObj from './usage_collection.devdocs.json';
diff --git a/api_docs/ux.mdx b/api_docs/ux.mdx
index 490dffba1e0c2..961badd1a3aa2 100644
--- a/api_docs/ux.mdx
+++ b/api_docs/ux.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ux
 title: "ux"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ux plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ux']
 ---
 import uxObj from './ux.devdocs.json';
diff --git a/api_docs/vis_default_editor.mdx b/api_docs/vis_default_editor.mdx
index eedc2c019d23e..ebc68f992532d 100644
--- a/api_docs/vis_default_editor.mdx
+++ b/api_docs/vis_default_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visDefaultEditor
 title: "visDefaultEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visDefaultEditor plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visDefaultEditor']
 ---
 import visDefaultEditorObj from './vis_default_editor.devdocs.json';
diff --git a/api_docs/vis_type_gauge.mdx b/api_docs/vis_type_gauge.mdx
index 15ba59a5a1275..6fd5f786330d0 100644
--- a/api_docs/vis_type_gauge.mdx
+++ b/api_docs/vis_type_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeGauge
 title: "visTypeGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeGauge plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeGauge']
 ---
 import visTypeGaugeObj from './vis_type_gauge.devdocs.json';
diff --git a/api_docs/vis_type_heatmap.mdx b/api_docs/vis_type_heatmap.mdx
index ac23e0ff4e61e..4fc7751981ae9 100644
--- a/api_docs/vis_type_heatmap.mdx
+++ b/api_docs/vis_type_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeHeatmap
 title: "visTypeHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeHeatmap plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeHeatmap']
 ---
 import visTypeHeatmapObj from './vis_type_heatmap.devdocs.json';
diff --git a/api_docs/vis_type_pie.mdx b/api_docs/vis_type_pie.mdx
index 83f111c2a1190..230f5545c332a 100644
--- a/api_docs/vis_type_pie.mdx
+++ b/api_docs/vis_type_pie.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypePie
 title: "visTypePie"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypePie plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypePie']
 ---
 import visTypePieObj from './vis_type_pie.devdocs.json';
diff --git a/api_docs/vis_type_table.mdx b/api_docs/vis_type_table.mdx
index 4c01c8841810a..9477acc939607 100644
--- a/api_docs/vis_type_table.mdx
+++ b/api_docs/vis_type_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTable
 title: "visTypeTable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTable plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTable']
 ---
 import visTypeTableObj from './vis_type_table.devdocs.json';
diff --git a/api_docs/vis_type_timelion.mdx b/api_docs/vis_type_timelion.mdx
index 9a6a5f5a514a8..fdcba6bcad8cb 100644
--- a/api_docs/vis_type_timelion.mdx
+++ b/api_docs/vis_type_timelion.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimelion
 title: "visTypeTimelion"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimelion plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimelion']
 ---
 import visTypeTimelionObj from './vis_type_timelion.devdocs.json';
diff --git a/api_docs/vis_type_timeseries.mdx b/api_docs/vis_type_timeseries.mdx
index e0a2872da856d..2fc9b97219976 100644
--- a/api_docs/vis_type_timeseries.mdx
+++ b/api_docs/vis_type_timeseries.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimeseries
 title: "visTypeTimeseries"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimeseries plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimeseries']
 ---
 import visTypeTimeseriesObj from './vis_type_timeseries.devdocs.json';
diff --git a/api_docs/vis_type_vega.mdx b/api_docs/vis_type_vega.mdx
index 377733d865630..304bc7edc65b5 100644
--- a/api_docs/vis_type_vega.mdx
+++ b/api_docs/vis_type_vega.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVega
 title: "visTypeVega"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVega plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVega']
 ---
 import visTypeVegaObj from './vis_type_vega.devdocs.json';
diff --git a/api_docs/vis_type_vislib.mdx b/api_docs/vis_type_vislib.mdx
index 926628184f4ef..2317ed06e02a4 100644
--- a/api_docs/vis_type_vislib.mdx
+++ b/api_docs/vis_type_vislib.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVislib
 title: "visTypeVislib"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVislib plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVislib']
 ---
 import visTypeVislibObj from './vis_type_vislib.devdocs.json';
diff --git a/api_docs/vis_type_xy.mdx b/api_docs/vis_type_xy.mdx
index fb9e61c42d161..b4d84cdd1c6a9 100644
--- a/api_docs/vis_type_xy.mdx
+++ b/api_docs/vis_type_xy.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeXy
 title: "visTypeXy"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeXy plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeXy']
 ---
 import visTypeXyObj from './vis_type_xy.devdocs.json';
diff --git a/api_docs/visualizations.devdocs.json b/api_docs/visualizations.devdocs.json
index e40e1b2ef4a6c..12ab849abf499 100644
--- a/api_docs/visualizations.devdocs.json
+++ b/api_docs/visualizations.devdocs.json
@@ -15214,7 +15214,7 @@
         "label": "Operation",
         "description": [],
         "signature": [
-          "\"min\" | \"max\" | \"sum\" | \"median\" | \"count\" | \"filters\" | \"range\" | \"date_histogram\" | \"percentile\" | \"average\" | \"terms\" | \"cumulative_sum\" | \"moving_average\" | \"unique_count\" | \"standard_deviation\" | \"percentile_rank\" | \"last_value\" | \"counter_rate\" | \"differences\" | \"formula\" | \"static_value\" | \"normalize_by_unit\""
+          "\"min\" | \"max\" | \"sum\" | \"median\" | \"count\" | \"filters\" | \"last_value\" | \"percentile\" | \"range\" | \"date_histogram\" | \"average\" | \"terms\" | \"cumulative_sum\" | \"moving_average\" | \"unique_count\" | \"standard_deviation\" | \"percentile_rank\" | \"counter_rate\" | \"differences\" | \"formula\" | \"static_value\" | \"normalize_by_unit\""
         ],
         "path": "src/plugins/visualizations/common/convert_to_lens/types/operations.ts",
         "deprecated": false,
@@ -15244,7 +15244,7 @@
         "label": "OperationWithSourceField",
         "description": [],
         "signature": [
-          "\"min\" | \"max\" | \"sum\" | \"median\" | \"count\" | \"filters\" | \"range\" | \"date_histogram\" | \"percentile\" | \"average\" | \"terms\" | \"unique_count\" | \"standard_deviation\" | \"percentile_rank\" | \"last_value\""
+          "\"min\" | \"max\" | \"sum\" | \"median\" | \"count\" | \"filters\" | \"last_value\" | \"percentile\" | \"range\" | \"date_histogram\" | \"average\" | \"terms\" | \"unique_count\" | \"standard_deviation\" | \"percentile_rank\""
         ],
         "path": "src/plugins/visualizations/common/convert_to_lens/types/operations.ts",
         "deprecated": false,
diff --git a/api_docs/visualizations.mdx b/api_docs/visualizations.mdx
index 8f0df503aa367..0df559e04aa93 100644
--- a/api_docs/visualizations.mdx
+++ b/api_docs/visualizations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visualizations
 title: "visualizations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visualizations plugin
-date: 2023-10-17
+date: 2023-10-18
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visualizations']
 ---
 import visualizationsObj from './visualizations.devdocs.json';
diff --git a/catalog-info.yaml b/catalog-info.yaml
index 00637fb1a039b..e7aa120004486 100644
--- a/catalog-info.yaml
+++ b/catalog-info.yaml
@@ -56,6 +56,8 @@ spec:
       teams:
         kibana-operations:
           access_level: MANAGE_BUILD_AND_READ
+        appex-qa:
+          access_level: BUILD_AND_READ
         security-engineering-productivity:
           access_level: BUILD_AND_READ
         fleet:
diff --git a/config/serverless.oblt.yml b/config/serverless.oblt.yml
index ed011cd90063a..a1d0edce6f168 100644
--- a/config/serverless.oblt.yml
+++ b/config/serverless.oblt.yml
@@ -16,6 +16,9 @@ xpack.serverless.observability.enabled: true
 ## Set the home route
 uiSettings.overrides.defaultRoute: /app/observability/landing
 
+# Customize empty page state for analytics apps
+no_data_page.analyticsNoDataPageFlavor: 'serverless_observability'
+
 ## Set the dev project switch current type
 xpack.serverless.plugin.developer.projectSwitcher.currentType: 'observability'
 
@@ -47,6 +50,9 @@ xpack.fleet.internal.registry.excludePackages: [
 xpack.fleet.packages:
   - name: apm
     version: latest
+# fleet_server package installed to publish agent metrics
+  - name: fleet_server
+    version: latest  
 ## Disable APM UI components and API calls
 xpack.apm.featureFlags.agentConfigurationAvailable: false
 xpack.apm.featureFlags.configurableIndicesAvailable: false
diff --git a/config/serverless.security.yml b/config/serverless.security.yml
index d5edac4507c5d..bf6c914bfaa1a 100644
--- a/config/serverless.security.yml
+++ b/config/serverless.security.yml
@@ -50,6 +50,10 @@ xpack.fleet.internal.registry.excludePackages: [
     'symantec',
     'cyberark',
   ]
+# fleet_server package installed to publish agent metrics
+xpack.fleet.packages:
+  - name: fleet_server
+    version: latest  
 
 xpack.ml.ad.enabled: true
 xpack.ml.dfa.enabled: true
diff --git a/config/serverless.yml b/config/serverless.yml
index 30c4aff914a51..97a7e638eb2d8 100644
--- a/config/serverless.yml
+++ b/config/serverless.yml
@@ -42,6 +42,8 @@ xpack.index_management.enableIndexActions: false
 xpack.index_management.enableLegacyTemplates: false
 # Disable index stats information from Index Management UI
 xpack.index_management.enableIndexStats: false
+# Only limited index settings can be edited
+xpack.index_management.editableIndexSettings: limited
 
 # Keep deeplinks visible so that they are shown in the sidenav
 dev_tools.deeplinks.navLinkStatus: visible
diff --git a/docs/api-generated/README.md b/docs/api-generated/README.md
deleted file mode 100644
index 97fd32119b8bc..0000000000000
--- a/docs/api-generated/README.md
+++ /dev/null
@@ -1,42 +0,0 @@
-# OpenAPI (Experimental)
-
-Open API specifications (OAS) exist in JSON or YAML format for some Kibana features,
-though they are experimental and may be incomplete or change later.
-
-A preview of the API specifications can be added to the Kibana Guide by using
-the following process:
-
-. Install [OpenAPI Generator](https://openapi-generator.tech/docs/installation),
-or a similar tool that can generate HTML output from OAS.
-
-. Optionally validate the specifications by using the commands listed in the appropriate readmes.
-
-. Generate HTML output. For example:
-
-  ```
-  openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/alerting/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/rules -t $GIT_HOME/kibana/docs/api-generated/template
-
-  openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/cases/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/cases -t $GIT_HOME/kibana/docs/api-generated/template
-
-  openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/actions/docs/openapi/bundled.yaml -o $GIT_HOME/kibana/docs/api-generated/connectors -t $GIT_HOME/kibana/docs/api-generated/template
-
-  openapi-generator-cli generate -g html -i $GIT_HOME/kibana/x-pack/plugins/ml/common/openapi/ml_apis_v3.yaml -o $GIT_HOME/kibana/docs/api-generated/machine-learning -t $GIT_HOME/kibana/docs/api-generated/template
-  ```
-
-. Rename the output files. For example:
-  ```
-  mv $GIT_HOME/kibana/docs/api-generated/rules/index.html $GIT_HOME/kibana/docs/api-generated/rules/rule-apis-passthru.asciidoc
-  mv $GIT_HOME/kibana/docs/api-generated/cases/index.html $GIT_HOME/kibana/docs/api-generated/cases/case-apis-passthru.asciidoc
-  mv $GIT_HOME/kibana/docs/api-generated/connectors/index.html $GIT_HOME/kibana/docs/api-generated/connectors/connector-apis-passthru.asciidoc
-  mv $GIT_HOME/kibana/docs/api-generated/machine-learning/index.html $GIT_HOME/kibana/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc
-  ```
-
-. If you're creating a new set of API output, you will need to have a page that incorporates the output by using passthrough blocks. For more information, refer to [Asciidoctor docs](https://docs.asciidoctor.org/asciidoc/latest/pass/pass-block/)
-
-. Verify the output by building the Kibana documentation. At this time, the output is added as a technical preview in the appendix.
-
-## Known issues
-
-- Some OAS 3.0 features such as `anyOf`, `oneOf`, and `allOf` might not display properly in the preview. These are on the [Short-term roadmap](https://openapi-generator.tech/docs/roadmap/) at this time.
-
-
diff --git a/docs/api-generated/cases/case-apis-passthru.asciidoc b/docs/api-generated/cases/case-apis-passthru.asciidoc
deleted file mode 100644
index eb354b320d899..0000000000000
--- a/docs/api-generated/cases/case-apis-passthru.asciidoc
+++ /dev/null
@@ -1,5511 +0,0 @@
-////
-This content is generated from the open API specification.
-Any modifications made to this file will be overwritten.
-////
-
-++++
-<div class="openapi">
-  <h2>Access</h2>
-    <ol>
-      <li>APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true</li>
-      <li>HTTP Basic Authentication</li>
-    </ol>
-
-  <h2><a name="__Methods">Methods</a></h2>
-  [ Jump to <a href="#__Models">Models</a> ]
-
-  <h3>Table of Contents </h3>
-  <div class="method-summary"></div>
-  <h4><a href="#Cases">Cases</a></h4>
-  <ul>
-  <li><a href="#addCaseComment"><code><span class="http-method">post</span> /s/{spaceId}/api/cases/{caseId}/comments</code></a></li>
-  <li><a href="#addCaseCommentDefaultSpace"><code><span class="http-method">post</span> /api/cases/{caseId}/comments</code></a></li>
-  <li><a href="#createCase"><code><span class="http-method">post</span> /s/{spaceId}/api/cases</code></a></li>
-  <li><a href="#createCaseDefaultSpace"><code><span class="http-method">post</span> /api/cases</code></a></li>
-  <li><a href="#deleteCase"><code><span class="http-method">delete</span> /s/{spaceId}/api/cases</code></a></li>
-  <li><a href="#deleteCaseComment"><code><span class="http-method">delete</span> /s/{spaceId}/api/cases/{caseId}/comments/{commentId}</code></a></li>
-  <li><a href="#deleteCaseCommentDefaultSpace"><code><span class="http-method">delete</span> /api/cases/{caseId}/comments/{commentId}</code></a></li>
-  <li><a href="#deleteCaseComments"><code><span class="http-method">delete</span> /s/{spaceId}/api/cases/{caseId}/comments</code></a></li>
-  <li><a href="#deleteCaseCommentsDefaultSpace"><code><span class="http-method">delete</span> /api/cases/{caseId}/comments</code></a></li>
-  <li><a href="#deleteCaseDefaultSpace"><code><span class="http-method">delete</span> /api/cases</code></a></li>
-  <li><a href="#findCaseActivity"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/user_actions/_find</code></a></li>
-  <li><a href="#findCaseActivityDefaultSpace"><code><span class="http-method">get</span> /api/cases/{caseId}/user_actions/_find</code></a></li>
-  <li><a href="#findCaseComments"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/comments/_find</code></a></li>
-  <li><a href="#findCaseConnectors"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/configure/connectors/_find</code></a></li>
-  <li><a href="#findCaseConnectorsDefaultSpace"><code><span class="http-method">get</span> /api/cases/configure/connectors/_find</code></a></li>
-  <li><a href="#findCases"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/_find</code></a></li>
-  <li><a href="#findCasesDefaultSpace"><code><span class="http-method">get</span> /api/cases/_find</code></a></li>
-  <li><a href="#getAllCaseComments"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/comments</code></a></li>
-  <li><a href="#getAllCaseCommentsDefaultSpace"><code><span class="http-method">get</span> /api/cases/{caseId}/comments</code></a></li>
-  <li><a href="#getCase"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}</code></a></li>
-  <li><a href="#getCaseActivity"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/user_actions</code></a></li>
-  <li><a href="#getCaseActivityDefaultSpace"><code><span class="http-method">get</span> /api/cases/{caseId}/user_actions</code></a></li>
-  <li><a href="#getCaseAlerts"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/alerts</code></a></li>
-  <li><a href="#getCaseAlertsDefaultSpace"><code><span class="http-method">get</span> /api/cases/{caseId}/alerts</code></a></li>
-  <li><a href="#getCaseComment"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/comments/{commentId}</code></a></li>
-  <li><a href="#getCaseCommentDefaultSpace"><code><span class="http-method">get</span> /api/cases/{caseId}/comments/{commentId}</code></a></li>
-  <li><a href="#getCaseConfiguration"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/configure</code></a></li>
-  <li><a href="#getCaseConfigurationDefaultSpace"><code><span class="http-method">get</span> /api/cases/configure</code></a></li>
-  <li><a href="#getCaseDefaultSpace"><code><span class="http-method">get</span> /api/cases/{caseId}</code></a></li>
-  <li><a href="#getCaseReporters"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/reporters</code></a></li>
-  <li><a href="#getCaseReportersDefaultSpace"><code><span class="http-method">get</span> /api/cases/reporters</code></a></li>
-  <li><a href="#getCaseStatus"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/status</code></a></li>
-  <li><a href="#getCaseStatusDefaultSpace"><code><span class="http-method">get</span> /api/cases/status</code></a></li>
-  <li><a href="#getCaseTags"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/tags</code></a></li>
-  <li><a href="#getCaseTagsDefaultSpace"><code><span class="http-method">get</span> /api/cases/tags</code></a></li>
-  <li><a href="#getCasesByAlert"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/alerts/{alertId}</code></a></li>
-  <li><a href="#getCasesByAlertDefaultSpace"><code><span class="http-method">get</span> /api/cases/alerts/{alertId}</code></a></li>
-  <li><a href="#pushCase"><code><span class="http-method">post</span> /s/{spaceId}/api/cases/{caseId}/connector/{connectorId}/_push</code></a></li>
-  <li><a href="#pushCaseDefaultSpace"><code><span class="http-method">post</span> /api/cases/{caseId}/connector/{connectorId}/_push</code></a></li>
-  <li><a href="#setCaseConfiguration"><code><span class="http-method">post</span> /s/{spaceId}/api/cases/configure</code></a></li>
-  <li><a href="#setCaseConfigurationDefaultSpace"><code><span class="http-method">post</span> /api/cases/configure</code></a></li>
-  <li><a href="#updateCase"><code><span class="http-method">patch</span> /s/{spaceId}/api/cases</code></a></li>
-  <li><a href="#updateCaseComment"><code><span class="http-method">patch</span> /s/{spaceId}/api/cases/{caseId}/comments</code></a></li>
-  <li><a href="#updateCaseCommentDefaultSpace"><code><span class="http-method">patch</span> /api/cases/{caseId}/comments</code></a></li>
-  <li><a href="#updateCaseConfiguration"><code><span class="http-method">patch</span> /s/{spaceId}/api/cases/configure/{configurationId}</code></a></li>
-  <li><a href="#updateCaseConfigurationDefaultSpace"><code><span class="http-method">patch</span> /api/cases/configure/{configurationId}</code></a></li>
-  <li><a href="#updateCaseDefaultSpace"><code><span class="http-method">patch</span> /api/cases</code></a></li>
-  </ul>
-
-  <h1><a name="Cases">Cases</a></h1>
-  <div class="method"><a name="addCaseComment"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/cases/{caseId}/comments</code></pre></div>
-    <div class="method-summary">Adds a comment or alert to a case. (<span class="nickname">addCaseComment</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">add_case_comment_request <a href="#add_case_comment_request">add_case_comment_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="addCaseCommentDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /api/cases/{caseId}/comments</code></pre></div>
-    <div class="method-summary">Adds a comment or alert to a case in the default space. (<span class="nickname">addCaseCommentDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">add_case_comment_request <a href="#add_case_comment_request">add_case_comment_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="createCase"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/cases</code></pre></div>
-    <div class="method-summary">Creates a case. (<span class="nickname">createCase</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana  feature privileges, depending on the owner of the case you're creating.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">create_case_request <a href="#create_case_request">create_case_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="createCaseDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /api/cases</code></pre></div>
-    <div class="method-summary">Creates a case in the default space. (<span class="nickname">createCaseDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana  feature privileges, depending on the owner of the case you're creating.</div>
-
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">create_case_request <a href="#create_case_request">create_case_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="deleteCase"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /s/{spaceId}/api/cases</code></pre></div>
-    <div class="method-summary">Deletes one or more cases. (<span class="nickname">deleteCase</span>)</div>
-    <div class="method-notes">You must have <code>read</code> or <code>all</code> privileges and the <code>delete</code> sub-feature privilege for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're deleting.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">ids (required)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The cases that you want to removed. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="deleteCaseComment"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /s/{spaceId}/api/cases/{caseId}/comments/{commentId}</code></pre></div>
-    <div class="method-summary">Deletes a comment or alert from a case. (<span class="nickname">deleteCaseComment</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're deleting.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">commentId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="deleteCaseCommentDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /api/cases/{caseId}/comments/{commentId}</code></pre></div>
-    <div class="method-summary">Deletes a comment or alert from a case in the default space. (<span class="nickname">deleteCaseCommentDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're deleting.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">commentId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="deleteCaseComments"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /s/{spaceId}/api/cases/{caseId}/comments</code></pre></div>
-    <div class="method-summary">Deletes all comments and alerts from a case. (<span class="nickname">deleteCaseComments</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're deleting.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="deleteCaseCommentsDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /api/cases/{caseId}/comments</code></pre></div>
-    <div class="method-summary">Deletes all comments and alerts from a case in the default space. (<span class="nickname">deleteCaseCommentsDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're deleting.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="deleteCaseDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /api/cases</code></pre></div>
-    <div class="method-summary">Deletes one or more cases in the default space. (<span class="nickname">deleteCaseDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>read</code> or <code>all</code> privileges and the <code>delete</code> sub-feature privilege for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're deleting.</div>
-
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">ids (required)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The cases that you want to removed. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="findCaseActivity"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/user_actions/_find</code></pre></div>
-    <div class="method-summary">Finds user activity for a case. (<span class="nickname">findCaseActivity</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">sortOrder (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div><div class="param">types (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the types of user actions to return. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#findCaseActivity_200_response">findCaseActivity_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "userActions" : [ {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  }, {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  } ],
-  "total" : 1,
-  "perPage" : 6,
-  "page" : 0
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#findCaseActivity_200_response">findCaseActivity_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="findCaseActivityDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/{caseId}/user_actions/_find</code></pre></div>
-    <div class="method-summary">Finds user activity for a case in the default space. (<span class="nickname">findCaseActivityDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">sortOrder (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div><div class="param">types (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the types of user actions to return. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#findCaseActivityDefaultSpace_200_response">findCaseActivityDefaultSpace_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "userActions" : [ {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  }, {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  }, {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  }, {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  }, {
-    "owner" : "cases",
-    "action" : "create",
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-    "type" : "create_case",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzM1ODg4LDFd"
-  } ],
-  "total" : 1,
-  "perPage" : 6,
-  "page" : 0
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#findCaseActivityDefaultSpace_200_response">findCaseActivityDefaultSpace_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="findCaseComments"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/comments/_find</code></pre></div>
-    <div class="method-summary">Retrieves all the user comments from a case. (<span class="nickname">findCaseComments</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">sortOrder (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="findCaseConnectors"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/configure/connectors/_find</code></pre></div>
-    <div class="method-summary">Retrieves information about connectors. (<span class="nickname">findCaseConnectors</span>)</div>
-    <div class="method-notes">In particular, only the connectors that are supported for use in cases are returned. You must have <code>read</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#findCaseConnectorsDefaultSpace_200_response_inner">findCaseConnectorsDefaultSpace_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : ".none",
-  "referencedByCount" : 0,
-  "name" : "name",
-  "id" : "id",
-  "config" : {
-    "projectKey" : "projectKey",
-    "apiUrl" : "apiUrl"
-  },
-  "isMissingSecrets" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="findCaseConnectorsDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/configure/connectors/_find</code></pre></div>
-    <div class="method-summary">Retrieves information about connectors in the default space. (<span class="nickname">findCaseConnectorsDefaultSpace</span>)</div>
-    <div class="method-notes">In particular, only the connectors that are supported for use in cases are returned. You must have <code>read</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges.</div>
-
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#findCaseConnectorsDefaultSpace_200_response_inner">findCaseConnectorsDefaultSpace_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : ".none",
-  "referencedByCount" : 0,
-  "name" : "name",
-  "id" : "id",
-  "config" : {
-    "projectKey" : "projectKey",
-    "apiUrl" : "apiUrl"
-  },
-  "isMissingSecrets" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="findCases"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/_find</code></pre></div>
-    <div class="method-summary">Retrieves a paginated subset of cases. (<span class="nickname">findCases</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">assignees (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by assignees. Valid values are <code>none</code> or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. default: null </div><div class="param">category (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by category. default: null </div><div class="param">defaultSearchOperator (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; he default operator to use for the simple_query_string. default: OR </div><div class="param">from (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; [preview] Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. default: null </div><div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div><div class="param">page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">reporters (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by the user name of the reporter. default: null </div><div class="param">search (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; An Elasticsearch simple_query_string query that filters the objects in the response. default: null </div><div class="param">searchFields (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The fields to perform the simple_query_string parsed query against. default: null </div><div class="param">severity (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The severity of the case. default: null </div><div class="param">sortField (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines which field is used to sort the results. default: createdAt </div><div class="param">sortOrder (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div><div class="param">status (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by state. default: null </div><div class="param">tags (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by tags. default: null </div><div class="param">to (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; [preview] Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#findCases_200_response">findCases_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "count_in_progress_cases" : 6,
-  "per_page" : 5,
-  "total" : 2,
-  "cases" : [ {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null, null, null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  }, {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null, null, null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  } ],
-  "count_open_cases" : 1,
-  "count_closed_cases" : 0,
-  "page" : 5
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#findCases_200_response">findCases_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="findCasesDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/_find</code></pre></div>
-    <div class="method-summary">Retrieves a paginated subset of cases in the default space. (<span class="nickname">findCasesDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">assignees (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by assignees. Valid values are <code>none</code> or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. default: null </div><div class="param">category (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by category. default: null </div><div class="param">defaultSearchOperator (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; he default operator to use for the simple_query_string. default: OR </div><div class="param">from (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; [preview] Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. default: null </div><div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div><div class="param">page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">reporters (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by the user name of the reporter. default: null </div><div class="param">search (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; An Elasticsearch simple_query_string query that filters the objects in the response. default: null </div><div class="param">searchFields (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The fields to perform the simple_query_string parsed query against. default: null </div><div class="param">severity (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The severity of the case. default: null </div><div class="param">sortField (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines which field is used to sort the results. default: createdAt </div><div class="param">sortOrder (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div><div class="param">status (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by state. default: null </div><div class="param">tags (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by tags. default: null </div><div class="param">to (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; [preview] Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#findCasesDefaultSpace_200_response">findCasesDefaultSpace_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "count_in_progress_cases" : 6,
-  "per_page" : 5,
-  "total" : 2,
-  "cases" : [ {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null, null, null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  }, {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null, null, null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  }, {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null, null, null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  }, {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null, null, null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  }, {
-    "owner" : "cases",
-    "totalComment" : 0,
-    "settings" : {
-      "syncAlerts" : true
-    },
-    "totalAlerts" : 0,
-    "closed_at" : "2000-01-23T04:56:07.000+00:00",
-    "comments" : [ null, null, null, null, null ],
-    "assignees" : [ {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    }, {
-      "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-    } ],
-    "created_at" : "2022-05-13T09:16:17.416Z",
-    "description" : "A case description.",
-    "title" : "Case title 1",
-    "created_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "version" : "WzUzMiwxXQ==",
-    "closed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "tags" : [ "tag-1" ],
-    "duration" : 120,
-    "updated_at" : "2000-01-23T04:56:07.000+00:00",
-    "updated_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-    "external_service" : {
-      "external_title" : "external_title",
-      "pushed_by" : {
-        "full_name" : "full_name",
-        "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-        "email" : "email",
-        "username" : "elastic"
-      },
-      "external_url" : "external_url",
-      "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-      "connector_id" : "connector_id",
-      "external_id" : "external_id",
-      "connector_name" : "connector_name"
-    }
-  } ],
-  "count_open_cases" : 1,
-  "count_closed_cases" : 0,
-  "page" : 5
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#findCasesDefaultSpace_200_response">findCasesDefaultSpace_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getAllCaseComments"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/comments</code></pre></div>
-    <div class="method-summary">Retrieves all the comments from a case. (<span class="nickname">getAllCaseComments</span>)</div>
-    <div class="method-notes">Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; instead, use the get case comment API, which requires a comment identifier in the path. You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getAllCaseCommentsDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/{caseId}/comments</code></pre></div>
-    <div class="method-summary">Retrieves all the comments from a case in the default space. (<span class="nickname">getAllCaseCommentsDefaultSpace</span>)</div>
-    <div class="method-notes">Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; instead, use the get case comment API, which requires a comment identifier in the path. You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCase"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}</code></pre></div>
-    <div class="method-summary">Retrieves information about a case. (<span class="nickname">getCase</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">includeComments (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Deprecated in 8.1.0. This parameter is deprecated and will be removed in a future release. It determines whether case comments are returned. default: true </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseActivity"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/user_actions</code></pre></div>
-    <div class="method-summary">Returns all user activity for a case. (<span class="nickname">getCaseActivity</span>)</div>
-    <div class="method-notes">Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#user_actions_response_properties">user_actions_response_properties</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "action_id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-  "case_id" : "22df07d0-03b1-11ed-920c-974bfa104448",
-  "action" : "create",
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-  "type" : "create_case",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseActivityDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/{caseId}/user_actions</code></pre></div>
-    <div class="method-summary">Returns all user activity for a case in the default space. (<span class="nickname">getCaseActivityDefaultSpace</span>)</div>
-    <div class="method-notes">Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find user actions API instead. You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#user_actions_response_properties">user_actions_response_properties</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "action_id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
-  "case_id" : "22df07d0-03b1-11ed-920c-974bfa104448",
-  "action" : "create",
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
-  "type" : "create_case",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseAlerts"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/alerts</code></pre></div>
-    <div class="method-summary">Gets all alerts attached to a case. (<span class="nickname">getCaseAlerts</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#alert_response_properties">alert_response_properties</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "index" : "index",
-  "id" : "id",
-  "attached_at" : "2000-01-23T04:56:07.000+00:00"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseAlertsDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/{caseId}/alerts</code></pre></div>
-    <div class="method-summary">Gets all alerts attached to a case in the default space. (<span class="nickname">getCaseAlertsDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#alert_response_properties">alert_response_properties</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "index" : "index",
-  "id" : "id",
-  "attached_at" : "2000-01-23T04:56:07.000+00:00"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseComment"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/comments/{commentId}</code></pre></div>
-    <div class="method-summary">Retrieves a comment from a case. (<span class="nickname">getCaseComment</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">commentId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#getCaseCommentDefaultSpace_200_response">getCaseCommentDefaultSpace_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>null</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#getCaseCommentDefaultSpace_200_response">getCaseCommentDefaultSpace_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseCommentDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/{caseId}/comments/{commentId}</code></pre></div>
-    <div class="method-summary">Retrieves a comment from a case in the default space. (<span class="nickname">getCaseCommentDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">commentId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#getCaseCommentDefaultSpace_200_response">getCaseCommentDefaultSpace_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>null</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#getCaseCommentDefaultSpace_200_response">getCaseCommentDefaultSpace_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseConfiguration"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/configure</code></pre></div>
-    <div class="method-summary">Retrieves external connection details, such as the closure type and default connector for cases. (<span class="nickname">getCaseConfiguration</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case configuration.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getCaseConfigurationDefaultSpace_200_response_inner">getCaseConfigurationDefaultSpace_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseConfigurationDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/configure</code></pre></div>
-    <div class="method-summary">Retrieves external connection details, such as the closure type and default connector for cases in the default space. (<span class="nickname">getCaseConfigurationDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case configuration.</div>
-
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getCaseConfigurationDefaultSpace_200_response_inner">getCaseConfigurationDefaultSpace_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/{caseId}</code></pre></div>
-    <div class="method-summary">Retrieves information about a case in the default space. (<span class="nickname">getCaseDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">includeComments (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Deprecated in 8.1.0. This parameter is deprecated and will be removed in a future release. It determines whether case comments are returned. default: true </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseReporters"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/reporters</code></pre></div>
-    <div class="method-summary">Returns information about the users who opened cases. (<span class="nickname">getCaseReporters</span>)</div>
-    <div class="method-notes">You must have read privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getCaseConfigurationDefaultSpace_200_response_inner_created_by">getCaseConfigurationDefaultSpace_200_response_inner_created_by</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "full_name" : "full_name",
-  "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-  "email" : "email",
-  "username" : "elastic"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseReportersDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/reporters</code></pre></div>
-    <div class="method-summary">Returns information about the users who opened cases in the default space. (<span class="nickname">getCaseReportersDefaultSpace</span>)</div>
-    <div class="method-notes">You must have read privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.</div>
-
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getCaseConfigurationDefaultSpace_200_response_inner_created_by">getCaseConfigurationDefaultSpace_200_response_inner_created_by</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "full_name" : "full_name",
-  "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-  "email" : "email",
-  "username" : "elastic"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseStatus"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/status</code></pre></div>
-    <div class="method-summary">Returns the number of cases that are open, closed, and in progress. (<span class="nickname">getCaseStatus</span>)</div>
-    <div class="method-notes">Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find cases API instead. You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#getCaseStatusDefaultSpace_200_response">getCaseStatusDefaultSpace_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "count_in_progress_cases" : 6,
-  "count_open_cases" : 1,
-  "count_closed_cases" : 0
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#getCaseStatusDefaultSpace_200_response">getCaseStatusDefaultSpace_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseStatusDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/status</code></pre></div>
-    <div class="method-summary">Returns the number of cases that are open, closed, and in progress in the default space. (<span class="nickname">getCaseStatusDefaultSpace</span>)</div>
-    <div class="method-notes">Deprecated in 8.1.0. This API is deprecated and will be removed in a future release; use the find cases API instead. You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#getCaseStatusDefaultSpace_200_response">getCaseStatusDefaultSpace_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "count_in_progress_cases" : 6,
-  "count_open_cases" : 1,
-  "count_closed_cases" : 0
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#getCaseStatusDefaultSpace_200_response">getCaseStatusDefaultSpace_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseTags"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/tags</code></pre></div>
-    <div class="method-summary">Aggregates and returns a list of case tags. (<span class="nickname">getCaseTags</span>)</div>
-    <div class="method-notes">You must have read privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      
-      array[String]
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>""</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCaseTagsDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/tags</code></pre></div>
-    <div class="method-summary">Aggregates and returns a list of case tags in the default space. (<span class="nickname">getCaseTagsDefaultSpace</span>)</div>
-    <div class="method-notes">You must have read privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      
-      array[String]
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>""</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCasesByAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/alerts/{alertId}</code></pre></div>
-    <div class="method-summary">Returns the cases associated with a specific alert. (<span class="nickname">getCasesByAlert</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the alert. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getCasesByAlertDefaultSpace_200_response_inner">getCasesByAlertDefaultSpace_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>[ {
-  "id" : "06116b80-e1c3-11ec-be9b-9b1838238ee6",
-  "title" : "security_case"
-} ]</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getCasesByAlertDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /api/cases/alerts/{alertId}</code></pre></div>
-    <div class="method-summary">Returns the cases associated with a specific alert in the default space. (<span class="nickname">getCasesByAlertDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the cases you're seeking.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the alert. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">owner (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getCasesByAlertDefaultSpace_200_response_inner">getCasesByAlertDefaultSpace_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>[ {
-  "id" : "06116b80-e1c3-11ec-be9b-9b1838238ee6",
-  "title" : "security_case"
-} ]</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="pushCase"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/cases/{caseId}/connector/{connectorId}/_push</code></pre></div>
-    <div class="method-summary">Pushes a case to an external service. (<span class="nickname">pushCase</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges. You must also have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're pushing.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">connectorId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the connector. To retrieve connector IDs, use the find connectors API. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">body <a href="#object">object</a> (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="pushCaseDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /api/cases/{caseId}/connector/{connectorId}/_push</code></pre></div>
-    <div class="method-summary">Pushes a case in the default space to an external service. (<span class="nickname">pushCaseDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges. You must also have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're pushing.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">connectorId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the connector. To retrieve connector IDs, use the find connectors API. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">body <a href="#object">object</a> (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="setCaseConfiguration"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/cases/configure</code></pre></div>
-    <div class="method-summary">Sets external connection details, such as the closure type and default connector for cases. (<span class="nickname">setCaseConfiguration</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">set_case_configuration_request <a href="#set_case_configuration_request">set_case_configuration_request</a> (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#getCaseConfigurationDefaultSpace_200_response_inner">getCaseConfigurationDefaultSpace_200_response_inner</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#getCaseConfigurationDefaultSpace_200_response_inner">getCaseConfigurationDefaultSpace_200_response_inner</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="setCaseConfigurationDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /api/cases/configure</code></pre></div>
-    <div class="method-summary">Sets external connection details, such as the closure type and default connector for cases in the default space. (<span class="nickname">setCaseConfigurationDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details.</div>
-
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">set_case_configuration_request <a href="#set_case_configuration_request">set_case_configuration_request</a> (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#getCaseConfigurationDefaultSpace_200_response_inner">getCaseConfigurationDefaultSpace_200_response_inner</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#getCaseConfigurationDefaultSpace_200_response_inner">getCaseConfigurationDefaultSpace_200_response_inner</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateCase"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="patch"><code class="huge"><span class="http-method">patch</span> /s/{spaceId}/api/cases</code></pre></div>
-    <div class="method-summary">Updates one or more cases. (<span class="nickname">updateCase</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the  <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana  feature privileges, depending on the owner of the case you're updating.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">update_case_request <a href="#update_case_request">update_case_request</a> (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#case_response_properties">case_response_properties</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateCaseComment"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="patch"><code class="huge"><span class="http-method">patch</span> /s/{spaceId}/api/cases/{caseId}/comments</code></pre></div>
-    <div class="method-summary">Updates a comment or alert in a case. (<span class="nickname">updateCaseComment</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">update_case_comment_request <a href="#update_case_comment_request">update_case_comment_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateCaseCommentDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="patch"><code class="huge"><span class="http-method">patch</span> /api/cases/{caseId}/comments</code></pre></div>
-    <div class="method-summary">Updates a comment or alert in a case in the default space. (<span class="nickname">updateCaseCommentDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">caseId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">update_case_comment_request <a href="#update_case_comment_request">update_case_comment_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#case_response_properties">case_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#case_response_properties">case_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateCaseConfiguration"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="patch"><code class="huge"><span class="http-method">patch</span> /s/{spaceId}/api/cases/configure/{configurationId}</code></pre></div>
-    <div class="method-summary">Updates external connection details, such as the closure type and default connector for cases. (<span class="nickname">updateCaseConfiguration</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">configurationId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the configuration. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">update_case_configuration_request <a href="#update_case_configuration_request">update_case_configuration_request</a> (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getCaseConfigurationDefaultSpace_200_response_inner">getCaseConfigurationDefaultSpace_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateCaseConfigurationDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="patch"><code class="huge"><span class="http-method">patch</span> /api/cases/configure/{configurationId}</code></pre></div>
-    <div class="method-summary">Updates external connection details, such as the closure type and default connector for cases in the default space. (<span class="nickname">updateCaseConfigurationDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case configuration. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Refer to the add connectors API.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">configurationId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the configuration. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">update_case_configuration_request <a href="#update_case_configuration_request">update_case_configuration_request</a> (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getCaseConfigurationDefaultSpace_200_response_inner">getCaseConfigurationDefaultSpace_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "closure_type" : "close-by-user",
-  "owner" : "cases",
-  "mappings" : [ {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  }, {
-    "action_type" : "overwrite",
-    "source" : "title",
-    "target" : "summary"
-  } ],
-  "connector" : {
-    "name" : "none",
-    "id" : "none",
-    "fields" : "{}",
-    "type" : ".none"
-  },
-  "updated_at" : "2022-06-01T19:58:48.169Z",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "created_at" : "2022-06-01T17:07:17.767Z",
-  "id" : "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
-  "error" : "error",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzIwNzMsMV0="
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateCaseDefaultSpace"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="patch"><code class="huge"><span class="http-method">patch</span> /api/cases</code></pre></div>
-    <div class="method-summary">Updates one or more cases in the default space. (<span class="nickname">updateCaseDefaultSpace</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Cases</strong> feature in the  <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana  feature privileges, depending on the owner of the case you're updating.</div>
-
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">update_case_request <a href="#update_case_request">update_case_request</a> (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#case_response_properties">case_response_properties</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "owner" : "cases",
-  "totalComment" : 0,
-  "settings" : {
-    "syncAlerts" : true
-  },
-  "totalAlerts" : 0,
-  "closed_at" : "2000-01-23T04:56:07.000+00:00",
-  "comments" : [ null, null, null, null, null ],
-  "assignees" : [ {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  }, {
-    "uid" : "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
-  } ],
-  "created_at" : "2022-05-13T09:16:17.416Z",
-  "description" : "A case description.",
-  "title" : "Case title 1",
-  "created_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "version" : "WzUzMiwxXQ==",
-  "closed_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "tags" : [ "tag-1" ],
-  "duration" : 120,
-  "updated_at" : "2000-01-23T04:56:07.000+00:00",
-  "updated_by" : {
-    "full_name" : "full_name",
-    "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-    "email" : "email",
-    "username" : "elastic"
-  },
-  "id" : "66b9aa00-94fa-11ea-9f74-e7e108796192",
-  "external_service" : {
-    "external_title" : "external_title",
-    "pushed_by" : {
-      "full_name" : "full_name",
-      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
-      "email" : "email",
-      "username" : "elastic"
-    },
-    "external_url" : "external_url",
-    "pushed_at" : "2000-01-23T04:56:07.000+00:00",
-    "connector_id" : "connector_id",
-    "external_id" : "external_id",
-    "connector_name" : "connector_name"
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#4xx_response">4xx_response</a>
-  </div> <!-- method -->
-  <hr/>
-
-  <h2><a name="__Models">Models</a></h2>
-  [ Jump to <a href="#__Methods">Methods</a> ]
-
-  <h3>Table of Contents</h3>
-  <ol>
-    <li><a href="#4xx_response"><code>4xx_response</code> - Unsuccessful cases API response</a></li>
-    <li><a href="#Case_response_properties_for_comments_inner"><code>Case_response_properties_for_comments_inner</code> - </a></li>
-    <li><a href="#Case_response_properties_for_connectors"><code>Case_response_properties_for_connectors</code> - Case response properties for connectors</a></li>
-    <li><a href="#action_types"><code>action_types</code> - </a></li>
-    <li><a href="#actions"><code>actions</code> - </a></li>
-    <li><a href="#add_alert_comment_request_properties"><code>add_alert_comment_request_properties</code> - Add case comment request properties for alerts</a></li>
-    <li><a href="#add_case_comment_request"><code>add_case_comment_request</code> - Add case comment request</a></li>
-    <li><a href="#add_user_comment_request_properties"><code>add_user_comment_request_properties</code> - Add case comment request properties for user comments</a></li>
-    <li><a href="#alert_comment_response_properties"><code>alert_comment_response_properties</code> - Add case comment response properties for alerts</a></li>
-    <li><a href="#alert_comment_response_properties_rule"><code>alert_comment_response_properties_rule</code> - </a></li>
-    <li><a href="#alert_identifiers"><code>alert_identifiers</code> - Alert identifiers</a></li>
-    <li><a href="#alert_indices"><code>alert_indices</code> - Alert indices</a></li>
-    <li><a href="#alert_response_properties"><code>alert_response_properties</code> - </a></li>
-    <li><a href="#assignees_inner"><code>assignees_inner</code> - </a></li>
-    <li><a href="#case_response_closed_by_properties"><code>case_response_closed_by_properties</code> - Case response properties for closed_by</a></li>
-    <li><a href="#case_response_created_by_properties"><code>case_response_created_by_properties</code> - Case response properties for created_by</a></li>
-    <li><a href="#case_response_properties"><code>case_response_properties</code> - Case response properties</a></li>
-    <li><a href="#case_response_pushed_by_properties"><code>case_response_pushed_by_properties</code> - Case response properties for pushed_by</a></li>
-    <li><a href="#case_response_updated_by_properties"><code>case_response_updated_by_properties</code> - Case response properties for updated_by</a></li>
-    <li><a href="#closure_types"><code>closure_types</code> - </a></li>
-    <li><a href="#connector_properties_cases_webhook"><code>connector_properties_cases_webhook</code> - Create or upate case request properties for Cases Webhook connector</a></li>
-    <li><a href="#connector_properties_jira"><code>connector_properties_jira</code> - Create or update case request properties for a Jira connector</a></li>
-    <li><a href="#connector_properties_jira_fields"><code>connector_properties_jira_fields</code> - </a></li>
-    <li><a href="#connector_properties_none"><code>connector_properties_none</code> - Create or update case request properties for no connector</a></li>
-    <li><a href="#connector_properties_resilient"><code>connector_properties_resilient</code> - Create case request properties for a IBM Resilient connector</a></li>
-    <li><a href="#connector_properties_resilient_fields"><code>connector_properties_resilient_fields</code> - </a></li>
-    <li><a href="#connector_properties_servicenow"><code>connector_properties_servicenow</code> - Create case request properties for a ServiceNow ITSM connector</a></li>
-    <li><a href="#connector_properties_servicenow_fields"><code>connector_properties_servicenow_fields</code> - </a></li>
-    <li><a href="#connector_properties_servicenow_sir"><code>connector_properties_servicenow_sir</code> - Create case request properties for a ServiceNow SecOps connector</a></li>
-    <li><a href="#connector_properties_servicenow_sir_fields"><code>connector_properties_servicenow_sir_fields</code> - </a></li>
-    <li><a href="#connector_properties_swimlane"><code>connector_properties_swimlane</code> - Create case request properties for a Swimlane connector</a></li>
-    <li><a href="#connector_properties_swimlane_fields"><code>connector_properties_swimlane_fields</code> - </a></li>
-    <li><a href="#connector_types"><code>connector_types</code> - </a></li>
-    <li><a href="#create_case_request"><code>create_case_request</code> - Create case request</a></li>
-    <li><a href="#create_case_request_connector"><code>create_case_request_connector</code> - </a></li>
-    <li><a href="#external_service"><code>external_service</code> - </a></li>
-    <li><a href="#findCaseActivityDefaultSpace_200_response"><code>findCaseActivityDefaultSpace_200_response</code> - </a></li>
-    <li><a href="#findCaseActivity_200_response"><code>findCaseActivity_200_response</code> - </a></li>
-    <li><a href="#findCaseConnectorsDefaultSpace_200_response_inner"><code>findCaseConnectorsDefaultSpace_200_response_inner</code> - </a></li>
-    <li><a href="#findCaseConnectorsDefaultSpace_200_response_inner_config"><code>findCaseConnectorsDefaultSpace_200_response_inner_config</code> - </a></li>
-    <li><a href="#findCasesDefaultSpace_200_response"><code>findCasesDefaultSpace_200_response</code> - </a></li>
-    <li><a href="#findCasesDefaultSpace_assignees_parameter"><code>findCasesDefaultSpace_assignees_parameter</code> - </a></li>
-    <li><a href="#findCasesDefaultSpace_owner_parameter"><code>findCasesDefaultSpace_owner_parameter</code> - </a></li>
-    <li><a href="#findCasesDefaultSpace_searchFields_parameter"><code>findCasesDefaultSpace_searchFields_parameter</code> - </a></li>
-    <li><a href="#findCases_200_response"><code>findCases_200_response</code> - </a></li>
-    <li><a href="#getCaseCommentDefaultSpace_200_response"><code>getCaseCommentDefaultSpace_200_response</code> - </a></li>
-    <li><a href="#getCaseConfigurationDefaultSpace_200_response_inner"><code>getCaseConfigurationDefaultSpace_200_response_inner</code> - </a></li>
-    <li><a href="#getCaseConfigurationDefaultSpace_200_response_inner_connector"><code>getCaseConfigurationDefaultSpace_200_response_inner_connector</code> - </a></li>
-    <li><a href="#getCaseConfigurationDefaultSpace_200_response_inner_created_by"><code>getCaseConfigurationDefaultSpace_200_response_inner_created_by</code> - </a></li>
-    <li><a href="#getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner"><code>getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner</code> - </a></li>
-    <li><a href="#getCaseConfigurationDefaultSpace_200_response_inner_updated_by"><code>getCaseConfigurationDefaultSpace_200_response_inner_updated_by</code> - </a></li>
-    <li><a href="#getCaseStatusDefaultSpace_200_response"><code>getCaseStatusDefaultSpace_200_response</code> - </a></li>
-    <li><a href="#getCasesByAlertDefaultSpace_200_response_inner"><code>getCasesByAlertDefaultSpace_200_response_inner</code> - </a></li>
-    <li><a href="#owners"><code>owners</code> - </a></li>
-    <li><a href="#payload_alert_comment"><code>payload_alert_comment</code> - </a></li>
-    <li><a href="#payload_alert_comment_comment"><code>payload_alert_comment_comment</code> - </a></li>
-    <li><a href="#payload_alert_comment_comment_alertId"><code>payload_alert_comment_comment_alertId</code> - </a></li>
-    <li><a href="#payload_alert_comment_comment_index"><code>payload_alert_comment_comment_index</code> - </a></li>
-    <li><a href="#payload_assignees"><code>payload_assignees</code> - </a></li>
-    <li><a href="#payload_connector"><code>payload_connector</code> - </a></li>
-    <li><a href="#payload_connector_connector"><code>payload_connector_connector</code> - </a></li>
-    <li><a href="#payload_connector_connector_fields"><code>payload_connector_connector_fields</code> - </a></li>
-    <li><a href="#payload_create_case"><code>payload_create_case</code> - </a></li>
-    <li><a href="#payload_description"><code>payload_description</code> - </a></li>
-    <li><a href="#payload_pushed"><code>payload_pushed</code> - </a></li>
-    <li><a href="#payload_settings"><code>payload_settings</code> - </a></li>
-    <li><a href="#payload_severity"><code>payload_severity</code> - </a></li>
-    <li><a href="#payload_status"><code>payload_status</code> - </a></li>
-    <li><a href="#payload_tags"><code>payload_tags</code> - </a></li>
-    <li><a href="#payload_title"><code>payload_title</code> - </a></li>
-    <li><a href="#payload_user_comment"><code>payload_user_comment</code> - </a></li>
-    <li><a href="#payload_user_comment_comment"><code>payload_user_comment_comment</code> - </a></li>
-    <li><a href="#rule"><code>rule</code> - Alerting rule</a></li>
-    <li><a href="#searchFieldsType"><code>searchFieldsType</code> - </a></li>
-    <li><a href="#set_case_configuration_request"><code>set_case_configuration_request</code> - Set case configuration request</a></li>
-    <li><a href="#set_case_configuration_request_connector"><code>set_case_configuration_request_connector</code> - </a></li>
-    <li><a href="#set_case_configuration_request_settings"><code>set_case_configuration_request_settings</code> - </a></li>
-    <li><a href="#settings"><code>settings</code> - </a></li>
-    <li><a href="#severity_property"><code>severity_property</code> - </a></li>
-    <li><a href="#status"><code>status</code> - </a></li>
-    <li><a href="#update_alert_comment_request_properties"><code>update_alert_comment_request_properties</code> - Update case comment request properties for alerts</a></li>
-    <li><a href="#update_case_comment_request"><code>update_case_comment_request</code> - Update case comment request</a></li>
-    <li><a href="#update_case_configuration_request"><code>update_case_configuration_request</code> - Update case configuration request</a></li>
-    <li><a href="#update_case_request"><code>update_case_request</code> - Update case request</a></li>
-    <li><a href="#update_case_request_cases_inner"><code>update_case_request_cases_inner</code> - </a></li>
-    <li><a href="#update_user_comment_request_properties"><code>update_user_comment_request_properties</code> - Update case comment request properties for user comments</a></li>
-    <li><a href="#user_actions_find_response_properties"><code>user_actions_find_response_properties</code> - </a></li>
-    <li><a href="#user_actions_response_properties"><code>user_actions_response_properties</code> - </a></li>
-    <li><a href="#user_actions_response_properties_created_by"><code>user_actions_response_properties_created_by</code> - </a></li>
-    <li><a href="#user_actions_response_properties_payload"><code>user_actions_response_properties_payload</code> - </a></li>
-    <li><a href="#user_comment_response_properties"><code>user_comment_response_properties</code> - Case response properties for user comments</a></li>
-  </ol>
-
-  <div class="model">
-    <h3><a name="4xx_response"><code>4xx_response</code> - Unsuccessful cases API response</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Case_response_properties_for_comments_inner"><code>Case_response_properties_for_comments_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alertId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">created_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">created_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_created_by_properties">case_response_created_by_properties</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">index (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">pushed_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">pushed_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_pushed_by_properties">case_response_pushed_by_properties</a></span>  </div>
-<div class="param">rule (optional)</div><div class="param-desc"><span class="param-type"><a href="#alert_comment_response_properties_rule">alert_comment_response_properties_rule</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">user</div>
-<div class="param">updated_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">updated_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_updated_by_properties">case_response_updated_by_properties</a></span>  </div>
-<div class="param">version (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Case_response_properties_for_connectors"><code>Case_response_properties_for_connectors</code> - Case response properties for connectors</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#connector_properties_swimlane_fields">connector_properties_swimlane_fields</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.swimlane</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="action_types"><code>action_types</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The type of action.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="actions"><code>actions</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="add_alert_comment_request_properties"><code>add_alert_comment_request_properties</code> - Add case comment request properties for alerts</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for case comment requests when type is alert.</div>
-    <div class="field-items">
-      <div class="param">alertId </div><div class="param-desc"><span class="param-type"><a href="#alert_identifiers">alert_identifiers</a></span>  </div>
-<div class="param">index </div><div class="param-desc"><span class="param-type"><a href="#alert_indices">alert_indices</a></span>  </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">rule </div><div class="param-desc"><span class="param-type"><a href="#rule">rule</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of comment. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">alert</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="add_case_comment_request"><code>add_case_comment_request</code> - Add case comment request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The add comment to case API request body varies depending on whether you are adding an alert or a comment.</div>
-    <div class="field-items">
-      <div class="param">alertId </div><div class="param-desc"><span class="param-type"><a href="#alert_identifiers">alert_identifiers</a></span>  </div>
-<div class="param">index </div><div class="param-desc"><span class="param-type"><a href="#alert_indices">alert_indices</a></span>  </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">rule </div><div class="param-desc"><span class="param-type"><a href="#rule">rule</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of comment. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">user</div>
-<div class="param">comment </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The new comment. It is required only when <code>type</code> is <code>user</code>. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="add_user_comment_request_properties"><code>add_user_comment_request_properties</code> - Add case comment request properties for user comments</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for case comment requests when type is user.</div>
-    <div class="field-items">
-      <div class="param">comment </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The new comment. It is required only when <code>type</code> is <code>user</code>. </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of comment. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">user</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="alert_comment_response_properties"><code>alert_comment_response_properties</code> - Add case comment response properties for alerts</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alertId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">created_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">created_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfigurationDefaultSpace_200_response_inner_created_by">getCaseConfigurationDefaultSpace_200_response_inner_created_by</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">index (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">pushed_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">pushed_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfigurationDefaultSpace_200_response_inner_updated_by">getCaseConfigurationDefaultSpace_200_response_inner_updated_by</a></span>  </div>
-<div class="param">rule (optional)</div><div class="param-desc"><span class="param-type"><a href="#alert_comment_response_properties_rule">alert_comment_response_properties_rule</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">alert</div>
-<div class="param">updated_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">updated_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfigurationDefaultSpace_200_response_inner_created_by">getCaseConfigurationDefaultSpace_200_response_inner_created_by</a></span>  </div>
-<div class="param">version (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="alert_comment_response_properties_rule"><code>alert_comment_response_properties_rule</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The rule identifier. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The rule name. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="alert_identifiers"><code>alert_identifiers</code> - Alert identifiers</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The alert identifiers. It is required only when <code>type</code> is <code>alert</code>. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; <code>index</code> must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="alert_indices"><code>alert_indices</code> - Alert indices</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The alert indices. It is required only when <code>type</code> is <code>alert</code>.  If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the <code>alertId</code> array. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="alert_response_properties"><code>alert_response_properties</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">attached_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The alert identifier. </div>
-<div class="param">index (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The alert index. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="assignees_inner"><code>assignees_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">uid </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="case_response_closed_by_properties"><code>case_response_closed_by_properties</code> - Case response properties for closed_by</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">email </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">full_name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">username </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">profile_uid (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="case_response_created_by_properties"><code>case_response_created_by_properties</code> - Case response properties for created_by</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">email </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">full_name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">username </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">profile_uid (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="case_response_properties"><code>case_response_properties</code> - Case response properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">assignees (optional)</div><div class="param-desc"><span class="param-type"><a href="#assignees_inner">array[assignees_inner]</a></span> An array containing users that are assigned to the case. </div>
-<div class="param">closed_at </div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">closed_by </div><div class="param-desc"><span class="param-type"><a href="#case_response_closed_by_properties">case_response_closed_by_properties</a></span>  </div>
-<div class="param">comments </div><div class="param-desc"><span class="param-type"><a href="#Case_response_properties_for_comments_inner">array[Case_response_properties_for_comments_inner]</a></span> An array of comment objects for the case. </div>
-<div class="param">connector </div><div class="param-desc"><span class="param-type"><a href="#Case_response_properties_for_connectors">Case_response_properties_for_connectors</a></span>  </div>
-<div class="param">created_at </div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">created_by </div><div class="param-desc"><span class="param-type"><a href="#case_response_created_by_properties">case_response_created_by_properties</a></span>  </div>
-<div class="param">description </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">duration </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero. </div>
-<div class="param">external_service </div><div class="param-desc"><span class="param-type"><a href="#external_service">external_service</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">settings </div><div class="param-desc"><span class="param-type"><a href="#settings">settings</a></span>  </div>
-<div class="param">severity </div><div class="param-desc"><span class="param-type"><a href="#severity_property">severity_property</a></span>  </div>
-<div class="param">status </div><div class="param-desc"><span class="param-type"><a href="#status">status</a></span>  </div>
-<div class="param">tags </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">title </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">totalAlerts </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">totalComment </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">updated_at </div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">updated_by </div><div class="param-desc"><span class="param-type"><a href="#case_response_updated_by_properties">case_response_updated_by_properties</a></span>  </div>
-<div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="case_response_pushed_by_properties"><code>case_response_pushed_by_properties</code> - Case response properties for pushed_by</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">email </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">full_name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">username </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">profile_uid (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="case_response_updated_by_properties"><code>case_response_updated_by_properties</code> - Case response properties for updated_by</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">email </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">full_name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">username </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">profile_uid (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="closure_types"><code>closure_types</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Indicates whether a case is automatically closed when it is pushed to external systems (<code>close-by-pushing</code>) or not automatically closed (<code>close-by-user</code>).</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_cases_webhook"><code>connector_properties_cases_webhook</code> - Create or upate case request properties for Cases Webhook connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.cases-webhook</code>.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.cases-webhook</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_jira"><code>connector_properties_jira</code> - Create or update case request properties for a Jira connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.jira</code>.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#connector_properties_jira_fields">connector_properties_jira_fields</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.jira</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_jira_fields"><code>connector_properties_jira_fields</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object containing the connector fields. If you want to omit any individual field, specify null as its value.</div>
-    <div class="field-items">
-      <div class="param">issueType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of issue. </div>
-<div class="param">parent </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key of the parent issue, when the issue type is sub-task. </div>
-<div class="param">priority </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The priority of the issue. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_none"><code>connector_properties_none</code> - Create or update case request properties for no connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.none</code>.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To create a case without a connector, use <code>none</code>. To update a case to remove the connector, specify <code>none</code>. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. To create a case without a connector, use <code>none</code>. To update a case to remove the connector, specify <code>none</code>. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. To create a case without a connector, use <code>.none</code>. To update a case to remove the connector, specify <code>.none</code>. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.none</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_resilient"><code>connector_properties_resilient</code> - Create case request properties for a IBM Resilient connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.resilient</code>.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#connector_properties_resilient_fields">connector_properties_resilient_fields</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.resilient</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_resilient_fields"><code>connector_properties_resilient_fields</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object containing the connector fields. If you want to omit any individual field, specify null as its value.</div>
-    <div class="field-items">
-      <div class="param">issueTypes </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The type of incident. </div>
-<div class="param">severityCode </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The severity code of the incident. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_servicenow"><code>connector_properties_servicenow</code> - Create case request properties for a ServiceNow ITSM connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.servicenow</code>.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#connector_properties_servicenow_fields">connector_properties_servicenow_fields</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.servicenow</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_servicenow_fields"><code>connector_properties_servicenow_fields</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object containing the connector fields. If you want to omit any individual field, specify null as its value.</div>
-    <div class="field-items">
-      <div class="param">category </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The category of the incident. </div>
-<div class="param">impact </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The effect an incident had on business. </div>
-<div class="param">severity </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The severity of the incident. </div>
-<div class="param">subcategory </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The subcategory of the incident. </div>
-<div class="param">urgency </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The extent to which the incident resolution can be delayed. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_servicenow_sir"><code>connector_properties_servicenow_sir</code> - Create case request properties for a ServiceNow SecOps connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.servicenow-sir</code>.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#connector_properties_servicenow_sir_fields">connector_properties_servicenow_sir_fields</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.servicenow-sir</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_servicenow_sir_fields"><code>connector_properties_servicenow_sir_fields</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object containing the connector fields. If you want to omit any individual field, specify null as its value.</div>
-    <div class="field-items">
-      <div class="param">category </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The category of the incident. </div>
-<div class="param">destIp </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether cases will send a comma-separated list of destination IPs. </div>
-<div class="param">malwareHash </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether cases will send a comma-separated list of malware hashes. </div>
-<div class="param">malwareUrl </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether cases will send a comma-separated list of malware URLs. </div>
-<div class="param">priority </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The priority of the issue. </div>
-<div class="param">sourceIp </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether cases will send a comma-separated list of source IPs. </div>
-<div class="param">subcategory </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The subcategory of the incident. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_swimlane"><code>connector_properties_swimlane</code> - Create case request properties for a Swimlane connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.swimlane</code>.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#connector_properties_swimlane_fields">connector_properties_swimlane_fields</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.swimlane</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_properties_swimlane_fields"><code>connector_properties_swimlane_fields</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object containing the connector fields. If you want to omit any individual field, specify null as its value.</div>
-    <div class="field-items">
-      <div class="param">caseId </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The case identifier for Swimlane connectors. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_types"><code>connector_types</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The type of connector.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_case_request"><code>create_case_request</code> - Create case request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The create case API request body varies depending on the type of connector.</div>
-    <div class="field-items">
-      <div class="param">assignees (optional)</div><div class="param-desc"><span class="param-type"><a href="#assignees_inner">array[assignees_inner]</a></span> An array containing users that are assigned to the case. </div>
-<div class="param">connector </div><div class="param-desc"><span class="param-type"><a href="#create_case_request_connector">create_case_request_connector</a></span>  </div>
-<div class="param">description </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The description for the case. </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">settings </div><div class="param-desc"><span class="param-type"><a href="#settings">settings</a></span>  </div>
-<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#severity_property">severity_property</a></span>  </div>
-<div class="param">tags </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The words and phrases that help categorize cases. It can be an empty array. </div>
-<div class="param">category (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Category for the case. It could be a word or a phrase to categorize the case. </div>
-<div class="param">title </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A title for the case. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_case_request_connector"><code>create_case_request_connector</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#connector_properties_swimlane_fields">connector_properties_swimlane_fields</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.swimlane</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="external_service"><code>external_service</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">connector_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">connector_name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">external_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">external_title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">external_url (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">pushed_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">pushed_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfigurationDefaultSpace_200_response_inner_updated_by">getCaseConfigurationDefaultSpace_200_response_inner_updated_by</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCaseActivityDefaultSpace_200_response"><code>findCaseActivityDefaultSpace_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">perPage (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">total (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">userActions (optional)</div><div class="param-desc"><span class="param-type"><a href="#user_actions_find_response_properties">array[user_actions_find_response_properties]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCaseActivity_200_response"><code>findCaseActivity_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">perPage (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">total (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">userActions (optional)</div><div class="param-desc"><span class="param-type"><a href="#user_actions_find_response_properties">array[user_actions_find_response_properties]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCaseConnectorsDefaultSpace_200_response_inner"><code>findCaseConnectorsDefaultSpace_200_response_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actionTypeId (optional)</div><div class="param-desc"><span class="param-type"><a href="#connector_types">connector_types</a></span>  </div>
-<div class="param">config (optional)</div><div class="param-desc"><span class="param-type"><a href="#findCaseConnectorsDefaultSpace_200_response_inner_config">findCaseConnectorsDefaultSpace_200_response_inner_config</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">isDeprecated (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">isMissingSecrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">isPreconfigured (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">referencedByCount (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCaseConnectorsDefaultSpace_200_response_inner_config"><code>findCaseConnectorsDefaultSpace_200_response_inner_config</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">apiUrl (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">projectKey (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCasesDefaultSpace_200_response"><code>findCasesDefaultSpace_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_properties">array[case_response_properties]</a></span>  </div>
-<div class="param">count_closed_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">count_in_progress_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">count_open_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">per_page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">total (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCasesDefaultSpace_assignees_parameter"><code>findCasesDefaultSpace_assignees_parameter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCasesDefaultSpace_owner_parameter"><code>findCasesDefaultSpace_owner_parameter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCasesDefaultSpace_searchFields_parameter"><code>findCasesDefaultSpace_searchFields_parameter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findCases_200_response"><code>findCases_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_properties">array[case_response_properties]</a></span>  </div>
-<div class="param">count_closed_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">count_in_progress_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">count_open_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">per_page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">total (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getCaseCommentDefaultSpace_200_response"><code>getCaseCommentDefaultSpace_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alertId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">created_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">created_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_created_by_properties">case_response_created_by_properties</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">index (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">pushed_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">pushed_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_pushed_by_properties">case_response_pushed_by_properties</a></span>  </div>
-<div class="param">rule (optional)</div><div class="param-desc"><span class="param-type"><a href="#alert_comment_response_properties_rule">alert_comment_response_properties_rule</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">user</div>
-<div class="param">updated_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">updated_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_updated_by_properties">case_response_updated_by_properties</a></span>  </div>
-<div class="param">version (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getCaseConfigurationDefaultSpace_200_response_inner"><code>getCaseConfigurationDefaultSpace_200_response_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">closure_type (optional)</div><div class="param-desc"><span class="param-type"><a href="#closure_types">closure_types</a></span>  </div>
-<div class="param">connector (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfigurationDefaultSpace_200_response_inner_connector">getCaseConfigurationDefaultSpace_200_response_inner_connector</a></span>  </div>
-<div class="param">created_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">created_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfigurationDefaultSpace_200_response_inner_created_by">getCaseConfigurationDefaultSpace_200_response_inner_created_by</a></span>  </div>
-<div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">mappings (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner">array[getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner]</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">updated_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">updated_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfigurationDefaultSpace_200_response_inner_updated_by">getCaseConfigurationDefaultSpace_200_response_inner_updated_by</a></span>  </div>
-<div class="param">version (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getCaseConfigurationDefaultSpace_200_response_inner_connector"><code>getCaseConfigurationDefaultSpace_200_response_inner_connector</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">fields (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to <code>null</code>. </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. If you do not want a default connector, use <code>none</code>. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. If you do not want a default connector, use <code>none</code>. To retrieve connector names, use the find connectors API. </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#connector_types">connector_types</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getCaseConfigurationDefaultSpace_200_response_inner_created_by"><code>getCaseConfigurationDefaultSpace_200_response_inner_created_by</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">email (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">full_name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">username (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">profile_uid (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner"><code>getCaseConfigurationDefaultSpace_200_response_inner_mappings_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">action_type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">source (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">target (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getCaseConfigurationDefaultSpace_200_response_inner_updated_by"><code>getCaseConfigurationDefaultSpace_200_response_inner_updated_by</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">email (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">full_name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">username (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">profile_uid (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getCaseStatusDefaultSpace_200_response"><code>getCaseStatusDefaultSpace_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">count_closed_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">count_in_progress_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">count_open_cases (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getCasesByAlertDefaultSpace_200_response_inner"><code>getCasesByAlertDefaultSpace_200_response_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The case identifier. </div>
-<div class="param">title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The case title. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="owners"><code>owners</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The application that owns the cases: Stack Management, Observability, or Elastic Security.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_alert_comment"><code>payload_alert_comment</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_alert_comment_comment">payload_alert_comment_comment</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_alert_comment_comment"><code>payload_alert_comment_comment</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alertId (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_alert_comment_comment_alertId">payload_alert_comment_comment_alertId</a></span>  </div>
-<div class="param">index (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_alert_comment_comment_index">payload_alert_comment_comment_index</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">rule (optional)</div><div class="param-desc"><span class="param-type"><a href="#alert_comment_response_properties_rule">alert_comment_response_properties_rule</a></span>  </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">alert</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_alert_comment_comment_alertId"><code>payload_alert_comment_comment_alertId</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_alert_comment_comment_index"><code>payload_alert_comment_comment_index</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_assignees"><code>payload_assignees</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">assignees (optional)</div><div class="param-desc"><span class="param-type"><a href="#assignees_inner">array[assignees_inner]</a></span> An array containing users that are assigned to the case. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_connector"><code>payload_connector</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">connector (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_connector_connector">payload_connector_connector</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_connector_connector"><code>payload_connector_connector</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">fields (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_connector_connector_fields">payload_connector_connector_fields</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. To create a case without a connector, use <code>none</code>. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. To create a case without a connector, use <code>none</code>. </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#connector_types">connector_types</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_connector_connector_fields"><code>payload_connector_connector_fields</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.</div>
-    <div class="field-items">
-      <div class="param">caseId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The case identifier for Swimlane connectors. </div>
-<div class="param">category (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. </div>
-<div class="param">destIp (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors. </div>
-<div class="param">impact (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The effect an incident had on business for ServiceNow ITSM connectors. </div>
-<div class="param">issueType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of issue for Jira connectors. </div>
-<div class="param">issueTypes (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The type of incident for IBM Resilient connectors. </div>
-<div class="param">malwareHash (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors. </div>
-<div class="param">malwareUrl (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors. </div>
-<div class="param">parent (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key of the parent issue, when the issue type is sub-task for Jira connectors. </div>
-<div class="param">priority (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The priority of the issue for Jira and ServiceNow SecOps connectors. </div>
-<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The severity of the incident for ServiceNow ITSM connectors. </div>
-<div class="param">severityCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The severity code of the incident for IBM Resilient connectors. </div>
-<div class="param">sourceIp (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors. </div>
-<div class="param">subcategory (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The subcategory of the incident for ServiceNow ITSM connectors. </div>
-<div class="param">urgency (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_create_case"><code>payload_create_case</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">assignees (optional)</div><div class="param-desc"><span class="param-type"><a href="#assignees_inner">array[assignees_inner]</a></span> An array containing users that are assigned to the case. </div>
-<div class="param">connector (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_connector_connector">payload_connector_connector</a></span>  </div>
-<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">settings (optional)</div><div class="param-desc"><span class="param-type"><a href="#settings">settings</a></span>  </div>
-<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#severity_property">severity_property</a></span>  </div>
-<div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#status">status</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_description"><code>payload_description</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_pushed"><code>payload_pushed</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">externalService (optional)</div><div class="param-desc"><span class="param-type"><a href="#external_service">external_service</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_settings"><code>payload_settings</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">settings (optional)</div><div class="param-desc"><span class="param-type"><a href="#settings">settings</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_severity"><code>payload_severity</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#severity_property">severity_property</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_status"><code>payload_status</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#status">status</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_tags"><code>payload_tags</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_title"><code>payload_title</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_user_comment"><code>payload_user_comment</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_user_comment_comment">payload_user_comment_comment</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="payload_user_comment_comment"><code>payload_user_comment_comment</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">user</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="rule"><code>rule</code> - Alerting rule</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The rule that is associated with the alerts. It is required only when <code>type</code> is <code>alert</code>. This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.</div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The rule identifier. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The rule name. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="searchFieldsType"><code>searchFieldsType</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The fields to perform the <code>simple_query_string</code> parsed query against.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="set_case_configuration_request"><code>set_case_configuration_request</code> - Set case configuration request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>External connection details, such as the closure type and default connector for cases.</div>
-    <div class="field-items">
-      <div class="param">closure_type </div><div class="param-desc"><span class="param-type"><a href="#closure_types">closure_types</a></span>  </div>
-<div class="param">connector </div><div class="param-desc"><span class="param-type"><a href="#set_case_configuration_request_connector">set_case_configuration_request_connector</a></span>  </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">settings (optional)</div><div class="param-desc"><span class="param-type"><a href="#set_case_configuration_request_settings">set_case_configuration_request_settings</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="set_case_configuration_request_connector"><code>set_case_configuration_request_connector</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object that contains the connector configuration.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to <code>null</code>. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. If you do not want a default connector, use <code>none</code>. To retrieve connector IDs, use the find connectors API. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector. If you do not want a default connector, use <code>none</code>. To retrieve connector names, use the find connectors API. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#connector_types">connector_types</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="set_case_configuration_request_settings"><code>set_case_configuration_request_settings</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object that contains the case settings.</div>
-    <div class="field-items">
-      <div class="param">syncAlerts </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Turns alert syncing on or off. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="settings"><code>settings</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An object that contains the case settings.</div>
-    <div class="field-items">
-      <div class="param">syncAlerts </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Turns alert syncing on or off. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="severity_property"><code>severity_property</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The severity of the case.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="status"><code>status</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The status of the case.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_alert_comment_request_properties"><code>update_alert_comment_request_properties</code> - Update case comment request properties for alerts</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for case comment requests when type is alert.</div>
-    <div class="field-items">
-      <div class="param">alertId </div><div class="param-desc"><span class="param-type"><a href="#alert_identifiers">alert_identifiers</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the comment. To retrieve comment IDs, use the get comments API. </div>
-<div class="param">index </div><div class="param-desc"><span class="param-type"><a href="#alert_indices">alert_indices</a></span>  </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">rule </div><div class="param-desc"><span class="param-type"><a href="#rule">rule</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of comment. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">alert</div>
-<div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The current comment version. To retrieve version values, use the get comments API. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_case_comment_request"><code>update_case_comment_request</code> - Update case comment request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The update case comment API request body varies depending on whether you are updating an alert or a comment.</div>
-    <div class="field-items">
-      <div class="param">alertId </div><div class="param-desc"><span class="param-type"><a href="#alert_identifiers">alert_identifiers</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the comment. To retrieve comment IDs, use the get comments API. </div>
-<div class="param">index </div><div class="param-desc"><span class="param-type"><a href="#alert_indices">alert_indices</a></span>  </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">rule </div><div class="param-desc"><span class="param-type"><a href="#rule">rule</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of comment. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">user</div>
-<div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The current comment version. To retrieve version values, use the get comments API. </div>
-<div class="param">comment </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The new comment. It is required only when <code>type</code> is <code>user</code>. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_case_configuration_request"><code>update_case_configuration_request</code> - Update case configuration request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>External connection details, such as the closure type and default connector for cases.</div>
-    <div class="field-items">
-      <div class="param">closure_type (optional)</div><div class="param-desc"><span class="param-type"><a href="#closure_types">closure_types</a></span>  </div>
-<div class="param">connector (optional)</div><div class="param-desc"><span class="param-type"><a href="#set_case_configuration_request_connector">set_case_configuration_request_connector</a></span>  </div>
-<div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The version of the connector. To retrieve the version value, use the get configuration API. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_case_request"><code>update_case_request</code> - Update case request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The update case API request body varies depending on the type of connector.</div>
-    <div class="field-items">
-      <div class="param">cases </div><div class="param-desc"><span class="param-type"><a href="#update_case_request_cases_inner">array[update_case_request_cases_inner]</a></span> An array containing one or more case objects. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_case_request_cases_inner"><code>update_case_request_cases_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">assignees (optional)</div><div class="param-desc"><span class="param-type"><a href="#assignees_inner">array[assignees_inner]</a></span> An array containing users that are assigned to the case. </div>
-<div class="param">connector (optional)</div><div class="param-desc"><span class="param-type"><a href="#create_case_request_connector">create_case_request_connector</a></span>  </div>
-<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> An updated description for the case. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the case. </div>
-<div class="param">settings (optional)</div><div class="param-desc"><span class="param-type"><a href="#settings">settings</a></span>  </div>
-<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#severity_property">severity_property</a></span>  </div>
-<div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#status">status</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The words and phrases that help categorize cases. </div>
-<div class="param">category (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Category for the case. It could be a word or a phrase to categorize the case. </div>
-<div class="param">title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A title for the case. </div>
-<div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The current version of the case. To determine this value, use the get case or find cases APIs. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_user_comment_request_properties"><code>update_user_comment_request_properties</code> - Update case comment request properties for user comments</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for case comment requests when type is user.</div>
-    <div class="field-items">
-      <div class="param">comment </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The new comment. It is required only when <code>type</code> is <code>user</code>. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the comment. To retrieve comment IDs, use the get comments API. </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of comment. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">user</div>
-<div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The current comment version. To retrieve version values, use the get comments API. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="user_actions_find_response_properties"><code>user_actions_find_response_properties</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">action </div><div class="param-desc"><span class="param-type"><a href="#actions">actions</a></span>  </div>
-<div class="param">comment_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">created_at </div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">created_by </div><div class="param-desc"><span class="param-type"><a href="#user_actions_response_properties_created_by">user_actions_response_properties_created_by</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">payload </div><div class="param-desc"><span class="param-type"><a href="#user_actions_response_properties_payload">user_actions_response_properties_payload</a></span>  </div>
-<div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of action. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">assignees</div><div class="param-enum">create_case</div><div class="param-enum">comment</div><div class="param-enum">connector</div><div class="param-enum">description</div><div class="param-enum">pushed</div><div class="param-enum">tags</div><div class="param-enum">title</div><div class="param-enum">status</div><div class="param-enum">settings</div><div class="param-enum">severity</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="user_actions_response_properties"><code>user_actions_response_properties</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">action </div><div class="param-desc"><span class="param-type"><a href="#actions">actions</a></span>  </div>
-<div class="param">action_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">case_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">comment_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">created_at </div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">created_by </div><div class="param-desc"><span class="param-type"><a href="#user_actions_response_properties_created_by">user_actions_response_properties_created_by</a></span>  </div>
-<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">payload </div><div class="param-desc"><span class="param-type"><a href="#user_actions_response_properties_payload">user_actions_response_properties_payload</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#action_types">action_types</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="user_actions_response_properties_created_by"><code>user_actions_response_properties_created_by</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">email </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">full_name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">username </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">profile_uid (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="user_actions_response_properties_payload"><code>user_actions_response_properties_payload</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_user_comment_comment">payload_user_comment_comment</a></span>  </div>
-<div class="param">assignees (optional)</div><div class="param-desc"><span class="param-type"><a href="#assignees_inner">array[assignees_inner]</a></span> An array containing users that are assigned to the case. </div>
-<div class="param">connector (optional)</div><div class="param-desc"><span class="param-type"><a href="#payload_connector_connector">payload_connector_connector</a></span>  </div>
-<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">settings (optional)</div><div class="param-desc"><span class="param-type"><a href="#settings">settings</a></span>  </div>
-<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#severity_property">severity_property</a></span>  </div>
-<div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#status">status</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">externalService (optional)</div><div class="param-desc"><span class="param-type"><a href="#external_service">external_service</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="user_comment_response_properties"><code>user_comment_response_properties</code> - Case response properties for user comments</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">created_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">created_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_created_by_properties">case_response_created_by_properties</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">owner (optional)</div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
-<div class="param">pushed_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">pushed_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_pushed_by_properties">case_response_pushed_by_properties</a></span>  </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">user</div>
-<div class="param">updated_at (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">updated_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#case_response_updated_by_properties">case_response_updated_by_properties</a></span>  </div>
-<div class="param">version (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-</div>
-++++
diff --git a/docs/api-generated/cases/case-apis.asciidoc b/docs/api-generated/cases/case-apis.asciidoc
deleted file mode 100644
index fdd9a941a58e6..0000000000000
--- a/docs/api-generated/cases/case-apis.asciidoc
+++ /dev/null
@@ -1,10 +0,0 @@
-[[case-apis]]
-== Case APIs
-
-preview::[]
-
-////
-This file includes content that has been generated from https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/docs/openapi. Any modifications required must be done in that open API specification.
-////
-
-include::case-apis-passthru.asciidoc[]
\ No newline at end of file
diff --git a/docs/api-generated/connectors/connector-apis-passthru.asciidoc b/docs/api-generated/connectors/connector-apis-passthru.asciidoc
deleted file mode 100644
index d3495cecf9edf..0000000000000
--- a/docs/api-generated/connectors/connector-apis-passthru.asciidoc
+++ /dev/null
@@ -1,2823 +0,0 @@
-////
-This content is generated from the open API specification.
-Any modifications made to this file will be overwritten.
-////
-
-++++
-<div class="openapi">
-  <h2>Access</h2>
-    <ol>
-      <li>APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true</li>
-      <li>HTTP Basic Authentication</li>
-    </ol>
-
-  <h2><a name="__Methods">Methods</a></h2>
-  [ Jump to <a href="#__Models">Models</a> ]
-
-  <h3>Table of Contents </h3>
-  <div class="method-summary"></div>
-  <h4><a href="#Connectors">Connectors</a></h4>
-  <ul>
-  <li><a href="#createConnector"><code><span class="http-method">post</span> /s/{spaceId}/api/actions/connector</code></a></li>
-  <li><a href="#createConnectorId"><code><span class="http-method">post</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></a></li>
-  <li><a href="#deleteConnector"><code><span class="http-method">delete</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></a></li>
-  <li><a href="#getConnector"><code><span class="http-method">get</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></a></li>
-  <li><a href="#getConnectorTypes"><code><span class="http-method">get</span> /s/{spaceId}/api/actions/connector_types</code></a></li>
-  <li><a href="#getConnectors"><code><span class="http-method">get</span> /s/{spaceId}/api/actions/connectors</code></a></li>
-  <li><a href="#legacyCreateConnector"><code><span class="http-method">post</span> /s/{spaceId}/api/actions</code></a></li>
-  <li><a href="#legacyDeleteConnector"><code><span class="http-method">delete</span> /s/{spaceId}/api/actions/action/{actionId}</code></a></li>
-  <li><a href="#legacyGetConnector"><code><span class="http-method">get</span> /s/{spaceId}/api/actions/action/{actionId}</code></a></li>
-  <li><a href="#legacyGetConnectorTypes"><code><span class="http-method">get</span> /s/{spaceId}/api/actions/list_action_types</code></a></li>
-  <li><a href="#legacyGetConnectors"><code><span class="http-method">get</span> /s/{spaceId}/api/actions</code></a></li>
-  <li><a href="#legacyRunConnector"><code><span class="http-method">post</span> /s/{spaceId}/api/actions/action/{actionId}/_execute</code></a></li>
-  <li><a href="#legacyUpdateConnector"><code><span class="http-method">put</span> /s/{spaceId}/api/actions/action/{actionId}</code></a></li>
-  <li><a href="#runConnector"><code><span class="http-method">post</span> /s/{spaceId}/api/actions/connector/{connectorId}/_execute</code></a></li>
-  <li><a href="#updateConnector"><code><span class="http-method">put</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></a></li>
-  </ul>
-
-  <h1><a name="Connectors">Connectors</a></h1>
-  <div class="method"><a name="createConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/actions/connector</code></pre></div>
-    <div class="method-summary">Creates a connector. (<span class="nickname">createConnector</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Create_connector_request_body_properties <a href="#Create_connector_request_body_properties">Create_connector_request_body_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#connector_response_properties">connector_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>null</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#connector_response_properties">connector_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="createConnectorId"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></pre></div>
-    <div class="method-summary">Creates a connector. (<span class="nickname">createConnectorId</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">connectorId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; A UUID v1 or v4 identifier for the connector. If you omit this parameter, an identifier is randomly generated. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Create_connector_request_body_properties <a href="#Create_connector_request_body_properties">Create_connector_request_body_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#connector_response_properties">connector_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>null</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#connector_response_properties">connector_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="deleteConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></pre></div>
-    <div class="method-summary">Deletes a connector. (<span class="nickname">deleteConnector</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges. WARNING: When you delete a connector, it cannot be recovered.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">connectorId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the connector. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#getConnector_404_response">getConnector_404_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></pre></div>
-    <div class="method-summary">Retrieves a connector by ID. (<span class="nickname">getConnector</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">connectorId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the connector. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#connector_response_properties">connector_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>null</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#connector_response_properties">connector_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#getConnector_404_response">getConnector_404_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getConnectorTypes"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/actions/connector_types</code></pre></div>
-    <div class="method-summary">Retrieves a list of all connector types. (<span class="nickname">getConnectorTypes</span>)</div>
-    <div class="method-notes">You do not need any Kibana feature privileges to run this API.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">feature_id (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases). default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#Get_connector_types_response_body_properties_inner">Get_connector_types_response_body_properties_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "supported_feature_ids" : [ "alerting", "uptime", "siem" ],
-  "name" : "Index",
-  "enabled_in_license" : true,
-  "id" : ".server-log",
-  "enabled_in_config" : true,
-  "minimum_license_required" : "basic",
-  "enabled" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getConnectors"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/actions/connectors</code></pre></div>
-    <div class="method-summary">Retrieves all connectors. (<span class="nickname">getConnectors</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#Get_connectors_response_body_properties">Get_connectors_response_body_properties</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "is_missing_secrets" : false,
-  "is_deprecated" : false,
-  "is_preconfigured" : false,
-  "name" : "my-connector",
-  "is_system_action" : false,
-  "referenced_by_count" : 2,
-  "id" : "b0766e10-d190-11ec-b04c-776c77d14fca",
-  "config" : {
-    "key" : ""
-  },
-  "connector_type_id" : ".server-log"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyCreateConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/actions</code></pre></div>
-    <div class="method-summary">Creates a connector. (<span class="nickname">legacyCreateConnector</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the create connector API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Legacy_create_connector_request_properties <a href="#Legacy_create_connector_request_properties">Legacy_create_connector_request_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#action_response_properties">action_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : "actionTypeId",
-  "name" : "name",
-  "id" : "id",
-  "config" : "{}",
-  "isMissingSecrets" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#action_response_properties">action_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyDeleteConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /s/{spaceId}/api/actions/action/{actionId}</code></pre></div>
-    <div class="method-summary">Deletes a connector. (<span class="nickname">legacyDeleteConnector</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the delete connector API instead. WARNING: When you delete a connector, it cannot be recovered.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">actionId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the action. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyGetConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/actions/action/{actionId}</code></pre></div>
-    <div class="method-summary">Retrieves a connector by ID. (<span class="nickname">legacyGetConnector</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the get connector API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">actionId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the action. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#action_response_properties">action_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : "actionTypeId",
-  "name" : "name",
-  "id" : "id",
-  "config" : "{}",
-  "isMissingSecrets" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#action_response_properties">action_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyGetConnectorTypes"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/actions/list_action_types</code></pre></div>
-    <div class="method-summary">Retrieves a list of all connector types. (<span class="nickname">legacyGetConnectorTypes</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the get all connector types API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#Legacy_get_connector_types_response_body_properties_inner">Legacy_get_connector_types_response_body_properties_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "enabledInConfig" : true,
-  "name" : "name",
-  "enabledInLicense" : true,
-  "id" : "id",
-  "minimumLicenseRequired" : "minimumLicenseRequired",
-  "enabled" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyGetConnectors"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/actions</code></pre></div>
-    <div class="method-summary">Retrieves all connectors. (<span class="nickname">legacyGetConnectors</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the get all connectors API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#action_response_properties">action_response_properties</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : "actionTypeId",
-  "name" : "name",
-  "id" : "id",
-  "config" : "{}",
-  "isMissingSecrets" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyRunConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/actions/action/{actionId}/_execute</code></pre></div>
-    <div class="method-summary">Runs a connector. (<span class="nickname">legacyRunConnector</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the run connector API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">actionId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the action. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Legacy_run_connector_request_body_properties <a href="#Legacy_run_connector_request_body_properties">Legacy_run_connector_request_body_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#legacyRunConnector_200_response">legacyRunConnector_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "actionId" : "actionId",
-  "status" : "status"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#legacyRunConnector_200_response">legacyRunConnector_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyUpdateConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="put"><code class="huge"><span class="http-method">put</span> /s/{spaceId}/api/actions/action/{actionId}</code></pre></div>
-    <div class="method-summary">Updates the attributes for a connector. (<span class="nickname">legacyUpdateConnector</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the update connector API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">actionId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the action. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Legacy_update_connector_request_body_properties <a href="#Legacy_update_connector_request_body_properties">Legacy_update_connector_request_body_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#action_response_properties">action_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "isPreconfigured" : true,
-  "isDeprecated" : true,
-  "actionTypeId" : "actionTypeId",
-  "name" : "name",
-  "id" : "id",
-  "config" : "{}",
-  "isMissingSecrets" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#action_response_properties">action_response_properties</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#Not_found_response">Not_found_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="runConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/actions/connector/{connectorId}/_execute</code></pre></div>
-    <div class="method-summary">Runs a connector. (<span class="nickname">runConnector</span>)</div>
-    <div class="method-notes">You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have <code>read</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges. If you use an index connector, you must also have <code>all</code>, <code>create</code>, <code>index</code>, or <code>write</code> indices privileges.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">connectorId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the connector. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Run_connector_request_body_properties <a href="#Run_connector_request_body_properties">Run_connector_request_body_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#runConnector_200_response">runConnector_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "connector_id" : "connector_id",
-  "status" : "error"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#runConnector_200_response">runConnector_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateConnector"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="put"><code class="huge"><span class="http-method">put</span> /s/{spaceId}/api/actions/connector/{connectorId}</code></pre></div>
-    <div class="method-summary">Updates the attributes for a connector. (<span class="nickname">updateConnector</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Actions and Connectors</strong> feature in the <strong>Management</strong> section of the Kibana feature privileges.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">connectorId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the connector. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Update_connector_request_body_properties <a href="#Update_connector_request_body_properties">Update_connector_request_body_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#connector_response_properties">connector_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>null</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#connector_response_properties">connector_response_properties</a>
-    <h4 class="field-label">400</h4>
-    Indicates a bad request.
-        <a href="#updateConnector_400_response">updateConnector_400_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#Unauthorized_response">Unauthorized_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#Not_found_response">Not_found_response</a>
-  </div> <!-- method -->
-  <hr/>
-
-  <h2><a name="__Models">Models</a></h2>
-  [ Jump to <a href="#__Methods">Methods</a> ]
-
-  <h3>Table of Contents</h3>
-  <ol>
-    <li><a href="#Alert_identifier_mapping"><code>Alert_identifier_mapping</code> - Alert identifier mapping</a></li>
-    <li><a href="#Case_comment_mapping"><code>Case_comment_mapping</code> - Case comment mapping</a></li>
-    <li><a href="#Case_description_mapping"><code>Case_description_mapping</code> - Case description mapping</a></li>
-    <li><a href="#Case_identifier_mapping"><code>Case_identifier_mapping</code> - Case identifier mapping</a></li>
-    <li><a href="#Case_name_mapping"><code>Case_name_mapping</code> - Case name mapping</a></li>
-    <li><a href="#Connector_mappings_properties_for_a_Swimlane_connector"><code>Connector_mappings_properties_for_a_Swimlane_connector</code> - Connector mappings properties for a Swimlane connector</a></li>
-    <li><a href="#Create_connector_request_body_properties"><code>Create_connector_request_body_properties</code> - Create connector request body properties</a></li>
-    <li><a href="#Get_connector_types_response_body_properties_inner"><code>Get_connector_types_response_body_properties_inner</code> - </a></li>
-    <li><a href="#Get_connectors_response_body_properties"><code>Get_connectors_response_body_properties</code> - Get connectors response body properties</a></li>
-    <li><a href="#Legacy_create_connector_request_properties"><code>Legacy_create_connector_request_properties</code> - Legacy create connector request properties</a></li>
-    <li><a href="#Legacy_get_connector_types_response_body_properties_inner"><code>Legacy_get_connector_types_response_body_properties_inner</code> - </a></li>
-    <li><a href="#Legacy_run_connector_request_body_properties"><code>Legacy_run_connector_request_body_properties</code> - Legacy run connector request body properties</a></li>
-    <li><a href="#Legacy_update_connector_request_body_properties"><code>Legacy_update_connector_request_body_properties</code> - Legacy update connector request body properties</a></li>
-    <li><a href="#Not_found_response"><code>Not_found_response</code> - Not found response</a></li>
-    <li><a href="#Rule_name_mapping"><code>Rule_name_mapping</code> - Rule name mapping</a></li>
-    <li><a href="#Run_connector_request_body_properties"><code>Run_connector_request_body_properties</code> - Run connector request body properties</a></li>
-    <li><a href="#Run_connector_request_body_properties_params"><code>Run_connector_request_body_properties_params</code> - </a></li>
-    <li><a href="#Severity_mapping"><code>Severity_mapping</code> - Severity mapping</a></li>
-    <li><a href="#Subaction_parameters"><code>Subaction_parameters</code> - Subaction parameters</a></li>
-    <li><a href="#Unauthorized_response"><code>Unauthorized_response</code> - Unauthorized response</a></li>
-    <li><a href="#Update_connector_request_body_properties"><code>Update_connector_request_body_properties</code> - Update connector request body properties</a></li>
-    <li><a href="#action_response_properties"><code>action_response_properties</code> - Action response properties</a></li>
-    <li><a href="#config_properties_cases_webhook"><code>config_properties_cases_webhook</code> - Connector request properties for Webhook - Case Management connector</a></li>
-    <li><a href="#config_properties_d3security"><code>config_properties_d3security</code> - Connector request properties for a D3 Security connector</a></li>
-    <li><a href="#config_properties_email"><code>config_properties_email</code> - Connector request properties for an email connector</a></li>
-    <li><a href="#config_properties_genai"><code>config_properties_genai</code> - Connector request properties for an OpenAI connector</a></li>
-    <li><a href="#config_properties_genai_oneOf"><code>config_properties_genai_oneOf</code> - </a></li>
-    <li><a href="#config_properties_genai_oneOf_1"><code>config_properties_genai_oneOf_1</code> - </a></li>
-    <li><a href="#config_properties_index"><code>config_properties_index</code> - Connector request properties for an index connector</a></li>
-    <li><a href="#config_properties_jira"><code>config_properties_jira</code> - Connector request properties for a Jira connector</a></li>
-    <li><a href="#config_properties_opsgenie"><code>config_properties_opsgenie</code> - Connector request properties for an Opsgenie connector</a></li>
-    <li><a href="#config_properties_pagerduty"><code>config_properties_pagerduty</code> - Connector request properties for a PagerDuty connector</a></li>
-    <li><a href="#config_properties_resilient"><code>config_properties_resilient</code> - Connector request properties for a IBM Resilient connector</a></li>
-    <li><a href="#config_properties_servicenow"><code>config_properties_servicenow</code> - Connector request properties for a ServiceNow ITSM connector</a></li>
-    <li><a href="#config_properties_servicenow_itom"><code>config_properties_servicenow_itom</code> - Connector request properties for a ServiceNow ITSM connector</a></li>
-    <li><a href="#config_properties_swimlane"><code>config_properties_swimlane</code> - Connector request properties for a Swimlane connector</a></li>
-    <li><a href="#config_properties_tines"><code>config_properties_tines</code> - Connector request properties for a Tines connector</a></li>
-    <li><a href="#config_properties_torq"><code>config_properties_torq</code> - Connector request properties for a Torq connector</a></li>
-    <li><a href="#config_properties_webhook"><code>config_properties_webhook</code> - Connector request properties for a Webhook connector</a></li>
-    <li><a href="#config_properties_xmatters"><code>config_properties_xmatters</code> - Connector request properties for an xMatters connector</a></li>
-    <li><a href="#connector_response_properties"><code>connector_response_properties</code> - Connector response properties</a></li>
-    <li><a href="#connector_response_properties_cases_webhook"><code>connector_response_properties_cases_webhook</code> - Connector request properties for a Webhook - Case Management connector</a></li>
-    <li><a href="#connector_response_properties_d3security"><code>connector_response_properties_d3security</code> - Connector response properties for a D3 Security connector</a></li>
-    <li><a href="#connector_response_properties_email"><code>connector_response_properties_email</code> - Connector response properties for an email connector</a></li>
-    <li><a href="#connector_response_properties_index"><code>connector_response_properties_index</code> - Connector response properties for an index connector</a></li>
-    <li><a href="#connector_response_properties_jira"><code>connector_response_properties_jira</code> - Connector response properties for a Jira connector</a></li>
-    <li><a href="#connector_response_properties_opsgenie"><code>connector_response_properties_opsgenie</code> - Connector response properties for an Opsgenie connector</a></li>
-    <li><a href="#connector_response_properties_pagerduty"><code>connector_response_properties_pagerduty</code> - Connector response properties for a PagerDuty connector</a></li>
-    <li><a href="#connector_response_properties_resilient"><code>connector_response_properties_resilient</code> - Connector response properties for a IBM Resilient connector</a></li>
-    <li><a href="#connector_response_properties_serverlog"><code>connector_response_properties_serverlog</code> - Connector response properties for a server log connector</a></li>
-    <li><a href="#connector_response_properties_servicenow"><code>connector_response_properties_servicenow</code> - Connector response properties for a ServiceNow ITSM connector</a></li>
-    <li><a href="#connector_response_properties_servicenow_itom"><code>connector_response_properties_servicenow_itom</code> - Connector response properties for a ServiceNow ITOM connector</a></li>
-    <li><a href="#connector_response_properties_servicenow_sir"><code>connector_response_properties_servicenow_sir</code> - Connector response properties for a ServiceNow SecOps connector</a></li>
-    <li><a href="#connector_response_properties_slack_api"><code>connector_response_properties_slack_api</code> - Connector response properties for a Slack connector</a></li>
-    <li><a href="#connector_response_properties_slack_webhook"><code>connector_response_properties_slack_webhook</code> - Connector response properties for a Slack connector</a></li>
-    <li><a href="#connector_response_properties_swimlane"><code>connector_response_properties_swimlane</code> - Connector response properties for a Swimlane connector</a></li>
-    <li><a href="#connector_response_properties_teams"><code>connector_response_properties_teams</code> - Connector response properties for a Microsoft Teams connector</a></li>
-    <li><a href="#connector_response_properties_tines"><code>connector_response_properties_tines</code> - Connector response properties for a Tines connector</a></li>
-    <li><a href="#connector_response_properties_torq"><code>connector_response_properties_torq</code> - Connector response properties for a Torq connector</a></li>
-    <li><a href="#connector_response_properties_webhook"><code>connector_response_properties_webhook</code> - Connector response properties for a Webhook connector</a></li>
-    <li><a href="#connector_response_properties_xmatters"><code>connector_response_properties_xmatters</code> - Connector response properties for an xMatters connector</a></li>
-    <li><a href="#connector_types"><code>connector_types</code> - Connector types</a></li>
-    <li><a href="#create_connector_request_cases_webhook"><code>create_connector_request_cases_webhook</code> - Create Webhook - Case Managment connector request</a></li>
-    <li><a href="#create_connector_request_d3security"><code>create_connector_request_d3security</code> - Create D3 Security connector request</a></li>
-    <li><a href="#create_connector_request_email"><code>create_connector_request_email</code> - Create email connector request</a></li>
-    <li><a href="#create_connector_request_genai"><code>create_connector_request_genai</code> - Create OpenAI connector request</a></li>
-    <li><a href="#create_connector_request_index"><code>create_connector_request_index</code> - Create index connector request</a></li>
-    <li><a href="#create_connector_request_jira"><code>create_connector_request_jira</code> - Create Jira connector request</a></li>
-    <li><a href="#create_connector_request_opsgenie"><code>create_connector_request_opsgenie</code> - Create Opsgenie connector request</a></li>
-    <li><a href="#create_connector_request_pagerduty"><code>create_connector_request_pagerduty</code> - Create PagerDuty connector request</a></li>
-    <li><a href="#create_connector_request_resilient"><code>create_connector_request_resilient</code> - Create IBM Resilient connector request</a></li>
-    <li><a href="#create_connector_request_serverlog"><code>create_connector_request_serverlog</code> - Create server log connector request</a></li>
-    <li><a href="#create_connector_request_servicenow"><code>create_connector_request_servicenow</code> - Create ServiceNow ITSM connector request</a></li>
-    <li><a href="#create_connector_request_servicenow_itom"><code>create_connector_request_servicenow_itom</code> - Create ServiceNow ITOM connector request</a></li>
-    <li><a href="#create_connector_request_servicenow_sir"><code>create_connector_request_servicenow_sir</code> - Create ServiceNow SecOps connector request</a></li>
-    <li><a href="#create_connector_request_slack_api"><code>create_connector_request_slack_api</code> - Create Slack connector request</a></li>
-    <li><a href="#create_connector_request_slack_webhook"><code>create_connector_request_slack_webhook</code> - Create Slack connector request</a></li>
-    <li><a href="#create_connector_request_swimlane"><code>create_connector_request_swimlane</code> - Create Swimlane connector request</a></li>
-    <li><a href="#create_connector_request_teams"><code>create_connector_request_teams</code> - Create Microsoft Teams connector request</a></li>
-    <li><a href="#create_connector_request_tines"><code>create_connector_request_tines</code> - Create Tines connector request</a></li>
-    <li><a href="#create_connector_request_torq"><code>create_connector_request_torq</code> - Create Torq connector request</a></li>
-    <li><a href="#create_connector_request_webhook"><code>create_connector_request_webhook</code> - Create Webhook connector request</a></li>
-    <li><a href="#create_connector_request_xmatters"><code>create_connector_request_xmatters</code> - Create xMatters connector request</a></li>
-    <li><a href="#features"><code>features</code> - </a></li>
-    <li><a href="#getConnector_404_response"><code>getConnector_404_response</code> - </a></li>
-    <li><a href="#legacyRunConnector_200_response"><code>legacyRunConnector_200_response</code> - </a></li>
-    <li><a href="#runConnector_200_response"><code>runConnector_200_response</code> - </a></li>
-    <li><a href="#runConnector_200_response_data"><code>runConnector_200_response_data</code> - </a></li>
-    <li><a href="#run_connector_params_documents"><code>run_connector_params_documents</code> - Index connector parameters</a></li>
-    <li><a href="#run_connector_params_level_message"><code>run_connector_params_level_message</code> - Server log connector parameters</a></li>
-    <li><a href="#run_connector_subaction_addevent"><code>run_connector_subaction_addevent</code> - The addEvent subaction</a></li>
-    <li><a href="#run_connector_subaction_addevent_subActionParams"><code>run_connector_subaction_addevent_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_closealert"><code>run_connector_subaction_closealert</code> - The closeAlert subaction</a></li>
-    <li><a href="#run_connector_subaction_closealert_subActionParams"><code>run_connector_subaction_closealert_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_createalert"><code>run_connector_subaction_createalert</code> - The createAlert subaction</a></li>
-    <li><a href="#run_connector_subaction_createalert_subActionParams"><code>run_connector_subaction_createalert_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_createalert_subActionParams_responders_inner"><code>run_connector_subaction_createalert_subActionParams_responders_inner</code> - </a></li>
-    <li><a href="#run_connector_subaction_createalert_subActionParams_visibleTo_inner"><code>run_connector_subaction_createalert_subActionParams_visibleTo_inner</code> - </a></li>
-    <li><a href="#run_connector_subaction_fieldsbyissuetype"><code>run_connector_subaction_fieldsbyissuetype</code> - The fieldsByIssueType subaction</a></li>
-    <li><a href="#run_connector_subaction_fieldsbyissuetype_subActionParams"><code>run_connector_subaction_fieldsbyissuetype_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_getchoices"><code>run_connector_subaction_getchoices</code> - The getChoices subaction</a></li>
-    <li><a href="#run_connector_subaction_getchoices_subActionParams"><code>run_connector_subaction_getchoices_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_getfields"><code>run_connector_subaction_getfields</code> - The getFields subaction</a></li>
-    <li><a href="#run_connector_subaction_getincident"><code>run_connector_subaction_getincident</code> - The getIncident subaction</a></li>
-    <li><a href="#run_connector_subaction_getincident_subActionParams"><code>run_connector_subaction_getincident_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_issue"><code>run_connector_subaction_issue</code> - The issue subaction</a></li>
-    <li><a href="#run_connector_subaction_issue_subActionParams"><code>run_connector_subaction_issue_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_issues"><code>run_connector_subaction_issues</code> - The issues subaction</a></li>
-    <li><a href="#run_connector_subaction_issues_subActionParams"><code>run_connector_subaction_issues_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_issuetypes"><code>run_connector_subaction_issuetypes</code> - The issueTypes subaction</a></li>
-    <li><a href="#run_connector_subaction_pushtoservice"><code>run_connector_subaction_pushtoservice</code> - The pushToService subaction</a></li>
-    <li><a href="#run_connector_subaction_pushtoservice_subActionParams"><code>run_connector_subaction_pushtoservice_subActionParams</code> - </a></li>
-    <li><a href="#run_connector_subaction_pushtoservice_subActionParams_comments_inner"><code>run_connector_subaction_pushtoservice_subActionParams_comments_inner</code> - </a></li>
-    <li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident"><code>run_connector_subaction_pushtoservice_subActionParams_incident</code> - </a></li>
-    <li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip"><code>run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip</code> - </a></li>
-    <li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash"><code>run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash</code> - </a></li>
-    <li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_malware_url"><code>run_connector_subaction_pushtoservice_subActionParams_incident_malware_url</code> - </a></li>
-    <li><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_source_ip"><code>run_connector_subaction_pushtoservice_subActionParams_incident_source_ip</code> - </a></li>
-    <li><a href="#secrets_properties_cases_webhook"><code>secrets_properties_cases_webhook</code> - Connector secrets properties for Webhook - Case Management connector</a></li>
-    <li><a href="#secrets_properties_d3security"><code>secrets_properties_d3security</code> - Connector secrets properties for a D3 Security connector</a></li>
-    <li><a href="#secrets_properties_email"><code>secrets_properties_email</code> - Connector secrets properties for an email connector</a></li>
-    <li><a href="#secrets_properties_genai"><code>secrets_properties_genai</code> - Connector secrets properties for an OpenAI connector</a></li>
-    <li><a href="#secrets_properties_jira"><code>secrets_properties_jira</code> - Connector secrets properties for a Jira connector</a></li>
-    <li><a href="#secrets_properties_opsgenie"><code>secrets_properties_opsgenie</code> - Connector secrets properties for an Opsgenie connector</a></li>
-    <li><a href="#secrets_properties_pagerduty"><code>secrets_properties_pagerduty</code> - Connector secrets properties for a PagerDuty connector</a></li>
-    <li><a href="#secrets_properties_resilient"><code>secrets_properties_resilient</code> - Connector secrets properties for IBM Resilient connector</a></li>
-    <li><a href="#secrets_properties_servicenow"><code>secrets_properties_servicenow</code> - Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors</a></li>
-    <li><a href="#secrets_properties_slack_api"><code>secrets_properties_slack_api</code> - Connector secrets properties for a Web API Slack connector</a></li>
-    <li><a href="#secrets_properties_slack_webhook"><code>secrets_properties_slack_webhook</code> - Connector secrets properties for a Webhook Slack connector</a></li>
-    <li><a href="#secrets_properties_swimlane"><code>secrets_properties_swimlane</code> - Connector secrets properties for a Swimlane connector</a></li>
-    <li><a href="#secrets_properties_teams"><code>secrets_properties_teams</code> - Connector secrets properties for a Microsoft Teams connector</a></li>
-    <li><a href="#secrets_properties_tines"><code>secrets_properties_tines</code> - Connector secrets properties for a Tines connector</a></li>
-    <li><a href="#secrets_properties_torq"><code>secrets_properties_torq</code> - Connector secrets properties for a Torq connector</a></li>
-    <li><a href="#secrets_properties_webhook"><code>secrets_properties_webhook</code> - Connector secrets properties for a Webhook connector</a></li>
-    <li><a href="#secrets_properties_xmatters"><code>secrets_properties_xmatters</code> - Connector secrets properties for an xMatters connector</a></li>
-    <li><a href="#updateConnector_400_response"><code>updateConnector_400_response</code> - </a></li>
-    <li><a href="#update_connector_request_cases_webhook"><code>update_connector_request_cases_webhook</code> - Update Webhook - Case Managment connector request</a></li>
-    <li><a href="#update_connector_request_d3security"><code>update_connector_request_d3security</code> - Update D3 Security connector request</a></li>
-    <li><a href="#update_connector_request_email"><code>update_connector_request_email</code> - Update email connector request</a></li>
-    <li><a href="#update_connector_request_index"><code>update_connector_request_index</code> - Update index connector request</a></li>
-    <li><a href="#update_connector_request_jira"><code>update_connector_request_jira</code> - Update Jira connector request</a></li>
-    <li><a href="#update_connector_request_opsgenie"><code>update_connector_request_opsgenie</code> - Update Opsgenie connector request</a></li>
-    <li><a href="#update_connector_request_pagerduty"><code>update_connector_request_pagerduty</code> - Update PagerDuty connector request</a></li>
-    <li><a href="#update_connector_request_resilient"><code>update_connector_request_resilient</code> - Update IBM Resilient connector request</a></li>
-    <li><a href="#update_connector_request_serverlog"><code>update_connector_request_serverlog</code> - Update server log connector request</a></li>
-    <li><a href="#update_connector_request_servicenow"><code>update_connector_request_servicenow</code> - Update ServiceNow ITSM connector or ServiceNow SecOps request</a></li>
-    <li><a href="#update_connector_request_servicenow_itom"><code>update_connector_request_servicenow_itom</code> - Create ServiceNow ITOM connector request</a></li>
-    <li><a href="#update_connector_request_slack_api"><code>update_connector_request_slack_api</code> - Update Slack connector request</a></li>
-    <li><a href="#update_connector_request_slack_webhook"><code>update_connector_request_slack_webhook</code> - Update Slack connector request</a></li>
-    <li><a href="#update_connector_request_swimlane"><code>update_connector_request_swimlane</code> - Update Swimlane connector request</a></li>
-    <li><a href="#update_connector_request_teams"><code>update_connector_request_teams</code> - Update Microsoft Teams connector request</a></li>
-    <li><a href="#update_connector_request_tines"><code>update_connector_request_tines</code> - Update Tines connector request</a></li>
-    <li><a href="#update_connector_request_torq"><code>update_connector_request_torq</code> - Update Torq connector request</a></li>
-    <li><a href="#update_connector_request_webhook"><code>update_connector_request_webhook</code> - Update Webhook connector request</a></li>
-    <li><a href="#update_connector_request_xmatters"><code>update_connector_request_xmatters</code> - Update xMatters connector request</a></li>
-  </ol>
-
-  <div class="model">
-    <h3><a name="Alert_identifier_mapping"><code>Alert_identifier_mapping</code> - Alert identifier mapping</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Mapping for the alert ID.</div>
-    <div class="field-items">
-      <div class="param">fieldType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of field in Swimlane. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the field in Swimlane. </div>
-<div class="param">key </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key for the field in Swimlane. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Case_comment_mapping"><code>Case_comment_mapping</code> - Case comment mapping</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Mapping for the case comments.</div>
-    <div class="field-items">
-      <div class="param">fieldType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of field in Swimlane. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the field in Swimlane. </div>
-<div class="param">key </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key for the field in Swimlane. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Case_description_mapping"><code>Case_description_mapping</code> - Case description mapping</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Mapping for the case description.</div>
-    <div class="field-items">
-      <div class="param">fieldType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of field in Swimlane. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the field in Swimlane. </div>
-<div class="param">key </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key for the field in Swimlane. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Case_identifier_mapping"><code>Case_identifier_mapping</code> - Case identifier mapping</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Mapping for the case ID.</div>
-    <div class="field-items">
-      <div class="param">fieldType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of field in Swimlane. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the field in Swimlane. </div>
-<div class="param">key </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key for the field in Swimlane. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Case_name_mapping"><code>Case_name_mapping</code> - Case name mapping</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Mapping for the case name.</div>
-    <div class="field-items">
-      <div class="param">fieldType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of field in Swimlane. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the field in Swimlane. </div>
-<div class="param">key </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key for the field in Swimlane. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Connector_mappings_properties_for_a_Swimlane_connector"><code>Connector_mappings_properties_for_a_Swimlane_connector</code> - Connector mappings properties for a Swimlane connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The field mapping.</div>
-    <div class="field-items">
-      <div class="param">alertIdConfig (optional)</div><div class="param-desc"><span class="param-type"><a href="#Alert_identifier_mapping">Alert_identifier_mapping</a></span>  </div>
-<div class="param">caseIdConfig (optional)</div><div class="param-desc"><span class="param-type"><a href="#Case_identifier_mapping">Case_identifier_mapping</a></span>  </div>
-<div class="param">caseNameConfig (optional)</div><div class="param-desc"><span class="param-type"><a href="#Case_name_mapping">Case_name_mapping</a></span>  </div>
-<div class="param">commentsConfig (optional)</div><div class="param-desc"><span class="param-type"><a href="#Case_comment_mapping">Case_comment_mapping</a></span>  </div>
-<div class="param">descriptionConfig (optional)</div><div class="param-desc"><span class="param-type"><a href="#Case_description_mapping">Case_description_mapping</a></span>  </div>
-<div class="param">ruleNameConfig (optional)</div><div class="param-desc"><span class="param-type"><a href="#Rule_name_mapping">Rule_name_mapping</a></span>  </div>
-<div class="param">severityConfig (optional)</div><div class="param-desc"><span class="param-type"><a href="#Severity_mapping">Severity_mapping</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Create_connector_request_body_properties"><code>Create_connector_request_body_properties</code> - Create connector request body properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary depending on the connector type.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_xmatters">config_properties_xmatters</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.xmatters</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_xmatters">secrets_properties_xmatters</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Get_connector_types_response_body_properties_inner"><code>Get_connector_types_response_body_properties_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is enabled in Kibana. </div>
-<div class="param">enabled_in_config (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is enabled in the Kibana <code>.yml</code> file. </div>
-<div class="param">enabled_in_license (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is enabled in the license. </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#connector_types">connector_types</a></span>  </div>
-<div class="param">minimum_license_required (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The license that is required to use the connector type. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector type. </div>
-<div class="param">supported_feature_ids (optional)</div><div class="param-desc"><span class="param-type"><a href="#features">array[features]</a></span> The Kibana features that are supported by the connector type. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Get_connectors_response_body_properties"><code>Get_connectors_response_body_properties</code> - Get connectors response body properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary for each connector type.</div>
-    <div class="field-items">
-      <div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#connector_types">connector_types</a></span>  </div>
-<div class="param">config (optional)</div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The configuration for the connector. Configuration properties vary depending on the connector type. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">referenced_by_count </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> Indicates the number of saved objects that reference the connector. If <code>is_preconfigured</code> is true, this value is not calculated. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_create_connector_request_properties"><code>Legacy_create_connector_request_properties</code> - Legacy create connector request properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actionTypeId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The connector type identifier. </div>
-<div class="param">config (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The configuration for the connector. Configuration properties vary depending on the connector type. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The secrets configuration for the connector. Secrets configuration properties vary depending on the connector type. NOTE: Remember these values. You must provide them each time you update the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_get_connector_types_response_body_properties_inner"><code>Legacy_get_connector_types_response_body_properties_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is enabled in Kibana. </div>
-<div class="param">enabledInConfig (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is enabled in the Kibana <code>.yml</code> file. </div>
-<div class="param">enabledInLicense (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is enabled in the license. </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The unique identifier for the connector type. </div>
-<div class="param">minimumLicenseRequired (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The license that is required to use the connector type. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the connector type. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_run_connector_request_body_properties"><code>Legacy_run_connector_request_body_properties</code> - Legacy run connector request body properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary depending on the connector type.</div>
-    <div class="field-items">
-      <div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The parameters of the connector. Parameter properties vary depending on the connector type. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_update_connector_request_body_properties"><code>Legacy_update_connector_request_body_properties</code> - Legacy update connector request body properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary depending on the connector type.</div>
-    <div class="field-items">
-      <div class="param">config (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The new connector configuration. Configuration properties vary depending on the connector type. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The new name for the connector. </div>
-<div class="param">secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The updated secrets configuration for the connector. Secrets properties vary depending on the connector type. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Not_found_response"><code>Not_found_response</code> - Not found response</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">Not Found</div>
-<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">404</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Rule_name_mapping"><code>Rule_name_mapping</code> - Rule name mapping</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Mapping for the name of the alert's rule.</div>
-    <div class="field-items">
-      <div class="param">fieldType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of field in Swimlane. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the field in Swimlane. </div>
-<div class="param">key </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key for the field in Swimlane. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Run_connector_request_body_properties"><code>Run_connector_request_body_properties</code> - Run connector request body properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary depending on the connector type.</div>
-    <div class="field-items">
-      <div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#Run_connector_request_body_properties_params">Run_connector_request_body_properties_params</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Run_connector_request_body_properties_params"><code>Run_connector_request_body_properties_params</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">documents </div><div class="param-desc"><span class="param-type"><a href="#map">array[map[String, oas_any_type_not_mapped]]</a></span> The documents in JSON format for index connectors. </div>
-<div class="param">level (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The log level of the message for server log connectors. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">debug</div><div class="param-enum">error</div><div class="param-enum">fatal</div><div class="param-enum">info</div><div class="param-enum">trace</div><div class="param-enum">warn</div>
-<div class="param">message </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The message for server log connectors. </div>
-<div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">pushToService</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams">run_connector_subaction_pushtoservice_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Severity_mapping"><code>Severity_mapping</code> - Severity mapping</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Mapping for the severity.</div>
-    <div class="field-items">
-      <div class="param">fieldType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of field in Swimlane. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the field in Swimlane. </div>
-<div class="param">key </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key for the field in Swimlane. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the field in Swimlane. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Subaction_parameters"><code>Subaction_parameters</code> - Subaction parameters</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Test an action that involves a subaction.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">pushToService</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams">run_connector_subaction_pushtoservice_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Unauthorized_response"><code>Unauthorized_response</code> - Unauthorized response</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">Unauthorized</div>
-<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">401</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Update_connector_request_body_properties"><code>Update_connector_request_body_properties</code> - Update connector request body properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary depending on the connector type.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_xmatters">config_properties_xmatters</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_xmatters">secrets_properties_xmatters</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.gen-ai</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="action_response_properties"><code>action_response_properties</code> - Action response properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary depending on the action type.</div>
-    <div class="field-items">
-      <div class="param">actionTypeId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">config (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">isDeprecated (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the action type is deprecated. </div>
-<div class="param">isMissingSecrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the action. </div>
-<div class="param">isPreconfigured (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured action. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_cases_webhook"><code>config_properties_cases_webhook</code> - Connector request properties for Webhook - Case Management connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.cases-webhook</code>.</div>
-    <div class="field-items">
-      <div class="param">createCommentJson (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is <code>case.comment</code>. Due to Mustache template variables (the text enclosed in triple braces, for example, <code>{{{case.title}}}</code>), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass. </div>
-<div class="param">createCommentMethod (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The REST API HTTP request method to create a case comment in the third-party system. Valid values are <code>patch</code>, <code>post</code>, and <code>put</code>. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">patch</div><div class="param-enum">post</div><div class="param-enum">put</div>
-<div class="param">createCommentUrl (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the <code>xpack.actions.allowedHosts setting</code>, add the hostname to the allowed hosts. </div>
-<div class="param">createIncidentJson </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are <code>case.title</code> and <code>case.description</code>. Due to Mustache template variables (which is the text enclosed in triple braces, for example, <code>{{{case.title}}}</code>), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review. </div>
-<div class="param">createIncidentMethod (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The REST API HTTP request method to create a case in the third-party system. Valid values are <code>patch</code>, <code>post</code>, and <code>put</code>. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">patch</div><div class="param-enum">post</div><div class="param-enum">put</div>
-<div class="param">createIncidentResponseKey </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The JSON key in the create case response that contains the external case ID. </div>
-<div class="param">createIncidentUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The REST API URL to create a case in the third-party system. If you are using the <code>xpack.actions.allowedHosts</code> setting, add the hostname to the allowed hosts. </div>
-<div class="param">getIncidentResponseExternalTitleKey </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The JSON key in get case response that contains the external case title. </div>
-<div class="param">getIncidentUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The REST API URL to get the case by ID from the third-party system. If you are using the <code>xpack.actions.allowedHosts</code> setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, <code>{{{case.title}}}</code>), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass. </div>
-<div class="param">hasAuth (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> If true, a username and password for login type authentication must be provided. </div>
-<div class="param">headers (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods. </div>
-<div class="param">updateIncidentJson </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are <code>case.title</code> and <code>case.description</code>. Due to Mustache template variables (which is the text enclosed in triple braces, for example, <code>{{{case.title}}}</code>), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review. </div>
-<div class="param">updateIncidentMethod (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The REST API HTTP request method to update the case in the third-party system. Valid values are <code>patch</code>, <code>post</code>, and <code>put</code>. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">patch</div><div class="param-enum">post</div><div class="param-enum">put</div>
-<div class="param">updateIncidentUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the <code>xpack.actions.allowedHosts</code> setting, add the hostname to the allowed hosts. </div>
-<div class="param">viewIncidentUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_d3security"><code>config_properties_d3security</code> - Connector request properties for a D3 Security connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.d3security</code>.</div>
-    <div class="field-items">
-      <div class="param">url </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The D3 Security API request URL. If you are using the <code>xpack.actions.allowedHosts</code> setting, add the hostname to the allowed hosts. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_email"><code>config_properties_email</code> - Connector request properties for an email connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.email</code>.</div>
-    <div class="field-items">
-      <div class="param">clientId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If <code>service</code> is <code>exchange_server</code>, this property is required. </div>
-<div class="param">from </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The from address for all emails sent by the connector. It must be specified in <code>user@host-name</code> format. </div>
-<div class="param">hasAuth (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Specifies whether a user and password are required inside the secrets configuration. </div>
-<div class="param">host (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The host name of the service provider. If the <code>service</code> is <code>elastic_cloud</code> (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If <code>service</code> is <code>other</code>, this property must be defined. </div>
-<div class="param">oauthTokenUrl (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">port (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The port to connect to on the service provider. If the <code>service</code> is <code>elastic_cloud</code> (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If <code>service</code> is <code>other</code>, this property must be defined. </div>
-<div class="param">secure (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Specifies whether the connection to the service provider will use TLS. If the <code>service</code> is <code>elastic_cloud</code> (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. </div>
-<div class="param">service (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the email service. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">elastic_cloud</div><div class="param-enum">exchange_server</div><div class="param-enum">gmail</div><div class="param-enum">other</div><div class="param-enum">outlook365</div><div class="param-enum">ses</div>
-<div class="param">tenantId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If <code>service</code> is <code>exchange_server</code>, this property is required. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_genai"><code>config_properties_genai</code> - Connector request properties for an OpenAI connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.gen-ai</code>.</div>
-    <div class="field-items">
-      <div class="param">apiProvider </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The OpenAI API provider. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">OpenAI</div>
-<div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The OpenAI API endpoint. </div>
-<div class="param">defaultModel (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The default model to use for requests. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_genai_oneOf"><code>config_properties_genai_oneOf</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">apiProvider </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The OpenAI API provider. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">Azure OpenAI</div>
-<div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The OpenAI API endpoint. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_genai_oneOf_1"><code>config_properties_genai_oneOf_1</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">apiProvider </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The OpenAI API provider. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">OpenAI</div>
-<div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The OpenAI API endpoint. </div>
-<div class="param">defaultModel (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The default model to use for requests. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_index"><code>config_properties_index</code> - Connector request properties for an index connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.index</code>.</div>
-    <div class="field-items">
-      <div class="param">executionTimeField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A field that indicates when the document was indexed. </div>
-<div class="param">index </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Elasticsearch index to be written to. </div>
-<div class="param">refresh (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_jira"><code>config_properties_jira</code> - Connector request properties for a Jira connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.jira</code>.</div>
-    <div class="field-items">
-      <div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira instance URL. </div>
-<div class="param">projectKey </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira project key. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_opsgenie"><code>config_properties_opsgenie</code> - Connector request properties for an Opsgenie connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.opsgenie</code>.</div>
-    <div class="field-items">
-      <div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Opsgenie URL. For example, <code>https://api.opsgenie.com</code> or <code>https://api.eu.opsgenie.com</code>. If you are using the <code>xpack.actions.allowedHosts</code> setting, add the hostname to the allowed hosts. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_pagerduty"><code>config_properties_pagerduty</code> - Connector request properties for a PagerDuty connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.pagerduty</code>.</div>
-    <div class="field-items">
-      <div class="param">apiUrl (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The PagerDuty event URL. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_resilient"><code>config_properties_resilient</code> - Connector request properties for a IBM Resilient connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.resilient</code>.</div>
-    <div class="field-items">
-      <div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The IBM Resilient instance URL. </div>
-<div class="param">orgId </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The IBM Resilient organization ID. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_servicenow"><code>config_properties_servicenow</code> - Connector request properties for a ServiceNow ITSM connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.servicenow</code>.</div>
-    <div class="field-items">
-      <div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ServiceNow instance URL. </div>
-<div class="param">clientId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The client ID assigned to your OAuth application. This property is required when <code>isOAuth</code> is <code>true</code>. </div>
-<div class="param">isOAuth (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth). </div>
-<div class="param">jwtKeyId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when <code>isOAuth</code> is <code>true</code>. </div>
-<div class="param">userIdentifierValue (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is <code>Email</code>, the user identifier should be the user's email address. This property is required when <code>isOAuth</code> is <code>true</code>. </div>
-<div class="param">usesTableApi (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors.  NOTE: If this property is set to <code>false</code>, the Elastic application should be installed in ServiceNow. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_servicenow_itom"><code>config_properties_servicenow_itom</code> - Connector request properties for a ServiceNow ITSM connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.servicenow</code>.</div>
-    <div class="field-items">
-      <div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ServiceNow instance URL. </div>
-<div class="param">clientId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The client ID assigned to your OAuth application. This property is required when <code>isOAuth</code> is <code>true</code>. </div>
-<div class="param">isOAuth (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth). </div>
-<div class="param">jwtKeyId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when <code>isOAuth</code> is <code>true</code>. </div>
-<div class="param">userIdentifierValue (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is <code>Email</code>, the user identifier should be the user's email address. This property is required when <code>isOAuth</code> is <code>true</code>. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_swimlane"><code>config_properties_swimlane</code> - Connector request properties for a Swimlane connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.swimlane</code>.</div>
-    <div class="field-items">
-      <div class="param">apiUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Swimlane instance URL. </div>
-<div class="param">appId </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Swimlane application ID. </div>
-<div class="param">connectorType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. Valid values are <code>all</code>, <code>alerts</code>, and <code>cases</code>. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">all</div><div class="param-enum">alerts</div><div class="param-enum">cases</div>
-<div class="param">mappings (optional)</div><div class="param-desc"><span class="param-type"><a href="#Connector_mappings_properties_for_a_Swimlane_connector">Connector_mappings_properties_for_a_Swimlane_connector</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_tines"><code>config_properties_tines</code> - Connector request properties for a Tines connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.tines</code>.</div>
-    <div class="field-items">
-      <div class="param">url </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Tines tenant URL. If you are using the <code>xpack.actions.allowedHosts</code> setting, make sure this hostname is added to the allowed hosts. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_torq"><code>config_properties_torq</code> - Connector request properties for a Torq connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.torq</code>.</div>
-    <div class="field-items">
-      <div class="param">webhookIntegrationUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The endpoint URL of the Elastic Security integration in Torq. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_webhook"><code>config_properties_webhook</code> - Connector request properties for a Webhook connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.webhook</code>.</div>
-    <div class="field-items">
-      <div class="param">authType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of authentication to use: basic, SSL, or none. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">webhook-authentication-basic</div><div class="param-enum">webhook-authentication-ssl</div><div class="param-enum">null</div>
-<div class="param">ca (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types. </div>
-<div class="param">certType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> If the <code>authType</code> is <code>webhook-authentication-ssl</code>, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">ssl-crt-key</div><div class="param-enum">ssl-pfx</div>
-<div class="param">hasAuth (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> If <code>true</code>, a user name and password must be provided for login type authentication. </div>
-<div class="param">headers (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> A set of key-value pairs sent as headers with the request. </div>
-<div class="param">method (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The HTTP request method, either <code>post</code> or <code>put</code>. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">post</div><div class="param-enum">put</div>
-<div class="param">url (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The request URL. If you are using the <code>xpack.actions.allowedHosts</code> setting, add the hostname to the allowed hosts. </div>
-<div class="param">verificationMode (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Controls the verification of certificates. Use <code>full</code> to validate that the certificate has an issue date within the <code>not_before</code> and <code>not_after</code> dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use <code>certificate</code> to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use <code>none</code> to skip certificate validation. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">certificate</div><div class="param-enum">full</div><div class="param-enum">none</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="config_properties_xmatters"><code>config_properties_xmatters</code> - Connector request properties for an xMatters connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines properties for connectors when type is <code>.xmatters</code>.</div>
-    <div class="field-items">
-      <div class="param">configUrl (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when <code>usesBasic</code> is <code>true</code>. </div>
-<div class="param">usesBasic (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Specifies whether the connector uses HTTP basic authentication (<code>true</code>) or URL authentication (<code>false</code>). </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties"><code>connector_response_properties</code> - Connector response properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary depending on the connector type.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_xmatters">config_properties_xmatters</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.xmatters</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_cases_webhook"><code>connector_response_properties_cases_webhook</code> - Connector request properties for a Webhook - Case Management connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_cases_webhook">config_properties_cases_webhook</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.cases-webhook</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_d3security"><code>connector_response_properties_d3security</code> - Connector response properties for a D3 Security connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_d3security">config_properties_d3security</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.d3security</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_email"><code>connector_response_properties_email</code> - Connector response properties for an email connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_email">config_properties_email</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.email</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_index"><code>connector_response_properties_index</code> - Connector response properties for an index connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_index">config_properties_index</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.index</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_jira"><code>connector_response_properties_jira</code> - Connector response properties for a Jira connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_jira">config_properties_jira</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.jira</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_opsgenie"><code>connector_response_properties_opsgenie</code> - Connector response properties for an Opsgenie connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_opsgenie">config_properties_opsgenie</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.opsgenie</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_pagerduty"><code>connector_response_properties_pagerduty</code> - Connector response properties for a PagerDuty connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_pagerduty">config_properties_pagerduty</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.pagerduty</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_resilient"><code>connector_response_properties_resilient</code> - Connector response properties for a IBM Resilient connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_resilient">config_properties_resilient</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.resilient</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_serverlog"><code>connector_response_properties_serverlog</code> - Connector response properties for a server log connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.server-log</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_servicenow"><code>connector_response_properties_servicenow</code> - Connector response properties for a ServiceNow ITSM connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_servicenow">config_properties_servicenow</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.servicenow</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_servicenow_itom"><code>connector_response_properties_servicenow_itom</code> - Connector response properties for a ServiceNow ITOM connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_servicenow_itom">config_properties_servicenow_itom</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.servicenow-itom</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_servicenow_sir"><code>connector_response_properties_servicenow_sir</code> - Connector response properties for a ServiceNow SecOps connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_servicenow">config_properties_servicenow</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.servicenow-sir</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_slack_api"><code>connector_response_properties_slack_api</code> - Connector response properties for a Slack connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.slack_api</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_slack_webhook"><code>connector_response_properties_slack_webhook</code> - Connector response properties for a Slack connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.slack</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_swimlane"><code>connector_response_properties_swimlane</code> - Connector response properties for a Swimlane connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_swimlane">config_properties_swimlane</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.swimlane</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_teams"><code>connector_response_properties_teams</code> - Connector response properties for a Microsoft Teams connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.teams</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_tines"><code>connector_response_properties_tines</code> - Connector response properties for a Tines connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_tines">config_properties_tines</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.tines</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_torq"><code>connector_response_properties_torq</code> - Connector response properties for a Torq connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_torq">config_properties_torq</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.torq</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_webhook"><code>connector_response_properties_webhook</code> - Connector response properties for a Webhook connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_webhook">config_properties_webhook</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.webhook</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_response_properties_xmatters"><code>connector_response_properties_xmatters</code> - Connector response properties for an xMatters connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_xmatters">config_properties_xmatters</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.xmatters</div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">is_deprecated </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector type is deprecated. </div>
-<div class="param">is_missing_secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type. </div>
-<div class="param">is_preconfigured </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether it is a preconfigured connector. If true, the <code>config</code> and <code>is_missing_secrets</code> properties are omitted from the response. </div>
-<div class="param">is_system_action (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the connector is used for system actions. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="connector_types"><code>connector_types</code> - Connector types</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The type of connector. For example, <code>.email</code>, <code>.index</code>, <code>.jira</code>, <code>.opsgenie</code>, or <code>.server-log</code>.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_cases_webhook"><code>create_connector_request_cases_webhook</code> - Create Webhook - Case Managment connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Webhook - Case Management connector uses axios to send POST, PUT, and GET requests to a case management RESTful API web service.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_cases_webhook">config_properties_cases_webhook</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.cases-webhook</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_cases_webhook">secrets_properties_cases_webhook</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_d3security"><code>create_connector_request_d3security</code> - Create D3 Security connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The connector uses axios to send a POST request to a D3 Security endpoint.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_d3security">config_properties_d3security</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.d3security</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_d3security">secrets_properties_d3security</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_email"><code>create_connector_request_email</code> - Create email connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The email connector uses the SMTP protocol to send mail messages, using an integration of Nodemailer. An exception is Microsoft Exchange, which uses HTTP protocol for sending emails, Send mail. Email message text is sent as both plain text and html text.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_email">config_properties_email</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.email</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_email">secrets_properties_email</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_genai"><code>create_connector_request_genai</code> - Create OpenAI connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The OpenAI connector uses axios to send a POST request to either OpenAI or Azure OpenAPI.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_genai">config_properties_genai</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.gen-ai</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_genai">secrets_properties_genai</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_index"><code>create_connector_request_index</code> - Create index connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The index connector indexes a document into Elasticsearch.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_index">config_properties_index</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.index</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_jira"><code>create_connector_request_jira</code> - Create Jira connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Jira connector uses the REST API v2 to create Jira issues.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_jira">config_properties_jira</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.jira</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_jira">secrets_properties_jira</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_opsgenie"><code>create_connector_request_opsgenie</code> - Create Opsgenie connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Opsgenie connector uses the Opsgenie alert API.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_opsgenie">config_properties_opsgenie</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.opsgenie</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_opsgenie">secrets_properties_opsgenie</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_pagerduty"><code>create_connector_request_pagerduty</code> - Create PagerDuty connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The PagerDuty connector uses the v2 Events API to trigger, acknowledge, and resolve PagerDuty alerts.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_pagerduty">config_properties_pagerduty</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.pagerduty</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_pagerduty">secrets_properties_pagerduty</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_resilient"><code>create_connector_request_resilient</code> - Create IBM Resilient connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The IBM Resilient connector uses the RESILIENT REST v2 to create IBM Resilient incidents.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_resilient">config_properties_resilient</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.resilient</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_resilient">secrets_properties_resilient</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_serverlog"><code>create_connector_request_serverlog</code> - Create server log connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>This connector writes an entry to the Kibana server log.</div>
-    <div class="field-items">
-      <div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.server-log</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_servicenow"><code>create_connector_request_servicenow</code> - Create ServiceNow ITSM connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The ServiceNow ITSM connector uses the import set API to create ServiceNow incidents. You can use the connector for rule actions and cases.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_servicenow">config_properties_servicenow</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.servicenow</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_servicenow">secrets_properties_servicenow</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_servicenow_itom"><code>create_connector_request_servicenow_itom</code> - Create ServiceNow ITOM connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The ServiceNow ITOM connector uses the event API to create ServiceNow events. You can use the connector for rule actions.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_servicenow_itom">config_properties_servicenow_itom</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.servicenow-itom</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_servicenow">secrets_properties_servicenow</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_servicenow_sir"><code>create_connector_request_servicenow_sir</code> - Create ServiceNow SecOps connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The ServiceNow SecOps connector uses the import set API to create ServiceNow security incidents. You can use the connector for rule actions and cases.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_servicenow">config_properties_servicenow</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.servicenow-sir</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_servicenow">secrets_properties_servicenow</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_slack_api"><code>create_connector_request_slack_api</code> - Create Slack connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Slack connector uses Slack Incoming Webhooks.</div>
-    <div class="field-items">
-      <div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.slack_api</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_slack_api">secrets_properties_slack_api</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_slack_webhook"><code>create_connector_request_slack_webhook</code> - Create Slack connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Slack connector uses Slack Incoming Webhooks.</div>
-    <div class="field-items">
-      <div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.slack</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_slack_webhook">secrets_properties_slack_webhook</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_swimlane"><code>create_connector_request_swimlane</code> - Create Swimlane connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Swimlane connector uses the Swimlane REST API to create Swimlane records.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_swimlane">config_properties_swimlane</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.swimlane</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_swimlane">secrets_properties_swimlane</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_teams"><code>create_connector_request_teams</code> - Create Microsoft Teams connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Microsoft Teams connector uses Incoming Webhooks.</div>
-    <div class="field-items">
-      <div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.teams</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_teams">secrets_properties_teams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_tines"><code>create_connector_request_tines</code> - Create Tines connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Tines connector uses Tines Webhook actions to send events via POST request.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_tines">config_properties_tines</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.tines</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_tines">secrets_properties_tines</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_torq"><code>create_connector_request_torq</code> - Create Torq connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Torq connector uses a Torq webhook to trigger workflows with Kibana actions.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_torq">config_properties_torq</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.torq</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_torq">secrets_properties_torq</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_webhook"><code>create_connector_request_webhook</code> - Create Webhook connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The Webhook connector uses axios to send a POST or PUT request to a web service.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_webhook">config_properties_webhook</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.webhook</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_webhook">secrets_properties_webhook</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_connector_request_xmatters"><code>create_connector_request_xmatters</code> - Create xMatters connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The xMatters connector uses the xMatters Workflow for Elastic to send actionable alerts to on-call xMatters resources.</div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_xmatters">config_properties_xmatters</a></span>  </div>
-<div class="param">connector_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.xmatters</div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_xmatters">secrets_properties_xmatters</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="features"><code>features</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The feature that uses the connector. Valid values are <code>alerting</code>, <code>cases</code>, <code>uptime</code>, and <code>siem</code>.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getConnector_404_response"><code>getConnector_404_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyRunConnector_200_response"><code>legacyRunConnector_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actionId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">data (optional)</div><div class="param-desc"><span class="param-type"><a href="#runConnector_200_response_data">runConnector_200_response_data</a></span>  </div>
-<div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The status of the action. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="runConnector_200_response"><code>runConnector_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">connector_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector. </div>
-<div class="param">data (optional)</div><div class="param-desc"><span class="param-type"><a href="#runConnector_200_response_data">runConnector_200_response_data</a></span>  </div>
-<div class="param">status </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The status of the action. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">error</div><div class="param-enum">ok</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="runConnector_200_response_data"><code>runConnector_200_response_data</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_params_documents"><code>run_connector_params_documents</code> - Index connector parameters</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Test an action that indexes a document into Elasticsearch.</div>
-    <div class="field-items">
-      <div class="param">documents </div><div class="param-desc"><span class="param-type"><a href="#map">array[map[String, oas_any_type_not_mapped]]</a></span> The documents in JSON format for index connectors. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_params_level_message"><code>run_connector_params_level_message</code> - Server log connector parameters</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Test an action that writes an entry to the Kibana server log.</div>
-    <div class="field-items">
-      <div class="param">level (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The log level of the message for server log connectors. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">debug</div><div class="param-enum">error</div><div class="param-enum">fatal</div><div class="param-enum">info</div><div class="param-enum">trace</div><div class="param-enum">warn</div>
-<div class="param">message </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The message for server log connectors. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_addevent"><code>run_connector_subaction_addevent</code> - The addEvent subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>addEvent</code> subaction for ServiceNow ITOM connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">addEvent</div>
-<div class="param">subActionParams (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_addevent_subActionParams">run_connector_subaction_addevent_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_addevent_subActionParams"><code>run_connector_subaction_addevent_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The set of configuration properties for the action.</div>
-    <div class="field-items">
-      <div class="param">additional_info (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Additional information about the event. </div>
-<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The details about the event. </div>
-<div class="param">event_class (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A specific instance of the source. </div>
-<div class="param">message_key (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> All actions sharing this key are associated with the same ServiceNow alert. The default value is <code>&lt;rule ID&gt;:&lt;alert instance ID&gt;</code>. </div>
-<div class="param">metric_name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the metric. </div>
-<div class="param">node (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The host that the event was triggered for. </div>
-<div class="param">resource (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the resource. </div>
-<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The severity of the event. </div>
-<div class="param">source (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the event source type. </div>
-<div class="param">time_of_event (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The time of the event. </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of event. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_closealert"><code>run_connector_subaction_closealert</code> - The closeAlert subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>closeAlert</code> subaction for Opsgenie connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">closeAlert</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_closealert_subActionParams">run_connector_subaction_closealert_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_closealert_subActionParams"><code>run_connector_subaction_closealert_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alias </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert. </div>
-<div class="param">note (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Additional information for the alert. </div>
-<div class="param">source (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the source of the alert. </div>
-<div class="param">user (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the owner. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_createalert"><code>run_connector_subaction_createalert</code> - The createAlert subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>createAlert</code> subaction for Opsgenie connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">createAlert</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_createalert_subActionParams">run_connector_subaction_createalert_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_createalert_subActionParams"><code>run_connector_subaction_createalert_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The custom actions available to the alert. </div>
-<div class="param">alias (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The unique identifier used for alert deduplication in Opsgenie. </div>
-<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A description that provides detailed information about the alert. </div>
-<div class="param">details (optional)</div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The custom properties of the alert. </div>
-<div class="param">entity (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The domain of the alert. For example, the application or server name. </div>
-<div class="param">message </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The alert message. </div>
-<div class="param">note (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Additional information for the alert. </div>
-<div class="param">priority (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The priority level for the alert. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">P1</div><div class="param-enum">P2</div><div class="param-enum">P3</div><div class="param-enum">P4</div><div class="param-enum">P5</div>
-<div class="param">responders (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_createalert_subActionParams_responders_inner">array[run_connector_subaction_createalert_subActionParams_responders_inner]</a></span> The entities to receive notifications about the alert. If <code>type</code> is <code>user</code>, either <code>id</code> or <code>username</code> is required. If <code>type</code> is <code>team</code>, either <code>id</code> or <code>name</code> is required. </div>
-<div class="param">source (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the source of the alert. </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the alert. </div>
-<div class="param">user (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the owner. </div>
-<div class="param">visibleTo (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_createalert_subActionParams_visibleTo_inner">array[run_connector_subaction_createalert_subActionParams_visibleTo_inner]</a></span> The teams and users that the alert will be visible to without sending a notification. Only one of <code>id</code>, <code>name</code>, or <code>username</code> is required. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_createalert_subActionParams_responders_inner"><code>run_connector_subaction_createalert_subActionParams_responders_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the entity. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the entity. </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of responders, in this case <code>escalation</code>. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">escalation</div><div class="param-enum">schedule</div><div class="param-enum">team</div><div class="param-enum">user</div>
-<div class="param">username (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A valid email address for the user. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_createalert_subActionParams_visibleTo_inner"><code>run_connector_subaction_createalert_subActionParams_visibleTo_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the entity. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the entity. </div>
-<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Valid values are <code>team</code> and <code>user</code>. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">team</div><div class="param-enum">user</div>
-<div class="param">username (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The user name. This property is required only when the <code>type</code> is <code>user</code>. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_fieldsbyissuetype"><code>run_connector_subaction_fieldsbyissuetype</code> - The fieldsByIssueType subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>fieldsByIssueType</code> subaction for Jira connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">fieldsByIssueType</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_fieldsbyissuetype_subActionParams">run_connector_subaction_fieldsbyissuetype_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_fieldsbyissuetype_subActionParams"><code>run_connector_subaction_fieldsbyissuetype_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira issue type identifier. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_getchoices"><code>run_connector_subaction_getchoices</code> - The getChoices subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>getChoices</code> subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">getChoices</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_getchoices_subActionParams">run_connector_subaction_getchoices_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_getchoices_subActionParams"><code>run_connector_subaction_getchoices_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The set of configuration properties for the action.</div>
-    <div class="field-items">
-      <div class="param">fields </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> An array of fields. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_getfields"><code>run_connector_subaction_getfields</code> - The getFields subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>getFields</code> subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">getFields</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_getincident"><code>run_connector_subaction_getincident</code> - The getIncident subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>getIncident</code> subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">getIncident</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_getincident_subActionParams">run_connector_subaction_getincident_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_getincident_subActionParams"><code>run_connector_subaction_getincident_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">externalId </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_issue"><code>run_connector_subaction_issue</code> - The issue subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>issue</code> subaction for Jira connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">issue</div>
-<div class="param">subActionParams (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_issue_subActionParams">run_connector_subaction_issue_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_issue_subActionParams"><code>run_connector_subaction_issue_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira issue identifier. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_issues"><code>run_connector_subaction_issues</code> - The issues subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>issues</code> subaction for Jira connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">issues</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_issues_subActionParams">run_connector_subaction_issues_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_issues_subActionParams"><code>run_connector_subaction_issues_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">title </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The title of the Jira issue. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_issuetypes"><code>run_connector_subaction_issuetypes</code> - The issueTypes subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>issueTypes</code> subaction for Jira connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">issueTypes</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_pushtoservice"><code>run_connector_subaction_pushtoservice</code> - The pushToService subaction</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The <code>pushToService</code> subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.</div>
-    <div class="field-items">
-      <div class="param">subAction </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The action to test. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">pushToService</div>
-<div class="param">subActionParams </div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams">run_connector_subaction_pushtoservice_subActionParams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_pushtoservice_subActionParams"><code>run_connector_subaction_pushtoservice_subActionParams</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The set of configuration properties for the action.</div>
-    <div class="field-items">
-      <div class="param">comments (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_comments_inner">array[run_connector_subaction_pushtoservice_subActionParams_comments_inner]</a></span> Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane. </div>
-<div class="param">incident (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident">run_connector_subaction_pushtoservice_subActionParams_incident</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_pushtoservice_subActionParams_comments_inner"><code>run_connector_subaction_pushtoservice_subActionParams_comments_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">comment (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A comment related to the incident. For example, describe how to troubleshoot the issue. </div>
-<div class="param">commentId (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> A unique identifier for the comment. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident"><code>run_connector_subaction_pushtoservice_subActionParams_incident</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident.</div>
-    <div class="field-items">
-      <div class="param">alertId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The alert identifier for Swimlane connectors. </div>
-<div class="param">caseId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The case identifier for the incident for Swimlane connectors. </div>
-<div class="param">caseName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The case name for the incident for Swimlane connectors. </div>
-<div class="param">category (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. </div>
-<div class="param">correlation_display (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors. </div>
-<div class="param">correlation_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as <code>{{ruleID}}:{{alert ID}}</code> to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of <code>{{ruleID}}:{{alert ID}}</code> ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert. </div>
-<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors. </div>
-<div class="param">dest_ip (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip">run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip</a></span>  </div>
-<div class="param">externalId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created. </div>
-<div class="param">impact (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The impact of the incident for ServiceNow ITSM connectors. </div>
-<div class="param">issueType (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set <code>subAction</code> to <code>issueTypes</code>. </div>
-<div class="param">labels (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces. </div>
-<div class="param">malware_hash (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash">run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash</a></span>  </div>
-<div class="param">malware_url (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_malware_url">run_connector_subaction_pushtoservice_subActionParams_incident_malware_url</a></span>  </div>
-<div class="param">parent (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID or key of the parent issue for Jira connectors. Applies only to <code>Sub-task</code> types of issues. </div>
-<div class="param">priority (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The priority of the incident in Jira and ServiceNow SecOps connectors. </div>
-<div class="param">ruleName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The rule name for Swimlane connectors. </div>
-<div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The severity of the incident for ServiceNow ITSM and Swimlane connectors. </div>
-<div class="param">short_description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base. </div>
-<div class="param">source_ip (optional)</div><div class="param-desc"><span class="param-type"><a href="#run_connector_subaction_pushtoservice_subActionParams_incident_source_ip">run_connector_subaction_pushtoservice_subActionParams_incident_source_ip</a></span>  </div>
-<div class="param">subcategory (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. </div>
-<div class="param">summary (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A summary of the incident for Jira connectors. </div>
-<div class="param">title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A title for the incident for Jira connectors. It is used for searching the contents of the knowledge base. </div>
-<div class="param">urgency (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The urgency of the incident for ServiceNow ITSM connectors. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip"><code>run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash"><code>run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident_malware_url"><code>run_connector_subaction_pushtoservice_subActionParams_incident_malware_url</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="run_connector_subaction_pushtoservice_subActionParams_incident_source_ip"><code>run_connector_subaction_pushtoservice_subActionParams_incident_source_ip</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_cases_webhook"><code>secrets_properties_cases_webhook</code> - Connector secrets properties for Webhook - Case Management connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">password (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The password for HTTP basic authentication. If <code>hasAuth</code> is set to <code>true</code>, this property is required. </div>
-<div class="param">user (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The username for HTTP basic authentication. If <code>hasAuth</code> is set to <code>true</code>, this property is required. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_d3security"><code>secrets_properties_d3security</code> - Connector secrets properties for a D3 Security connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.d3security</code>.</div>
-    <div class="field-items">
-      <div class="param">token </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The D3 Security token. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_email"><code>secrets_properties_email</code> - Connector secrets properties for an email connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.email</code>.</div>
-    <div class="field-items">
-      <div class="param">clientSecret (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If <code>service</code> is <code>exchange_server</code>, this property is required. </div>
-<div class="param">password (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The password for HTTP basic authentication. If <code>hasAuth</code> is set to <code>true</code>, this property is required. </div>
-<div class="param">user (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The username for HTTP basic authentication. If <code>hasAuth</code> is set to <code>true</code>, this property is required. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_genai"><code>secrets_properties_genai</code> - Connector secrets properties for an OpenAI connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.gen-ai</code>.</div>
-    <div class="field-items">
-      <div class="param">apiKey (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The OpenAI API key. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_jira"><code>secrets_properties_jira</code> - Connector secrets properties for a Jira connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.jira</code>.</div>
-    <div class="field-items">
-      <div class="param">apiToken </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Jira API authentication token for HTTP basic authentication. </div>
-<div class="param">email </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The account email for HTTP Basic authentication. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_opsgenie"><code>secrets_properties_opsgenie</code> - Connector secrets properties for an Opsgenie connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.opsgenie</code>.</div>
-    <div class="field-items">
-      <div class="param">apiKey </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Opsgenie API authentication key for HTTP Basic authentication. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_pagerduty"><code>secrets_properties_pagerduty</code> - Connector secrets properties for a PagerDuty connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.pagerduty</code>.</div>
-    <div class="field-items">
-      <div class="param">routingKey </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A 32 character PagerDuty Integration Key for an integration on a service. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_resilient"><code>secrets_properties_resilient</code> - Connector secrets properties for IBM Resilient connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.resilient</code>.</div>
-    <div class="field-items">
-      <div class="param">apiKeyId </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The authentication key ID for HTTP Basic authentication. </div>
-<div class="param">apiKeySecret </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The authentication key secret for HTTP Basic authentication. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_servicenow"><code>secrets_properties_servicenow</code> - Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.servicenow</code>, <code>.servicenow-sir</code>, or <code>.servicenow-itom</code>.</div>
-    <div class="field-items">
-      <div class="param">clientSecret (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The client secret assigned to your OAuth application. This property is required when <code>isOAuth</code> is <code>true</code>. </div>
-<div class="param">password (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The password for HTTP basic authentication. This property is required when <code>isOAuth</code> is <code>false</code>. </div>
-<div class="param">privateKey (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The RSA private key that you created for use in ServiceNow. This property is required when <code>isOAuth</code> is <code>true</code>. </div>
-<div class="param">privateKeyPassword (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The password for the RSA private key. This property is required when <code>isOAuth</code> is <code>true</code> and you set a password on your private key. </div>
-<div class="param">username (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The username for HTTP basic authentication. This property is required when <code>isOAuth</code> is <code>false</code>. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_slack_api"><code>secrets_properties_slack_api</code> - Connector secrets properties for a Web API Slack connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.slack</code>.</div>
-    <div class="field-items">
-      <div class="param">token </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Slack bot user OAuth token. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_slack_webhook"><code>secrets_properties_slack_webhook</code> - Connector secrets properties for a Webhook Slack connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.slack</code>.</div>
-    <div class="field-items">
-      <div class="param">webhookUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Slack webhook url. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_swimlane"><code>secrets_properties_swimlane</code> - Connector secrets properties for a Swimlane connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.swimlane</code>.</div>
-    <div class="field-items">
-      <div class="param">apiToken (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Swimlane API authentication token. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_teams"><code>secrets_properties_teams</code> - Connector secrets properties for a Microsoft Teams connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.teams</code>.</div>
-    <div class="field-items">
-      <div class="param">webhookUrl </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The URL of the incoming webhook. If you are using the <code>xpack.actions.allowedHosts</code> setting, add the hostname to the allowed hosts. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_tines"><code>secrets_properties_tines</code> - Connector secrets properties for a Tines connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.tines</code>.</div>
-    <div class="field-items">
-      <div class="param">email </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The email used to sign in to Tines. </div>
-<div class="param">token </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The Tines API token. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_torq"><code>secrets_properties_torq</code> - Connector secrets properties for a Torq connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.torq</code>.</div>
-    <div class="field-items">
-      <div class="param">token </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The secret of the webhook authentication header. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_webhook"><code>secrets_properties_webhook</code> - Connector secrets properties for a Webhook connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.webhook</code>.</div>
-    <div class="field-items">
-      <div class="param">crt (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> If <code>authType</code> is <code>webhook-authentication-ssl</code> and <code>certType</code> is <code>ssl-crt-key</code>, it is a base64 encoded version of the CRT or CERT file. </div>
-<div class="param">key (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> If <code>authType</code> is <code>webhook-authentication-ssl</code> and <code>certType</code> is <code>ssl-crt-key</code>, it is a base64 encoded version of the KEY file. </div>
-<div class="param">pfx (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> If <code>authType</code> is <code>webhook-authentication-ssl</code> and <code>certType</code> is <code>ssl-pfx</code>, it is a base64 encoded version of the PFX or P12 file. </div>
-<div class="param">password (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The password for HTTP basic authentication or the passphrase for the SSL certificate files. If <code>hasAuth</code> is set to <code>true</code> and <code>authType</code> is <code>webhook-authentication-basic</code>, this property is required. </div>
-<div class="param">user (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The username for HTTP basic authentication. If <code>hasAuth</code> is set to <code>true</code>  and <code>authType</code> is <code>webhook-authentication-basic</code>, this property is required. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="secrets_properties_xmatters"><code>secrets_properties_xmatters</code> - Connector secrets properties for an xMatters connector</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines secrets for connectors when type is <code>.xmatters</code>.</div>
-    <div class="field-items">
-      <div class="param">password (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A user name for HTTP basic authentication. It is applicable only when <code>usesBasic</code> is <code>true</code>. </div>
-<div class="param">secretsUrl (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when <code>usesBasic</code> is <code>false</code>. </div>
-<div class="param">user (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A password for HTTP basic authentication. It is applicable only when <code>usesBasic</code> is <code>true</code>. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="updateConnector_400_response"><code>updateConnector_400_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_cases_webhook"><code>update_connector_request_cases_webhook</code> - Update Webhook - Case Managment connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_cases_webhook">config_properties_cases_webhook</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_cases_webhook">secrets_properties_cases_webhook</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_d3security"><code>update_connector_request_d3security</code> - Update D3 Security connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_d3security">config_properties_d3security</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_d3security">secrets_properties_d3security</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_email"><code>update_connector_request_email</code> - Update email connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_email">config_properties_email</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets (optional)</div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_email">secrets_properties_email</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_index"><code>update_connector_request_index</code> - Update index connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_index">config_properties_index</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_jira"><code>update_connector_request_jira</code> - Update Jira connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_jira">config_properties_jira</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_jira">secrets_properties_jira</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_opsgenie"><code>update_connector_request_opsgenie</code> - Update Opsgenie connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_opsgenie">config_properties_opsgenie</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_opsgenie">secrets_properties_opsgenie</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_pagerduty"><code>update_connector_request_pagerduty</code> - Update PagerDuty connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_pagerduty">config_properties_pagerduty</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_pagerduty">secrets_properties_pagerduty</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_resilient"><code>update_connector_request_resilient</code> - Update IBM Resilient connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_resilient">config_properties_resilient</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_resilient">secrets_properties_resilient</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_serverlog"><code>update_connector_request_serverlog</code> - Update server log connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_servicenow"><code>update_connector_request_servicenow</code> - Update ServiceNow ITSM connector or ServiceNow SecOps request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_servicenow">config_properties_servicenow</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_servicenow">secrets_properties_servicenow</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_servicenow_itom"><code>update_connector_request_servicenow_itom</code> - Create ServiceNow ITOM connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_servicenow_itom">config_properties_servicenow_itom</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_servicenow">secrets_properties_servicenow</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_slack_api"><code>update_connector_request_slack_api</code> - Update Slack connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_slack_api">secrets_properties_slack_api</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_slack_webhook"><code>update_connector_request_slack_webhook</code> - Update Slack connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_slack_webhook">secrets_properties_slack_webhook</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_swimlane"><code>update_connector_request_swimlane</code> - Update Swimlane connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_swimlane">config_properties_swimlane</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_swimlane">secrets_properties_swimlane</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_teams"><code>update_connector_request_teams</code> - Update Microsoft Teams connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_teams">secrets_properties_teams</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_tines"><code>update_connector_request_tines</code> - Update Tines connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_tines">config_properties_tines</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_tines">secrets_properties_tines</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_torq"><code>update_connector_request_torq</code> - Update Torq connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_torq">config_properties_torq</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_torq">secrets_properties_torq</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_webhook"><code>update_connector_request_webhook</code> - Update Webhook connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_webhook">config_properties_webhook</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_webhook">secrets_properties_webhook</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_connector_request_xmatters"><code>update_connector_request_xmatters</code> - Update xMatters connector request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">config </div><div class="param-desc"><span class="param-type"><a href="#config_properties_xmatters">config_properties_xmatters</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The display name for the connector. </div>
-<div class="param">secrets </div><div class="param-desc"><span class="param-type"><a href="#secrets_properties_xmatters">secrets_properties_xmatters</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-</div>
-++++
diff --git a/docs/api-generated/connectors/connector-apis.asciidoc b/docs/api-generated/connectors/connector-apis.asciidoc
deleted file mode 100644
index d35bad3d3d633..0000000000000
--- a/docs/api-generated/connectors/connector-apis.asciidoc
+++ /dev/null
@@ -1,10 +0,0 @@
-[[connector-apis]]
-== Connector APIs
-
-preview::[]
-
-////
-This file includes content that has been generated from https://github.com/elastic/kibana/tree/main/x-pack/plugins/actions/docs/openapi. Any modifications required must be done in that open API specification.
-////
-
-include::connector-apis-passthru.asciidoc[]
\ No newline at end of file
diff --git a/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc b/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc
deleted file mode 100644
index 116ddbe0d7273..0000000000000
--- a/docs/api-generated/machine-learning/ml-apis-passthru.asciidoc
+++ /dev/null
@@ -1,205 +0,0 @@
-////
-This content is generated from the open API specification.
-Any modifications made to this file will be overwritten.
-////
-
-++++
-<div class="openapi">
-  <h2>Access</h2>
-    <ol>
-      <li>APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true</li>
-      <li>HTTP Basic Authentication</li>
-    </ol>
-
-  <h2><a name="__Methods">Methods</a></h2>
-  [ Jump to <a href="#__Models">Models</a> ]
-
-  <h3>Table of Contents </h3>
-  <div class="method-summary"></div>
-  <h4><a href="#Ml">Ml</a></h4>
-  <ul>
-  <li><a href="#mlSync"><code><span class="http-method">get</span> /s/{spaceId}/api/ml/saved_objects/sync</code></a></li>
-  </ul>
-
-  <h1><a name="Ml">Ml</a></h1>
-  <div class="method"><a name="mlSync"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/ml/saved_objects/sync</code></pre></div>
-    <div class="method-summary">Synchronizes Kibana saved objects for machine learning jobs and trained models. (<span class="nickname">mlSync</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the <strong>Machine Learning</strong> feature in the <strong>Analytics</strong> section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">simulate (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; When true, simulates the synchronization by returning only the list of actions that would be performed. default: null </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#mlSync200Response">mlSync200Response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "datafeedsAdded" : {
-    "key" : {
-      "success" : true
-    }
-  },
-  "savedObjectsCreated" : {
-    "anomaly-detector" : {
-      "key" : {
-        "success" : true
-      }
-    },
-    "data-frame-analytics" : {
-      "key" : {
-        "success" : true
-      }
-    },
-    "trained-model" : {
-      "key" : {
-        "success" : true
-      }
-    }
-  },
-  "savedObjectsDeleted" : {
-    "anomaly-detector" : {
-      "key" : {
-        "success" : true
-      }
-    },
-    "data-frame-analytics" : {
-      "key" : {
-        "success" : true
-      }
-    },
-    "trained-model" : {
-      "key" : {
-        "success" : true
-      }
-    }
-  },
-  "datafeedsRemoved" : {
-    "key" : {
-      "success" : true
-    }
-  }
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call
-        <a href="#mlSync200Response">mlSync200Response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#mlSync4xxResponse">mlSync4xxResponse</a>
-  </div> <!-- method -->
-  <hr/>
-
-  <h2><a name="__Models">Models</a></h2>
-  [ Jump to <a href="#__Methods">Methods</a> ]
-
-  <h3>Table of Contents</h3>
-  <ol>
-    <li><a href="#mlSync200Response"><code>mlSync200Response</code> - Successful sync API response</a></li>
-    <li><a href="#mlSync4xxResponse"><code>mlSync4xxResponse</code> - Unsuccessful sync API response</a></li>
-    <li><a href="#mlSyncResponseAnomalyDetectors"><code>mlSyncResponseAnomalyDetectors</code> - Sync API response for anomaly detection jobs</a></li>
-    <li><a href="#mlSyncResponseDataFrameAnalytics"><code>mlSyncResponseDataFrameAnalytics</code> - Sync API response for data frame analytics jobs</a></li>
-    <li><a href="#mlSyncResponseDatafeeds"><code>mlSyncResponseDatafeeds</code> - Sync API response for datafeeds</a></li>
-    <li><a href="#mlSyncResponseSavedObjectsCreated"><code>mlSyncResponseSavedObjectsCreated</code> - Sync API response for created saved objects</a></li>
-    <li><a href="#mlSyncResponseSavedObjectsDeleted"><code>mlSyncResponseSavedObjectsDeleted</code> - Sync API response for deleted saved objects</a></li>
-    <li><a href="#mlSyncResponseTrainedModels"><code>mlSyncResponseTrainedModels</code> - Sync API response for trained models</a></li>
-  </ol>
-
-  <div class="model">
-    <h3><a name="mlSync200Response"><code>mlSync200Response</code> - Successful sync API response</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">datafeedsAdded (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseDatafeeds">map[String, mlSyncResponseDatafeeds]</a></span> If a saved object for an anomaly detection job is missing a datafeed identifier, it is added when you run the sync machine learning saved objects API. </div>
-<div class="param">datafeedsRemoved (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseDatafeeds">map[String, mlSyncResponseDatafeeds]</a></span> If a saved object for an anomaly detection job references a datafeed that no longer exists, it is deleted when you run the sync machine learning saved objects API. </div>
-<div class="param">savedObjectsCreated (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseSavedObjectsCreated">mlSyncResponseSavedObjectsCreated</a></span>  </div>
-<div class="param">savedObjectsDeleted (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseSavedObjectsDeleted">mlSyncResponseSavedObjectsDeleted</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="mlSync4xxResponse"><code>mlSync4xxResponse</code> - Unsuccessful sync API response</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="mlSyncResponseAnomalyDetectors"><code>mlSyncResponseAnomalyDetectors</code> - Sync API response for anomaly detection jobs</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The sync machine learning saved objects API response contains this object when there are anomaly detection jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status.</div>
-    <div class="field-items">
-      <div class="param">success (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> The success or failure of the synchronization. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="mlSyncResponseDataFrameAnalytics"><code>mlSyncResponseDataFrameAnalytics</code> - Sync API response for data frame analytics jobs</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The sync machine learning saved objects API response contains this object when there are data frame analytics jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status.</div>
-    <div class="field-items">
-      <div class="param">success (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> The success or failure of the synchronization. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="mlSyncResponseDatafeeds"><code>mlSyncResponseDatafeeds</code> - Sync API response for datafeeds</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The sync machine learning saved objects API response contains this object when there are datafeeds affected by the synchronization. There is an object for each relevant datafeed, which contains the synchronization status.</div>
-    <div class="field-items">
-      <div class="param">success (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> The success or failure of the synchronization. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="mlSyncResponseSavedObjectsCreated"><code>mlSyncResponseSavedObjectsCreated</code> - Sync API response for created saved objects</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>If saved objects are missing for machine learning jobs or trained models, they are created when you run the sync machine learning saved objects API.</div>
-    <div class="field-items">
-      <div class="param">anomalyMinusdetector (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseAnomalyDetectors">map[String, mlSyncResponseAnomalyDetectors]</a></span> If saved objects are missing for anomaly detection jobs, they are created. </div>
-<div class="param">dataMinusframeMinusanalytics (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseDataFrameAnalytics">map[String, mlSyncResponseDataFrameAnalytics]</a></span> If saved objects are missing for data frame analytics jobs, they are created. </div>
-<div class="param">trainedMinusmodel (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseTrainedModels">map[String, mlSyncResponseTrainedModels]</a></span> If saved objects are missing for trained models, they are created. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="mlSyncResponseSavedObjectsDeleted"><code>mlSyncResponseSavedObjectsDeleted</code> - Sync API response for deleted saved objects</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>If saved objects exist for machine learning jobs or trained models that no longer exist, they are deleted when you run the sync machine learning saved objects API.</div>
-    <div class="field-items">
-      <div class="param">anomalyMinusdetector (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseAnomalyDetectors">map[String, mlSyncResponseAnomalyDetectors]</a></span> If there are saved objects exist for nonexistent anomaly detection jobs, they are deleted. </div>
-<div class="param">dataMinusframeMinusanalytics (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseDataFrameAnalytics">map[String, mlSyncResponseDataFrameAnalytics]</a></span> If there are saved objects exist for nonexistent data frame analytics jobs, they are deleted. </div>
-<div class="param">trainedMinusmodel (optional)</div><div class="param-desc"><span class="param-type"><a href="#mlSyncResponseTrainedModels">map[String, mlSyncResponseTrainedModels]</a></span> If there are saved objects exist for nonexistent trained models, they are deleted. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="mlSyncResponseTrainedModels"><code>mlSyncResponseTrainedModels</code> - Sync API response for trained models</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The sync machine learning saved objects API response contains this object when there are trained models affected by the synchronization. There is an object for each relevant trained model, which contains the synchronization status.</div>
-    <div class="field-items">
-      <div class="param">success (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> The success or failure of the synchronization. </div>
-    </div>  <!-- field-items -->
-  </div>
-</div>
-++++
diff --git a/docs/api-generated/machine-learning/ml-apis.asciidoc b/docs/api-generated/machine-learning/ml-apis.asciidoc
deleted file mode 100644
index 2d87d72616a75..0000000000000
--- a/docs/api-generated/machine-learning/ml-apis.asciidoc
+++ /dev/null
@@ -1,10 +0,0 @@
-[[machine-learning-apis]]
-== Machine learning APIs
-
-preview::[]
-
-////
-This file includes content that has been generated from https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/common/openapi. Any modifications required must be done in that open API specification.
-////
-
-include::ml-apis-passthru.asciidoc[]
\ No newline at end of file
diff --git a/docs/api-generated/rules/rule-apis-passthru.asciidoc b/docs/api-generated/rules/rule-apis-passthru.asciidoc
deleted file mode 100644
index 843f073f95e04..0000000000000
--- a/docs/api-generated/rules/rule-apis-passthru.asciidoc
+++ /dev/null
@@ -1,4905 +0,0 @@
-////
-This content is generated from the open API specification.
-Any modifications made to this file will be overwritten.
-////
-
-++++
-<div class="openapi">
-  <h2>Access</h2>
-    <ol>
-      <li>APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true</li>
-      <li>HTTP Basic Authentication</li>
-    </ol>
-
-  <h2><a name="__Methods">Methods</a></h2>
-  [ Jump to <a href="#__Models">Models</a> ]
-
-  <h3>Table of Contents </h3>
-  <div class="method-summary"></div>
-  <h4><a href="#Alerting">Alerting</a></h4>
-  <ul>
-  <li><a href="#createRule"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule</code></a></li>
-  <li><a href="#createRuleId"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></a></li>
-  <li><a href="#deleteRule"><code><span class="http-method">delete</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></a></li>
-  <li><a href="#disableRule"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_disable</code></a></li>
-  <li><a href="#enableRule"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_enable</code></a></li>
-  <li><a href="#findRules"><code><span class="http-method">get</span> /s/{spaceId}/api/alerting/rules/_find</code></a></li>
-  <li><a href="#getAlertingHealth"><code><span class="http-method">get</span> /s/{spaceId}/api/alerting/_health</code></a></li>
-  <li><a href="#getRule"><code><span class="http-method">get</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></a></li>
-  <li><a href="#getRuleTypes"><code><span class="http-method">get</span> /s/{spaceId}/api/alerting/rule_types</code></a></li>
-  <li><a href="#legacyCreateAlert"><code><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}</code></a></li>
-  <li><a href="#legacyDisableAlert"><code><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/_disable</code></a></li>
-  <li><a href="#legacyEnableAlert"><code><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/_enable</code></a></li>
-  <li><a href="#legacyFindAlerts"><code><span class="http-method">get</span> /s/{spaceId}/api/alerts/alerts/_find</code></a></li>
-  <li><a href="#legacyGetAlert"><code><span class="http-method">get</span> /s/{spaceId}/api/alerts/alert/{alertId}</code></a></li>
-  <li><a href="#legacyGetAlertTypes"><code><span class="http-method">get</span> /s/{spaceId}/api/alerts/alerts/list_alert_types</code></a></li>
-  <li><a href="#legacyGetAlertingHealth"><code><span class="http-method">get</span> /s/{spaceId}/api/alerts/alerts/_health</code></a></li>
-  <li><a href="#legacyMuteAlertInstance"><code><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute</code></a></li>
-  <li><a href="#legacyMuteAllAlertInstances"><code><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/_mute_all</code></a></li>
-  <li><a href="#legacyUnmuteAlertInstance"><code><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute</code></a></li>
-  <li><a href="#legacyUnmuteAllAlertInstances"><code><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/_unmute_all</code></a></li>
-  <li><a href="#legacyUpdateAlert"><code><span class="http-method">put</span> /s/{spaceId}/api/alerts/alert/{alertId}</code></a></li>
-  <li><a href="#legaryDeleteAlert"><code><span class="http-method">delete</span> /s/{spaceId}/api/alerts/alert/{alertId}</code></a></li>
-  <li><a href="#muteAlert"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_mute</code></a></li>
-  <li><a href="#muteAllAlerts"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_mute_all</code></a></li>
-  <li><a href="#unmuteAlert"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_unmute</code></a></li>
-  <li><a href="#unmuteAllAlerts"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_unmute_all</code></a></li>
-  <li><a href="#updateRule"><code><span class="http-method">put</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></a></li>
-  <li><a href="#updateRuleAPIKey"><code><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_update_api_key</code></a></li>
-  </ul>
-
-  <h1><a name="Alerting">Alerting</a></h1>
-  <div class="method"><a name="createRule"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule</code></pre></div>
-    <div class="method-summary">Creates a rule with a randomly generated rule identifier. (<span class="nickname">createRule</span>)</div>
-    <div class="method-notes">To create a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're creating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">create_rule_request <a href="#create_rule_request">create_rule_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#rule_response_properties">rule_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "throttle" : "10m",
-  "created_at" : "2022-12-05T23:36:58.284Z",
-  "api_key_created_by_user" : false,
-  "enabled" : true,
-  "running" : true,
-  "notify_when" : "notify_when",
-  "next_run" : "2022-12-06T00:14:43.818Z",
-  "updated_at" : "2022-12-05T23:36:58.284Z",
-  "execution_status" : {
-    "last_execution_date" : "2022-12-06T00:13:43.89Z",
-    "last_duration" : 55,
-    "status" : "ok"
-  },
-  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "consumer" : "alerts",
-  "last_run" : {
-    "alerts_count" : {
-      "ignored" : 6,
-      "new" : 1,
-      "recovered" : 5,
-      "active" : 0
-    },
-    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-    "outcome_order" : 5,
-    "warning" : "warning",
-    "outcome" : "succeeded"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "created_by" : "elastic",
-  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-  "rule_type_id" : "monitoring_alert_cluster_health",
-  "revision" : 2,
-  "tags" : [ "tags", "tags" ],
-  "api_key_owner" : "elastic",
-  "schedule" : {
-    "interval" : "1m"
-  },
-  "name" : "cluster_health_rule",
-  "updated_by" : "elastic",
-  "mute_all" : false,
-  "actions" : [ {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  }, {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  } ]
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#rule_response_properties">rule_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#404_response">404_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="createRuleId"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></pre></div>
-    <div class="method-summary">Creates a rule with a specific rule identifier. (<span class="nickname">createRuleId</span>)</div>
-    <div class="method-notes">To create a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're creating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An UUID v1 or v4 identifier for the rule. If you omit this parameter, an identifier is randomly generated. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">create_rule_request <a href="#create_rule_request">create_rule_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#rule_response_properties">rule_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "throttle" : "10m",
-  "created_at" : "2022-12-05T23:36:58.284Z",
-  "api_key_created_by_user" : false,
-  "enabled" : true,
-  "running" : true,
-  "notify_when" : "notify_when",
-  "next_run" : "2022-12-06T00:14:43.818Z",
-  "updated_at" : "2022-12-05T23:36:58.284Z",
-  "execution_status" : {
-    "last_execution_date" : "2022-12-06T00:13:43.89Z",
-    "last_duration" : 55,
-    "status" : "ok"
-  },
-  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "consumer" : "alerts",
-  "last_run" : {
-    "alerts_count" : {
-      "ignored" : 6,
-      "new" : 1,
-      "recovered" : 5,
-      "active" : 0
-    },
-    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-    "outcome_order" : 5,
-    "warning" : "warning",
-    "outcome" : "succeeded"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "created_by" : "elastic",
-  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-  "rule_type_id" : "monitoring_alert_cluster_health",
-  "revision" : 2,
-  "tags" : [ "tags", "tags" ],
-  "api_key_owner" : "elastic",
-  "schedule" : {
-    "interval" : "1m"
-  },
-  "name" : "cluster_health_rule",
-  "updated_by" : "elastic",
-  "mute_all" : false,
-  "actions" : [ {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  }, {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  } ]
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#rule_response_properties">rule_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#404_response">404_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="deleteRule"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></pre></div>
-    <div class="method-summary">Deletes a rule. (<span class="nickname">deleteRule</span>)</div>
-    <div class="method-notes">To delete a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're deleting. For example, the <strong>Management</strong> &gt; <strong>Stack Rules</strong> feature, <strong>Analytics</strong> &gt; <strong>Discover</strong> or <strong>Machine Learning</strong> features, <strong>Observability</strong>, or <strong>Security</strong> features. WARNING: After you delete a rule, you cannot recover it. If the API key that is used by the rule was created automatically, it is deleted.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#404_response">404_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="disableRule"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_disable</code></pre></div>
-    <div class="method-summary">Disables a rule. (<span class="nickname">disableRule</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong>, and <strong>Security</strong> features.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#404_response">404_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="enableRule"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_enable</code></pre></div>
-    <div class="method-summary">Enables a rule. (<span class="nickname">enableRule</span>)</div>
-    <div class="method-notes">To enable a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong>, and <strong>Security</strong> features. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="findRules"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/alerting/rules/_find</code></pre></div>
-    <div class="method-summary">Retrieves information about rules. (<span class="nickname">findRules</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rules you're seeking. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. To find rules associated with the <strong>Stack Monitoring</strong> feature, use the <code>monitoring_user</code> built-in role.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">default_search_operator (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The default operator to use for the simple_query_string. default: OR </div><div class="param">fields (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The fields to return in the <code>attributes</code> key of the response. default: null </div><div class="param">filter (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A KQL string that you filter with an attribute from your saved object. It should look like <code>savedObjectType.attributes.title: &quot;myTitle&quot;</code>. However, if you used a direct attribute of a saved object, such as <code>updatedAt</code>, you must define your filter, for example, <code>savedObjectType.updatedAt &gt; 2018-12-22</code>. default: null </div><div class="param">has_reference (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the rules that have a relation with the reference objects with a specific type and identifier. default: null </div><div class="param">page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">per_page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of rules to return per page. default: 20 </div><div class="param">search (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; An Elasticsearch simple_query_string query that filters the objects in the response. default: null </div><div class="param">search_fields (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The fields to perform the simple_query_string parsed query against. default: null </div><div class="param">sort_field (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines which field is used to sort the results. The field must exist in the <code>attributes</code> key of the response. default: null </div><div class="param">sort_order (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#findRules_200_response">findRules_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "per_page" : 6,
-  "total" : 1,
-  "data" : [ {
-    "throttle" : "10m",
-    "created_at" : "2022-12-05T23:36:58.284Z",
-    "api_key_created_by_user" : false,
-    "enabled" : true,
-    "running" : true,
-    "notify_when" : "notify_when",
-    "next_run" : "2022-12-06T00:14:43.818Z",
-    "updated_at" : "2022-12-05T23:36:58.284Z",
-    "execution_status" : {
-      "last_execution_date" : "2022-12-06T00:13:43.89Z",
-      "last_duration" : 55,
-      "status" : "ok"
-    },
-    "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "consumer" : "alerts",
-    "last_run" : {
-      "alerts_count" : {
-        "ignored" : 6,
-        "new" : 1,
-        "recovered" : 5,
-        "active" : 0
-      },
-      "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-      "outcome_order" : 5,
-      "warning" : "warning",
-      "outcome" : "succeeded"
-    },
-    "params" : {
-      "key" : ""
-    },
-    "created_by" : "elastic",
-    "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-    "rule_type_id" : "monitoring_alert_cluster_health",
-    "revision" : 2,
-    "tags" : [ "tags", "tags" ],
-    "api_key_owner" : "elastic",
-    "schedule" : {
-      "interval" : "1m"
-    },
-    "name" : "cluster_health_rule",
-    "updated_by" : "elastic",
-    "mute_all" : false,
-    "actions" : [ {
-      "alerts_filter" : {
-        "timeframe" : {
-          "hours" : {
-            "start" : "08:00",
-            "end" : "17:00"
-          },
-          "timezone" : "Europe/Madrid",
-          "days" : [ 1, 2, 3, 4, 5 ]
-        },
-        "query" : {
-          "kql" : "kql",
-          "filters" : [ {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          }, {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          } ]
-        }
-      },
-      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-      "params" : {
-        "key" : ""
-      },
-      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-      "connector_type_id" : ".server-log",
-      "frequency" : {
-        "summary" : true,
-        "throttle" : "10m",
-        "notify_when" : "onActiveAlert"
-      },
-      "group" : "default"
-    }, {
-      "alerts_filter" : {
-        "timeframe" : {
-          "hours" : {
-            "start" : "08:00",
-            "end" : "17:00"
-          },
-          "timezone" : "Europe/Madrid",
-          "days" : [ 1, 2, 3, 4, 5 ]
-        },
-        "query" : {
-          "kql" : "kql",
-          "filters" : [ {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          }, {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          } ]
-        }
-      },
-      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-      "params" : {
-        "key" : ""
-      },
-      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-      "connector_type_id" : ".server-log",
-      "frequency" : {
-        "summary" : true,
-        "throttle" : "10m",
-        "notify_when" : "onActiveAlert"
-      },
-      "group" : "default"
-    } ]
-  }, {
-    "throttle" : "10m",
-    "created_at" : "2022-12-05T23:36:58.284Z",
-    "api_key_created_by_user" : false,
-    "enabled" : true,
-    "running" : true,
-    "notify_when" : "notify_when",
-    "next_run" : "2022-12-06T00:14:43.818Z",
-    "updated_at" : "2022-12-05T23:36:58.284Z",
-    "execution_status" : {
-      "last_execution_date" : "2022-12-06T00:13:43.89Z",
-      "last_duration" : 55,
-      "status" : "ok"
-    },
-    "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "consumer" : "alerts",
-    "last_run" : {
-      "alerts_count" : {
-        "ignored" : 6,
-        "new" : 1,
-        "recovered" : 5,
-        "active" : 0
-      },
-      "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-      "outcome_order" : 5,
-      "warning" : "warning",
-      "outcome" : "succeeded"
-    },
-    "params" : {
-      "key" : ""
-    },
-    "created_by" : "elastic",
-    "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-    "rule_type_id" : "monitoring_alert_cluster_health",
-    "revision" : 2,
-    "tags" : [ "tags", "tags" ],
-    "api_key_owner" : "elastic",
-    "schedule" : {
-      "interval" : "1m"
-    },
-    "name" : "cluster_health_rule",
-    "updated_by" : "elastic",
-    "mute_all" : false,
-    "actions" : [ {
-      "alerts_filter" : {
-        "timeframe" : {
-          "hours" : {
-            "start" : "08:00",
-            "end" : "17:00"
-          },
-          "timezone" : "Europe/Madrid",
-          "days" : [ 1, 2, 3, 4, 5 ]
-        },
-        "query" : {
-          "kql" : "kql",
-          "filters" : [ {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          }, {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          } ]
-        }
-      },
-      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-      "params" : {
-        "key" : ""
-      },
-      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-      "connector_type_id" : ".server-log",
-      "frequency" : {
-        "summary" : true,
-        "throttle" : "10m",
-        "notify_when" : "onActiveAlert"
-      },
-      "group" : "default"
-    }, {
-      "alerts_filter" : {
-        "timeframe" : {
-          "hours" : {
-            "start" : "08:00",
-            "end" : "17:00"
-          },
-          "timezone" : "Europe/Madrid",
-          "days" : [ 1, 2, 3, 4, 5 ]
-        },
-        "query" : {
-          "kql" : "kql",
-          "filters" : [ {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          }, {
-            "$state" : "{}",
-            "meta" : {
-              "field" : "field",
-              "controlledBy" : "controlledBy",
-              "negate" : true,
-              "alias" : "alias",
-              "index" : "index",
-              "disabled" : true,
-              "params" : "{}",
-              "type" : "type",
-              "value" : "value",
-              "isMultiIndex" : true,
-              "key" : "key",
-              "group" : "group"
-            },
-            "query" : "{}"
-          } ]
-        }
-      },
-      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-      "params" : {
-        "key" : ""
-      },
-      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-      "connector_type_id" : ".server-log",
-      "frequency" : {
-        "summary" : true,
-        "throttle" : "10m",
-        "notify_when" : "onActiveAlert"
-      },
-      "group" : "default"
-    } ]
-  } ],
-  "page" : 0
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#findRules_200_response">findRules_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getAlertingHealth"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/alerting/_health</code></pre></div>
-    <div class="method-summary">Retrieves the health status of the alerting framework. (<span class="nickname">getAlertingHealth</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Management &gt; Stack Rules</strong> feature or for at least one of the <strong>Analytics &gt; Discover</strong>, <strong>Analytics &gt; Machine Learning</strong>, <strong>Observability</strong>, or <strong>Security</strong> features.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#getAlertingHealth_200_response">getAlertingHealth_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "alerting_framework_health" : {
-    "execution_health" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    },
-    "read_health" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    },
-    "decryption_health" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    }
-  },
-  "has_permanent_encryption_key" : true,
-  "is_sufficiently_secure" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#getAlertingHealth_200_response">getAlertingHealth_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getRule"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></pre></div>
-    <div class="method-summary">Retrieves a rule by its identifier. (<span class="nickname">getRule</span>)</div>
-    <div class="method-notes">You must have <code>read</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rules you're seeking. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. To get rules associated with the <strong>Stack Monitoring</strong> feature, use the <code>monitoring_user</code> built-in role.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#rule_response_properties">rule_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "throttle" : "10m",
-  "created_at" : "2022-12-05T23:36:58.284Z",
-  "api_key_created_by_user" : false,
-  "enabled" : true,
-  "running" : true,
-  "notify_when" : "notify_when",
-  "next_run" : "2022-12-06T00:14:43.818Z",
-  "updated_at" : "2022-12-05T23:36:58.284Z",
-  "execution_status" : {
-    "last_execution_date" : "2022-12-06T00:13:43.89Z",
-    "last_duration" : 55,
-    "status" : "ok"
-  },
-  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "consumer" : "alerts",
-  "last_run" : {
-    "alerts_count" : {
-      "ignored" : 6,
-      "new" : 1,
-      "recovered" : 5,
-      "active" : 0
-    },
-    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-    "outcome_order" : 5,
-    "warning" : "warning",
-    "outcome" : "succeeded"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "created_by" : "elastic",
-  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-  "rule_type_id" : "monitoring_alert_cluster_health",
-  "revision" : 2,
-  "tags" : [ "tags", "tags" ],
-  "api_key_owner" : "elastic",
-  "schedule" : {
-    "interval" : "1m"
-  },
-  "name" : "cluster_health_rule",
-  "updated_by" : "elastic",
-  "mute_all" : false,
-  "actions" : [ {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  }, {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  } ]
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#rule_response_properties">rule_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#404_response">404_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="getRuleTypes"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/alerting/rule_types</code></pre></div>
-    <div class="method-summary">Retrieves a list of rule types. (<span class="nickname">getRuleTypes</span>)</div>
-    <div class="method-notes">If you have <code>read</code> privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, and <strong>Security</strong> features. To get rule types associated with the <strong>Stack Monitoring</strong> feature, use the <code>monitoring_user</code> built-in role.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#getRuleTypes_200_response_inner">getRuleTypes_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "recovery_action_group" : {
-    "name" : "name",
-    "id" : "id"
-  },
-  "does_set_recovery_context" : true,
-  "is_exportable" : true,
-  "authorized_consumers" : {
-    "alerts" : {
-      "all" : true,
-      "read" : true
-    },
-    "discover" : {
-      "all" : true,
-      "read" : true
-    },
-    "stackAlerts" : {
-      "all" : true,
-      "read" : true
-    },
-    "infrastructure" : {
-      "all" : true,
-      "read" : true
-    },
-    "siem" : {
-      "all" : true,
-      "read" : true
-    },
-    "monitoring" : {
-      "all" : true,
-      "read" : true
-    },
-    "logs" : {
-      "all" : true,
-      "read" : true
-    },
-    "apm" : {
-      "all" : true,
-      "read" : true
-    },
-    "ml" : {
-      "all" : true,
-      "read" : true
-    },
-    "uptime" : {
-      "all" : true,
-      "read" : true
-    }
-  },
-  "action_groups" : [ {
-    "name" : "name",
-    "id" : "id"
-  }, {
-    "name" : "name",
-    "id" : "id"
-  } ],
-  "minimum_license_required" : "basic",
-  "action_variables" : {
-    "context" : [ {
-      "name" : "name",
-      "description" : "description",
-      "useWithTripleBracesInTemplates" : true
-    }, {
-      "name" : "name",
-      "description" : "description",
-      "useWithTripleBracesInTemplates" : true
-    } ],
-    "state" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ],
-    "params" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ]
-  },
-  "rule_task_timeout" : "5m",
-  "name" : "name",
-  "enabled_in_license" : true,
-  "producer" : "stackAlerts",
-  "id" : "id",
-  "default_action_group_id" : "default_action_group_id"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyCreateAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}</code></pre></div>
-    <div class="method-summary">Create an alert. (<span class="nickname">legacyCreateAlert</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the create rule API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An UUID v1 or v4 identifier for the alert. If this parameter is omitted, the identifier is randomly generated. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Legacy_create_alert_request_properties <a href="#Legacy_create_alert_request_properties">Legacy_create_alert_request_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#alert_response_properties">alert_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "alertTypeId" : ".index-threshold",
-  "throttle" : "throttle",
-  "updatedBy" : "elastic",
-  "executionStatus" : {
-    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-    "status" : "ok"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "enabled" : true,
-  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-  "tags" : [ "tags", "tags" ],
-  "createdAt" : "2022-12-05T23:36:58.284Z",
-  "schedule" : {
-    "interval" : "interval"
-  },
-  "notifyWhen" : "onActionGroupChange",
-  "createdBy" : "elastic",
-  "muteAll" : false,
-  "name" : "my alert",
-  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "actions" : [ "{}", "{}" ],
-  "apiKeyOwner" : "elastic",
-  "updatedAt" : "2022-12-05T23:36:58.284Z"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#alert_response_properties">alert_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyDisableAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/_disable</code></pre></div>
-    <div class="method-summary">Disables an alert. (<span class="nickname">legacyDisableAlert</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the disable rule API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the alert. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyEnableAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/_enable</code></pre></div>
-    <div class="method-summary">Enables an alert. (<span class="nickname">legacyEnableAlert</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the enable rule API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the alert. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyFindAlerts"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/alerts/alerts/_find</code></pre></div>
-    <div class="method-summary">Retrieves a paginated set of alerts. (<span class="nickname">legacyFindAlerts</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the find rules API instead. NOTE: Alert <code>params</code> are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      <div class="param">default_search_operator (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The default operator to use for the <code>simple_query_string</code>. default: OR </div><div class="param">fields (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The fields to return in the <code>attributes</code> key of the response. default: null </div><div class="param">filter (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; A KQL string that you filter with an attribute from your saved object. It should look like <code>savedObjectType.attributes.title: &quot;myTitle&quot;</code>. However, if you used a direct attribute of a saved object, such as <code>updatedAt</code>, you must define your filter, for example, <code>savedObjectType.updatedAt &gt; 2018-12-22</code>. default: null </div><div class="param">has_reference (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the rules that have a relation with the reference objects with a specific type and identifier. default: null </div><div class="param">page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">per_page (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of alerts to return per page. default: 20 </div><div class="param">search (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; An Elasticsearch <code>simple_query_string</code> query that filters the alerts in the response. default: null </div><div class="param">search_fields (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The fields to perform the <code>simple_query_string</code> parsed query against. default: null </div><div class="param">sort_field (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines which field is used to sort the results. The field must exist in the <code>attributes</code> key of the response. default: null </div><div class="param">sort_order (optional)</div>
-
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div>
-    </div>  <!-- field-items -->
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#legacyFindAlerts_200_response">legacyFindAlerts_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "total" : 1,
-  "perPage" : 6,
-  "data" : [ {
-    "alertTypeId" : ".index-threshold",
-    "throttle" : "throttle",
-    "updatedBy" : "elastic",
-    "executionStatus" : {
-      "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-      "status" : "ok"
-    },
-    "params" : {
-      "key" : ""
-    },
-    "enabled" : true,
-    "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-    "tags" : [ "tags", "tags" ],
-    "createdAt" : "2022-12-05T23:36:58.284Z",
-    "schedule" : {
-      "interval" : "interval"
-    },
-    "notifyWhen" : "onActionGroupChange",
-    "createdBy" : "elastic",
-    "muteAll" : false,
-    "name" : "my alert",
-    "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "actions" : [ "{}", "{}" ],
-    "apiKeyOwner" : "elastic",
-    "updatedAt" : "2022-12-05T23:36:58.284Z"
-  }, {
-    "alertTypeId" : ".index-threshold",
-    "throttle" : "throttle",
-    "updatedBy" : "elastic",
-    "executionStatus" : {
-      "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-      "status" : "ok"
-    },
-    "params" : {
-      "key" : ""
-    },
-    "enabled" : true,
-    "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-    "tags" : [ "tags", "tags" ],
-    "createdAt" : "2022-12-05T23:36:58.284Z",
-    "schedule" : {
-      "interval" : "interval"
-    },
-    "notifyWhen" : "onActionGroupChange",
-    "createdBy" : "elastic",
-    "muteAll" : false,
-    "name" : "my alert",
-    "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-    "actions" : [ "{}", "{}" ],
-    "apiKeyOwner" : "elastic",
-    "updatedAt" : "2022-12-05T23:36:58.284Z"
-  } ],
-  "page" : 0
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#legacyFindAlerts_200_response">legacyFindAlerts_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyGetAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/alerts/alert/{alertId}</code></pre></div>
-    <div class="method-summary">Retrieves an alert by its identifier. (<span class="nickname">legacyGetAlert</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the get rule API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the alert. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#alert_response_properties">alert_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "alertTypeId" : ".index-threshold",
-  "throttle" : "throttle",
-  "updatedBy" : "elastic",
-  "executionStatus" : {
-    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-    "status" : "ok"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "enabled" : true,
-  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-  "tags" : [ "tags", "tags" ],
-  "createdAt" : "2022-12-05T23:36:58.284Z",
-  "schedule" : {
-    "interval" : "interval"
-  },
-  "notifyWhen" : "onActionGroupChange",
-  "createdBy" : "elastic",
-  "muteAll" : false,
-  "name" : "my alert",
-  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "actions" : [ "{}", "{}" ],
-  "apiKeyOwner" : "elastic",
-  "updatedAt" : "2022-12-05T23:36:58.284Z"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#alert_response_properties">alert_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyGetAlertTypes"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/alerts/alerts/list_alert_types</code></pre></div>
-    <div class="method-summary">Retrieves a list of alert types. (<span class="nickname">legacyGetAlertTypes</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the get rule types API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      array[<a href="#legacyGetAlertTypes_200_response_inner">legacyGetAlertTypes_200_response_inner</a>]
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "defaultActionGroupId" : "defaultActionGroupId",
-  "isExportable" : true,
-  "actionVariables" : {
-    "context" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ],
-    "state" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ],
-    "params" : [ {
-      "name" : "name",
-      "description" : "description"
-    }, {
-      "name" : "name",
-      "description" : "description"
-    } ]
-  },
-  "actionGroups" : [ {
-    "name" : "name",
-    "id" : "id"
-  }, {
-    "name" : "name",
-    "id" : "id"
-  } ],
-  "name" : "name",
-  "producer" : "producer",
-  "authorizedConsumers" : "{}",
-  "recoveryActionGroup" : {
-    "name" : "name",
-    "id" : "id"
-  },
-  "enabledInLicense" : true,
-  "id" : "id",
-  "minimumLicenseRequired" : "minimumLicenseRequired"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyGetAlertingHealth"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/alerts/alerts/_health</code></pre></div>
-    <div class="method-summary">Retrieves the health status of the alerting framework. (<span class="nickname">legacyGetAlertingHealth</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the get alerting framework health API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#legacyGetAlertingHealth_200_response">legacyGetAlertingHealth_200_response</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "hasPermanentEncryptionKey" : true,
-  "alertingFrameworkHealth" : {
-    "executionHealth" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    },
-    "decryptionHealth" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    },
-    "readHealth" : {
-      "status" : "ok",
-      "timestamp" : "2023-01-13T01:28:00.28Z"
-    }
-  },
-  "isSufficientlySecure" : true
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#legacyGetAlertingHealth_200_response">legacyGetAlertingHealth_200_response</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyMuteAlertInstance"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute</code></pre></div>
-    <div class="method-summary">Mutes an alert instance. (<span class="nickname">legacyMuteAlertInstance</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the mute alert API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the alert. default: null </div><div class="param">alertInstanceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the alert instance. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyMuteAllAlertInstances"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/_mute_all</code></pre></div>
-    <div class="method-summary">Mutes all alert instances. (<span class="nickname">legacyMuteAllAlertInstances</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the mute all alerts API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the alert. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyUnmuteAlertInstance"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute</code></pre></div>
-    <div class="method-summary">Unmutes an alert instance. (<span class="nickname">legacyUnmuteAlertInstance</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the unmute alert API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the alert. default: null </div><div class="param">alertInstanceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the alert instance. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyUnmuteAllAlertInstances"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerts/alert/{alertId}/_unmute_all</code></pre></div>
-    <div class="method-summary">Unmutes all alert instances. (<span class="nickname">legacyUnmuteAllAlertInstances</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the unmute all alerts API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the alert. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legacyUpdateAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="put"><code class="huge"><span class="http-method">put</span> /s/{spaceId}/api/alerts/alert/{alertId}</code></pre></div>
-    <div class="method-summary">Updates the attributes for an alert. (<span class="nickname">legacyUpdateAlert</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the update rule API instead.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the alert. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">Legacy_update_alert_request_properties <a href="#Legacy_update_alert_request_properties">Legacy_update_alert_request_properties</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#alert_response_properties">alert_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "alertTypeId" : ".index-threshold",
-  "throttle" : "throttle",
-  "updatedBy" : "elastic",
-  "executionStatus" : {
-    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
-    "status" : "ok"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "enabled" : true,
-  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
-  "tags" : [ "tags", "tags" ],
-  "createdAt" : "2022-12-05T23:36:58.284Z",
-  "schedule" : {
-    "interval" : "interval"
-  },
-  "notifyWhen" : "onActionGroupChange",
-  "createdBy" : "elastic",
-  "muteAll" : false,
-  "name" : "my alert",
-  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "actions" : [ "{}", "{}" ],
-  "apiKeyOwner" : "elastic",
-  "updatedAt" : "2022-12-05T23:36:58.284Z"
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#alert_response_properties">alert_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="legaryDeleteAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="delete"><code class="huge"><span class="http-method">delete</span> /s/{spaceId}/api/alerts/alert/{alertId}</code></pre></div>
-    <div class="method-summary">Permanently removes an alert. (<span class="nickname">legaryDeleteAlert</span>)</div>
-    <div class="method-notes">Deprecated in 7.13.0. Use the delete rule API instead. WARNING: After you delete an alert, you cannot recover it.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div><div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the alert. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="muteAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_mute</code></pre></div>
-    <div class="method-summary">Mutes an alert. (<span class="nickname">muteAlert</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong>, and <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the alert. The identifier is generated by the rule and might be any arbitrary string. default: null </div><div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="muteAllAlerts"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_mute_all</code></pre></div>
-    <div class="method-summary">Mutes all alerts. (<span class="nickname">muteAllAlerts</span>)</div>
-    <div class="method-notes">This API snoozes the notifications for the rule indefinitely. The rule checks continue to occur but alerts will not trigger any actions. You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong>, and <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="unmuteAlert"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_unmute</code></pre></div>
-    <div class="method-summary">Unmutes an alert. (<span class="nickname">unmuteAlert</span>)</div>
-    <div class="method-notes">You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong>, and <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">alertId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the alert. The identifier is generated by the rule and might be any arbitrary string. default: null </div><div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="unmuteAllAlerts"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_unmute_all</code></pre></div>
-    <div class="method-summary">Unmutes all alerts. (<span class="nickname">unmuteAllAlerts</span>)</div>
-    <div class="method-notes">If the rule has its notifications snoozed indefinitely, this API cancels the snooze. You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong>, and <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">204</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateRule"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="put"><code class="huge"><span class="http-method">put</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></pre></div>
-    <div class="method-summary">Updates the attributes for a rule. (<span class="nickname">updateRule</span>)</div>
-    <div class="method-notes">To update a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're updating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs. NOTE: If the API key has different privileges than the key that created or most recently updated the rule, the rule behavior might change. Though some properties are optional, when you update the rule the existing property values are overwritten with default values. Therefore, it is recommended to explicitly set all property values.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      <div class="param">update_rule_request <a href="#update_rule_request">update_rule_request</a> (required)</div>
-
-      <div class="param-desc"><span class="param-type">Body Parameter</span> &mdash;  </div>
-
-    </div>  <!-- field-items -->
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      <a href="#rule_response_properties">rule_response_properties</a>
-      
-    </div>
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: application/json</div>
-    <pre class="example"><code>{
-  "throttle" : "10m",
-  "created_at" : "2022-12-05T23:36:58.284Z",
-  "api_key_created_by_user" : false,
-  "enabled" : true,
-  "running" : true,
-  "notify_when" : "notify_when",
-  "next_run" : "2022-12-06T00:14:43.818Z",
-  "updated_at" : "2022-12-05T23:36:58.284Z",
-  "execution_status" : {
-    "last_execution_date" : "2022-12-06T00:13:43.89Z",
-    "last_duration" : 55,
-    "status" : "ok"
-  },
-  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
-  "consumer" : "alerts",
-  "last_run" : {
-    "alerts_count" : {
-      "ignored" : 6,
-      "new" : 1,
-      "recovered" : 5,
-      "active" : 0
-    },
-    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
-    "outcome_order" : 5,
-    "warning" : "warning",
-    "outcome" : "succeeded"
-  },
-  "params" : {
-    "key" : ""
-  },
-  "created_by" : "elastic",
-  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
-  "rule_type_id" : "monitoring_alert_cluster_health",
-  "revision" : 2,
-  "tags" : [ "tags", "tags" ],
-  "api_key_owner" : "elastic",
-  "schedule" : {
-    "interval" : "1m"
-  },
-  "name" : "cluster_health_rule",
-  "updated_by" : "elastic",
-  "mute_all" : false,
-  "actions" : [ {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  }, {
-    "alerts_filter" : {
-      "timeframe" : {
-        "hours" : {
-          "start" : "08:00",
-          "end" : "17:00"
-        },
-        "timezone" : "Europe/Madrid",
-        "days" : [ 1, 2, 3, 4, 5 ]
-      },
-      "query" : {
-        "kql" : "kql",
-        "filters" : [ {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        }, {
-          "$state" : "{}",
-          "meta" : {
-            "field" : "field",
-            "controlledBy" : "controlledBy",
-            "negate" : true,
-            "alias" : "alias",
-            "index" : "index",
-            "disabled" : true,
-            "params" : "{}",
-            "type" : "type",
-            "value" : "value",
-            "isMultiIndex" : true,
-            "key" : "key",
-            "group" : "group"
-          },
-          "query" : "{}"
-        } ]
-      }
-    },
-    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
-    "params" : {
-      "key" : ""
-    },
-    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
-    "connector_type_id" : ".server-log",
-    "frequency" : {
-      "summary" : true,
-      "throttle" : "10m",
-      "notify_when" : "onActiveAlert"
-    },
-    "group" : "default"
-  } ]
-}</code></pre>
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#rule_response_properties">rule_response_properties</a>
-    <h4 class="field-label">401</h4>
-    Authorization information is missing or invalid.
-        <a href="#401_response">401_response</a>
-    <h4 class="field-label">404</h4>
-    Object is not found.
-        <a href="#404_response">404_response</a>
-  </div> <!-- method -->
-  <hr/>
-  <div class="method"><a name="updateRuleAPIKey"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_update_api_key</code></pre></div>
-    <div class="method-summary">Updates the API key for a rule. (<span class="nickname">updateRuleAPIKey</span>)</div>
-    <div class="method-notes">The new API key has the credentials of the user that submits the request.</div>
-
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      <div class="param">ruleId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the rule. default: null </div><div class="param">spaceId (required)</div>
-
-      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
-    </div>  <!-- field-items -->
-
-
-
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      <div class="param">kbn-xsrf (required)</div>
-
-      <div class="param-desc"><span class="param-type">Header Parameter</span> &mdash; Cross-site request forgery protection default: null </div>
-
-    </div>  <!-- field-items -->
-
-
-
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-      <li><code>application/json</code></li>
-    </ul>
-
-    <h3 class="field-label">Responses</h3>
-    <h4 class="field-label">200</h4>
-    Indicates a successful call.
-        <a href="#"></a>
-    <h4 class="field-label">400</h4>
-    Bad request
-        <a href="#400_response">400_response</a>
-  </div> <!-- method -->
-  <hr/>
-
-  <h2><a name="__Models">Models</a></h2>
-  [ Jump to <a href="#__Methods">Methods</a> ]
-
-  <h3>Table of Contents</h3>
-  <ol>
-    <li><a href="#400_response"><code>400_response</code> - Bad request</a></li>
-    <li><a href="#401_response"><code>401_response</code> - Unsuccessful rule API response</a></li>
-    <li><a href="#404_response"><code>404_response</code> - </a></li>
-    <li><a href="#Count"><code>Count</code> - Count</a></li>
-    <li><a href="#Count_count"><code>Count_count</code> - </a></li>
-    <li><a href="#Count_criteria"><code>Count_criteria</code> - </a></li>
-    <li><a href="#Count_logView"><code>Count_logView</code> - </a></li>
-    <li><a href="#Legacy_create_alert_request_properties"><code>Legacy_create_alert_request_properties</code> - Legacy create alert request properties</a></li>
-    <li><a href="#Legacy_create_alert_request_properties_schedule"><code>Legacy_create_alert_request_properties_schedule</code> - </a></li>
-    <li><a href="#Legacy_update_alert_request_properties"><code>Legacy_update_alert_request_properties</code> - Legacy update alert request properties</a></li>
-    <li><a href="#Legacy_update_alert_request_properties_actions_inner"><code>Legacy_update_alert_request_properties_actions_inner</code> - </a></li>
-    <li><a href="#Legacy_update_alert_request_properties_schedule"><code>Legacy_update_alert_request_properties_schedule</code> - </a></li>
-    <li><a href="#Ratio"><code>Ratio</code> - Ratio</a></li>
-    <li><a href="#actions_inner"><code>actions_inner</code> - </a></li>
-    <li><a href="#actions_inner_alerts_filter"><code>actions_inner_alerts_filter</code> - </a></li>
-    <li><a href="#actions_inner_alerts_filter_query"><code>actions_inner_alerts_filter_query</code> - </a></li>
-    <li><a href="#actions_inner_alerts_filter_timeframe"><code>actions_inner_alerts_filter_timeframe</code> - </a></li>
-    <li><a href="#actions_inner_alerts_filter_timeframe_hours"><code>actions_inner_alerts_filter_timeframe_hours</code> - </a></li>
-    <li><a href="#actions_inner_frequency"><code>actions_inner_frequency</code> - </a></li>
-    <li><a href="#aggtype"><code>aggtype</code> - </a></li>
-    <li><a href="#alert_response_properties"><code>alert_response_properties</code> - Legacy alert response properties</a></li>
-    <li><a href="#alert_response_properties_executionStatus"><code>alert_response_properties_executionStatus</code> - </a></li>
-    <li><a href="#alert_response_properties_schedule"><code>alert_response_properties_schedule</code> - </a></li>
-    <li><a href="#count_criterion"><code>count_criterion</code> - count criterion</a></li>
-    <li><a href="#create_anomaly_detection_alert_rule_request"><code>create_anomaly_detection_alert_rule_request</code> - Create anomaly detection rule request</a></li>
-    <li><a href="#create_anomaly_detection_jobs_health_rule_request"><code>create_anomaly_detection_jobs_health_rule_request</code> - Create anomaly detection jobs health rule request</a></li>
-    <li><a href="#create_apm_anomaly_rule_request"><code>create_apm_anomaly_rule_request</code> - Create APM anomaly rule rule request</a></li>
-    <li><a href="#create_apm_error_count_rule_request"><code>create_apm_error_count_rule_request</code> - Create APM error count rule request</a></li>
-    <li><a href="#create_apm_transaction_duration_rule_request"><code>create_apm_transaction_duration_rule_request</code> - Create latency threshold rule request</a></li>
-    <li><a href="#create_apm_transaction_error_rate_rule_request"><code>create_apm_transaction_error_rate_rule_request</code> - Create APM transaction error rate rule request</a></li>
-    <li><a href="#create_es_query_rule_request"><code>create_es_query_rule_request</code> - Create Elasticsearch query rule request</a></li>
-    <li><a href="#create_geo_containment_rule_request"><code>create_geo_containment_rule_request</code> - Create traacking containment rule request</a></li>
-    <li><a href="#create_index_threshold_rule_request"><code>create_index_threshold_rule_request</code> - Create index threshold rule request</a></li>
-    <li><a href="#create_infra_inventory_rule_request"><code>create_infra_inventory_rule_request</code> - Create infra inventory rule request</a></li>
-    <li><a href="#create_infra_metric_anomaly_rule_request"><code>create_infra_metric_anomaly_rule_request</code> - Create infrastructure anomaly rule request</a></li>
-    <li><a href="#create_infra_metric_threshold_rule_request"><code>create_infra_metric_threshold_rule_request</code> - Create infra metric threshold rule request</a></li>
-    <li><a href="#create_log_threshold_rule_request"><code>create_log_threshold_rule_request</code> - Create log threshold rule request</a></li>
-    <li><a href="#create_monitoring_ccr_exceptions_rule_request"><code>create_monitoring_ccr_exceptions_rule_request</code> - Create CCR read exceptions rule request</a></li>
-    <li><a href="#create_monitoring_cluster_health_rule_request"><code>create_monitoring_cluster_health_rule_request</code> - Create cluster health rule request</a></li>
-    <li><a href="#create_monitoring_cpu_usage_rule_request"><code>create_monitoring_cpu_usage_rule_request</code> - Create CPU usage rule request</a></li>
-    <li><a href="#create_monitoring_disk_usage_rule_request"><code>create_monitoring_disk_usage_rule_request</code> - Create disk usage rule request</a></li>
-    <li><a href="#create_monitoring_elasticsearch_version_mismatch_rule_request"><code>create_monitoring_elasticsearch_version_mismatch_rule_request</code> - Create Elasticsearch version mismatch rule request</a></li>
-    <li><a href="#create_monitoring_jvm_memory_usage_rule_request"><code>create_monitoring_jvm_memory_usage_rule_request</code> - Create JVM memory usage rule request</a></li>
-    <li><a href="#create_monitoring_kibana_version_mismatch_rule_request"><code>create_monitoring_kibana_version_mismatch_rule_request</code> - Create Kibana version mismatch rule request</a></li>
-    <li><a href="#create_monitoring_license_expiration_rule_request"><code>create_monitoring_license_expiration_rule_request</code> - Create license expiration rule request</a></li>
-    <li><a href="#create_monitoring_logstash_version_mismatch_rule_request"><code>create_monitoring_logstash_version_mismatch_rule_request</code> - Create Logstash version mismatch rule request</a></li>
-    <li><a href="#create_monitoring_missing_data_rule_request"><code>create_monitoring_missing_data_rule_request</code> - Create missing monitoring data rule request</a></li>
-    <li><a href="#create_monitoring_nodes_changed_rule_request"><code>create_monitoring_nodes_changed_rule_request</code> - Create nodes changed rule request</a></li>
-    <li><a href="#create_monitoring_shard_size_rule_request"><code>create_monitoring_shard_size_rule_request</code> - Create shard size rule request</a></li>
-    <li><a href="#create_monitoring_thread_pool_search_rejections_rule_request"><code>create_monitoring_thread_pool_search_rejections_rule_request</code> - Create thread pool search rejections rule request</a></li>
-    <li><a href="#create_monitoring_thread_pool_write_rejections_rule_request"><code>create_monitoring_thread_pool_write_rejections_rule_request</code> - Create thread pool write rejections rule request</a></li>
-    <li><a href="#create_rule_request"><code>create_rule_request</code> - Create rule request body properties</a></li>
-    <li><a href="#create_siem_eql_rule_request"><code>create_siem_eql_rule_request</code> - Create event correlation rule request</a></li>
-    <li><a href="#create_siem_indicator_rule_request"><code>create_siem_indicator_rule_request</code> - Create indicator match rule request</a></li>
-    <li><a href="#create_siem_ml_rule_request"><code>create_siem_ml_rule_request</code> - Create machine learning rule request</a></li>
-    <li><a href="#create_siem_new_terms_rule_request"><code>create_siem_new_terms_rule_request</code> - Create new terms rule request</a></li>
-    <li><a href="#create_siem_notifications_rule_request"><code>create_siem_notifications_rule_request</code> - Create security solution notification (legacy) rule request</a></li>
-    <li><a href="#create_siem_query_rule_request"><code>create_siem_query_rule_request</code> - Create custom query rule request</a></li>
-    <li><a href="#create_siem_saved_query_rule_request"><code>create_siem_saved_query_rule_request</code> - Create saved query rule request</a></li>
-    <li><a href="#create_siem_threshold_rule_request"><code>create_siem_threshold_rule_request</code> - Create threshold rule request</a></li>
-    <li><a href="#create_slo_burn_rate_rule_request"><code>create_slo_burn_rate_rule_request</code> - Create slo burn rate rule request</a></li>
-    <li><a href="#create_synthetics_monitor_status_rule_request"><code>create_synthetics_monitor_status_rule_request</code> - Create synthetics monitor status rule request</a></li>
-    <li><a href="#create_synthetics_uptime_duration_anomaly_rule_request"><code>create_synthetics_uptime_duration_anomaly_rule_request</code> - Create synthetics uptime duration anomaly rule request</a></li>
-    <li><a href="#create_synthetics_uptime_tls_certificate_rule_request"><code>create_synthetics_uptime_tls_certificate_rule_request</code> - Create TLS certificate rule request</a></li>
-    <li><a href="#create_synthetics_uptime_tls_rule_request"><code>create_synthetics_uptime_tls_rule_request</code> - Create synthetics uptime TLS rule request</a></li>
-    <li><a href="#create_transform_health_rule_request"><code>create_transform_health_rule_request</code> - Create transform health rule request</a></li>
-    <li><a href="#create_uptime_monitor_status_rule_request"><code>create_uptime_monitor_status_rule_request</code> - Create uptime monitor status rule request</a></li>
-    <li><a href="#custom_criterion"><code>custom_criterion</code> - custom criterion</a></li>
-    <li><a href="#custom_criterion_customMetric_inner"><code>custom_criterion_customMetric_inner</code> - </a></li>
-    <li><a href="#custom_criterion_customMetric_inner_oneOf"><code>custom_criterion_customMetric_inner_oneOf</code> - </a></li>
-    <li><a href="#custom_criterion_customMetric_inner_oneOf_1"><code>custom_criterion_customMetric_inner_oneOf_1</code> - </a></li>
-    <li><a href="#filter"><code>filter</code> - </a></li>
-    <li><a href="#filter_meta"><code>filter_meta</code> - </a></li>
-    <li><a href="#findRules_200_response"><code>findRules_200_response</code> - </a></li>
-    <li><a href="#findRules_has_reference_parameter"><code>findRules_has_reference_parameter</code> - </a></li>
-    <li><a href="#findRules_search_fields_parameter"><code>findRules_search_fields_parameter</code> - </a></li>
-    <li><a href="#getAlertingHealth_200_response"><code>getAlertingHealth_200_response</code> - </a></li>
-    <li><a href="#getAlertingHealth_200_response_alerting_framework_health"><code>getAlertingHealth_200_response_alerting_framework_health</code> - </a></li>
-    <li><a href="#getAlertingHealth_200_response_alerting_framework_health_decryption_health"><code>getAlertingHealth_200_response_alerting_framework_health_decryption_health</code> - </a></li>
-    <li><a href="#getAlertingHealth_200_response_alerting_framework_health_execution_health"><code>getAlertingHealth_200_response_alerting_framework_health_execution_health</code> - </a></li>
-    <li><a href="#getAlertingHealth_200_response_alerting_framework_health_read_health"><code>getAlertingHealth_200_response_alerting_framework_health_read_health</code> - </a></li>
-    <li><a href="#getRuleTypes_200_response_inner"><code>getRuleTypes_200_response_inner</code> - </a></li>
-    <li><a href="#getRuleTypes_200_response_inner_action_groups_inner"><code>getRuleTypes_200_response_inner_action_groups_inner</code> - </a></li>
-    <li><a href="#getRuleTypes_200_response_inner_action_variables"><code>getRuleTypes_200_response_inner_action_variables</code> - </a></li>
-    <li><a href="#getRuleTypes_200_response_inner_action_variables_context_inner"><code>getRuleTypes_200_response_inner_action_variables_context_inner</code> - </a></li>
-    <li><a href="#getRuleTypes_200_response_inner_action_variables_params_inner"><code>getRuleTypes_200_response_inner_action_variables_params_inner</code> - </a></li>
-    <li><a href="#getRuleTypes_200_response_inner_authorized_consumers"><code>getRuleTypes_200_response_inner_authorized_consumers</code> - </a></li>
-    <li><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts"><code>getRuleTypes_200_response_inner_authorized_consumers_alerts</code> - </a></li>
-    <li><a href="#getRuleTypes_200_response_inner_recovery_action_group"><code>getRuleTypes_200_response_inner_recovery_action_group</code> - </a></li>
-    <li><a href="#groupby"><code>groupby</code> - </a></li>
-    <li><a href="#legacyFindAlerts_200_response"><code>legacyFindAlerts_200_response</code> - </a></li>
-    <li><a href="#legacyGetAlertTypes_200_response_inner"><code>legacyGetAlertTypes_200_response_inner</code> - </a></li>
-    <li><a href="#legacyGetAlertTypes_200_response_inner_actionVariables"><code>legacyGetAlertTypes_200_response_inner_actionVariables</code> - </a></li>
-    <li><a href="#legacyGetAlertTypes_200_response_inner_actionVariables_context_inner"><code>legacyGetAlertTypes_200_response_inner_actionVariables_context_inner</code> - </a></li>
-    <li><a href="#legacyGetAlertTypes_200_response_inner_recoveryActionGroup"><code>legacyGetAlertTypes_200_response_inner_recoveryActionGroup</code> - </a></li>
-    <li><a href="#legacyGetAlertingHealth_200_response"><code>legacyGetAlertingHealth_200_response</code> - </a></li>
-    <li><a href="#legacyGetAlertingHealth_200_response_alertingFrameworkHealth"><code>legacyGetAlertingHealth_200_response_alertingFrameworkHealth</code> - </a></li>
-    <li><a href="#legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth"><code>legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth</code> - </a></li>
-    <li><a href="#legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth"><code>legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth</code> - </a></li>
-    <li><a href="#legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth"><code>legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth</code> - </a></li>
-    <li><a href="#non_count_criterion"><code>non_count_criterion</code> - non count criterion</a></li>
-    <li><a href="#notify_when"><code>notify_when</code> - </a></li>
-    <li><a href="#params_es_query_rule"><code>params_es_query_rule</code> - </a></li>
-    <li><a href="#params_es_query_rule_oneOf"><code>params_es_query_rule_oneOf</code> - </a></li>
-    <li><a href="#params_es_query_rule_oneOf_1"><code>params_es_query_rule_oneOf_1</code> - </a></li>
-    <li><a href="#params_es_query_rule_oneOf_searchConfiguration"><code>params_es_query_rule_oneOf_searchConfiguration</code> - </a></li>
-    <li><a href="#params_es_query_rule_oneOf_searchConfiguration_query"><code>params_es_query_rule_oneOf_searchConfiguration_query</code> - </a></li>
-    <li><a href="#params_index_threshold_rule"><code>params_index_threshold_rule</code> - </a></li>
-    <li><a href="#params_property_apm_anomaly"><code>params_property_apm_anomaly</code> - </a></li>
-    <li><a href="#params_property_apm_error_count"><code>params_property_apm_error_count</code> - </a></li>
-    <li><a href="#params_property_apm_transaction_duration"><code>params_property_apm_transaction_duration</code> - </a></li>
-    <li><a href="#params_property_apm_transaction_error_rate"><code>params_property_apm_transaction_error_rate</code> - </a></li>
-    <li><a href="#params_property_infra_inventory"><code>params_property_infra_inventory</code> - </a></li>
-    <li><a href="#params_property_infra_inventory_criteria_inner"><code>params_property_infra_inventory_criteria_inner</code> - </a></li>
-    <li><a href="#params_property_infra_inventory_criteria_inner_customMetric"><code>params_property_infra_inventory_criteria_inner_customMetric</code> - </a></li>
-    <li><a href="#params_property_infra_metric_threshold"><code>params_property_infra_metric_threshold</code> - </a></li>
-    <li><a href="#params_property_infra_metric_threshold_criteria_inner"><code>params_property_infra_metric_threshold_criteria_inner</code> - </a></li>
-    <li><a href="#params_property_log_threshold"><code>params_property_log_threshold</code> - </a></li>
-    <li><a href="#params_property_slo_burn_rate"><code>params_property_slo_burn_rate</code> - </a></li>
-    <li><a href="#params_property_slo_burn_rate_longWindow"><code>params_property_slo_burn_rate_longWindow</code> - </a></li>
-    <li><a href="#params_property_slo_burn_rate_shortWindow"><code>params_property_slo_burn_rate_shortWindow</code> - </a></li>
-    <li><a href="#params_property_synthetics_monitor_status"><code>params_property_synthetics_monitor_status</code> - </a></li>
-    <li><a href="#params_property_synthetics_monitor_status_availability"><code>params_property_synthetics_monitor_status_availability</code> - </a></li>
-    <li><a href="#params_property_synthetics_monitor_status_filters"><code>params_property_synthetics_monitor_status_filters</code> - </a></li>
-    <li><a href="#params_property_synthetics_monitor_status_filters_oneOf"><code>params_property_synthetics_monitor_status_filters_oneOf</code> - </a></li>
-    <li><a href="#params_property_synthetics_monitor_status_timerange"><code>params_property_synthetics_monitor_status_timerange</code> - </a></li>
-    <li><a href="#params_property_synthetics_uptime_tls"><code>params_property_synthetics_uptime_tls</code> - </a></li>
-    <li><a href="#rule_response_properties"><code>rule_response_properties</code> - Rule response properties</a></li>
-    <li><a href="#rule_response_properties_execution_status"><code>rule_response_properties_execution_status</code> - </a></li>
-    <li><a href="#rule_response_properties_last_run"><code>rule_response_properties_last_run</code> - </a></li>
-    <li><a href="#rule_response_properties_last_run_alerts_count"><code>rule_response_properties_last_run_alerts_count</code> - </a></li>
-    <li><a href="#schedule"><code>schedule</code> - </a></li>
-    <li><a href="#thresholdcomparator"><code>thresholdcomparator</code> - </a></li>
-    <li><a href="#timewindowunit"><code>timewindowunit</code> - </a></li>
-    <li><a href="#update_rule_request"><code>update_rule_request</code> - Update rule request</a></li>
-  </ol>
-
-  <div class="model">
-    <h3><a name="400_response"><code>400_response</code> - Bad request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">Bad Request</div>
-<div class="param">message </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">400</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="401_response"><code>401_response</code> - Unsuccessful rule API response</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">Unauthorized</div>
-<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">401</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="404_response"><code>404_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">error (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">Not Found</div>
-<div class="param">message (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">statusCode (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">404</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Count"><code>Count</code> - Count</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">criteria (optional)</div><div class="param-desc"><span class="param-type"><a href="#Count_criteria">array[Count_criteria]</a></span>  </div>
-<div class="param">count </div><div class="param-desc"><span class="param-type"><a href="#Count_count">Count_count</a></span>  </div>
-<div class="param">timeSize </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">timeUnit </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">s</div><div class="param-enum">m</div><div class="param-enum">h</div><div class="param-enum">d</div>
-<div class="param">logView </div><div class="param-desc"><span class="param-type"><a href="#Count_logView">Count_logView</a></span>  </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Count_count"><code>Count_count</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">comparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">more than</div><div class="param-enum">more than or equals</div><div class="param-enum">less than</div><div class="param-enum">less than or equals</div><div class="param-enum">equals</div><div class="param-enum">does not equal</div><div class="param-enum">matches</div><div class="param-enum">does not match</div><div class="param-enum">matches phrase</div><div class="param-enum">does not match phrase</div>
-<div class="param">value (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Count_criteria"><code>Count_criteria</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">field (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">comparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">more than</div><div class="param-enum">more than or equals</div><div class="param-enum">less than</div><div class="param-enum">less than or equals</div><div class="param-enum">equals</div><div class="param-enum">does not equal</div><div class="param-enum">matches</div><div class="param-enum">does not match</div><div class="param-enum">matches phrase</div><div class="param-enum">does not match phrase</div>
-<div class="param">value (optional)</div><div class="param-desc"><span class="param-type"><a href="#oneOf<number,string>">oneOf<number,string></a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Count_logView"><code>Count_logView</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">logViewId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">log-view-reference</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_create_alert_request_properties"><code>Legacy_create_alert_request_properties</code> - Legacy create alert request properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#Legacy_update_alert_request_properties_actions_inner">array[Legacy_update_alert_request_properties_actions_inner]</a></span>  </div>
-<div class="param">alertTypeId </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the alert type that you want to call when the alert is scheduled to run. </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application that owns the alert. This name has to match the Kibana feature name, as that dictates the required role-based access control privileges. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates if you want to run the alert on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A name to reference and search. </div>
-<div class="param">notifyWhen </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The condition for throttling the notification. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">onActionGroupChange</div><div class="param-enum">onActiveAlert</div><div class="param-enum">onThrottleInterval</div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The parameters to pass to the alert type executor <code>params</code> value. This will also validate against the alert type params validator, if defined. </div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#Legacy_create_alert_request_properties_schedule">Legacy_create_alert_request_properties_schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> A list of keywords to reference and search. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of <code>10m</code> or <code>1h</code> will prevent it from sending 90 notifications during this period. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_create_alert_request_properties_schedule"><code>Legacy_create_alert_request_properties_schedule</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.</div>
-    <div class="field-items">
-      <div class="param">interval (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The interval format specifies the interval in seconds, minutes, hours or days at which the alert should execute. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_update_alert_request_properties"><code>Legacy_update_alert_request_properties</code> - Legacy update alert request properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#Legacy_update_alert_request_properties_actions_inner">array[Legacy_update_alert_request_properties_actions_inner]</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A name to reference and search. </div>
-<div class="param">notifyWhen </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The condition for throttling the notification. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">onActionGroupChange</div><div class="param-enum">onActiveAlert</div><div class="param-enum">onThrottleInterval</div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The parameters to pass to the alert type executor <code>params</code> value. This will also validate against the alert type params validator, if defined. </div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#Legacy_update_alert_request_properties_schedule">Legacy_update_alert_request_properties_schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> A list of keywords to reference and search. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of <code>10m</code> or <code>1h</code> will prevent it from sending 90 notifications during this period. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_update_alert_request_properties_actions_inner"><code>Legacy_update_alert_request_properties_actions_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actionTypeId </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the action type. </div>
-<div class="param">group </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Grouping actions is recommended for escalations for different types of alert instances. If you don't need this functionality, set it to <code>default</code>. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the action saved object to execute. </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The map to the <code>params</code> that the action type will receive. <code>params</code> are handled as Mustache templates and passed a default set of context. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Legacy_update_alert_request_properties_schedule"><code>Legacy_update_alert_request_properties_schedule</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.</div>
-    <div class="field-items">
-      <div class="param">interval (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The interval format specifies the interval in seconds, minutes, hours or days at which the alert should execute. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="Ratio"><code>Ratio</code> - Ratio</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">criteria (optional)</div><div class="param-desc"><span class="param-type"><a href="#array">array[array[Object]]</a></span>  </div>
-<div class="param">count </div><div class="param-desc"><span class="param-type"><a href="#Count_count">Count_count</a></span>  </div>
-<div class="param">timeSize </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">timeUnit </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">s</div><div class="param-enum">m</div><div class="param-enum">h</div><div class="param-enum">d</div>
-<div class="param">logView </div><div class="param-desc"><span class="param-type"><a href="#Count_logView">Count_logView</a></span>  </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="actions_inner"><code>actions_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An action that runs under defined conditions.</div>
-    <div class="field-items">
-      <div class="param">alerts_filter (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner_alerts_filter">actions_inner_alerts_filter</a></span>  </div>
-<div class="param">connector_type_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of connector. This property appears in responses but cannot be set in requests. </div>
-<div class="param">frequency (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner_frequency">actions_inner_frequency</a></span>  </div>
-<div class="param">group </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to <code>default</code>. </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the connector saved object. </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the action, which are sent to the connector. The <code>params</code> are handled as Mustache templates and passed a default set of context. </div>
-<div class="param">uuid (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A universally unique identifier (UUID) for the action. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="actions_inner_alerts_filter"><code>actions_inner_alerts_filter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.</div>
-    <div class="field-items">
-      <div class="param">query (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner_alerts_filter_query">actions_inner_alerts_filter_query</a></span>  </div>
-<div class="param">timeframe (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner_alerts_filter_timeframe">actions_inner_alerts_filter_timeframe</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="actions_inner_alerts_filter_query"><code>actions_inner_alerts_filter_query</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines a query filter that determines whether the action runs.</div>
-    <div class="field-items">
-      <div class="param">kql (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A filter written in Kibana Query Language (KQL). </div>
-<div class="param">filters (optional)</div><div class="param-desc"><span class="param-type"><a href="#filter">array[filter]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="actions_inner_alerts_filter_timeframe"><code>actions_inner_alerts_filter_timeframe</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines a period that limits whether the action runs.</div>
-    <div class="field-items">
-      <div class="param">days (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">array[Integer]</a></span> Defines the days of the week that the action can run, represented as an array of numbers. For example, <code>1</code> represents Monday. An empty array is equivalent to specifying all the days of the week. </div>
-<div class="param">hours (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner_alerts_filter_timeframe_hours">actions_inner_alerts_filter_timeframe_hours</a></span>  </div>
-<div class="param">timezone (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ISO time zone for the <code>hours</code> values. Values such as <code>UTC</code> and <code>UTC+1</code> also work but lack built-in daylight savings time support and are not recommended. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="actions_inner_alerts_filter_timeframe_hours"><code>actions_inner_alerts_filter_timeframe_hours</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Defines the range of time in a day that the action can run. If the <code>start</code> value is <code>00:00</code> and the <code>end</code> value is <code>24:00</code>, actions be generated all day.</div>
-    <div class="field-items">
-      <div class="param">end (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The end of the time frame in 24-hour notation (<code>hh:mm</code>). </div>
-<div class="param">start (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The start of the time frame in 24-hour notation (<code>hh:mm</code>). </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="actions_inner_frequency"><code>actions_inner_frequency</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties that affect how often actions are generated. If the rule type supports setting <code>summary</code> to <code>true</code>, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when <code>notify_when</code> or <code>throttle</code> are defined at the rule level.</div>
-    <div class="field-items">
-      <div class="param">notify_when </div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">summary </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the action is a summary. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="aggtype"><code>aggtype</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The type of aggregation to perform.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="alert_response_properties"><code>alert_response_properties</code> - Legacy alert response properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#object">array[Object]</a></span>  </div>
-<div class="param">alertTypeId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">apiKeyOwner (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">createdAt (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span> The date and time that the alert was created. format: date-time</div>
-<div class="param">createdBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the user that created the alert. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the alert is currently enabled. </div>
-<div class="param">executionStatus (optional)</div><div class="param-desc"><span class="param-type"><a href="#alert_response_properties_executionStatus">alert_response_properties_executionStatus</a></span>  </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the alert. </div>
-<div class="param">muteAll (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">mutedInstanceIds (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the alert. </div>
-<div class="param">notifyWhen (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">params (optional)</div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span>  </div>
-<div class="param">schedule (optional)</div><div class="param-desc"><span class="param-type"><a href="#alert_response_properties_schedule">alert_response_properties_schedule</a></span>  </div>
-<div class="param">scheduledTaskId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">updatedAt (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">updatedBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the user that updated this alert most recently. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="alert_response_properties_executionStatus"><code>alert_response_properties_executionStatus</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">lastExecutionDate (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="alert_response_properties_schedule"><code>alert_response_properties_schedule</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">interval (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="count_criterion"><code>count_criterion</code> - count criterion</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">threshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">comparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">timeUnit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">timeSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">warningThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">warningComparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">count</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_anomaly_detection_alert_rule_request"><code>create_anomaly_detection_alert_rule_request</code> - Create anomaly detection rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that checks if the anomaly detection job results contain anomalies that match the rule conditions.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for an anomaly detection rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">xpack.ml.anomaly_detection_alert</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_anomaly_detection_jobs_health_rule_request"><code>create_anomaly_detection_jobs_health_rule_request</code> - Create anomaly detection jobs health rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An rule that monitors job health and alerts if an operational issue occurred that may prevent the job from detecting anomalies.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for an anomaly detection jobs health rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">xpack.ml.anomaly_detection_jobs_health</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_apm_anomaly_rule_request"><code>create_apm_anomaly_rule_request</code> - Create APM anomaly rule rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when either the latency, throughput, or failed transaction rate of a service is anomalous.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_apm_anomaly">params_property_apm_anomaly</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">apm.anomaly</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_apm_error_count_rule_request"><code>create_apm_error_count_rule_request</code> - Create APM error count rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the number of errors in a service exceeds a defined threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_apm_error_count">params_property_apm_error_count</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">apm.error_rate</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_apm_transaction_duration_rule_request"><code>create_apm_transaction_duration_rule_request</code> - Create latency threshold rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the latency of a specific transaction type in a service exceeds a threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_apm_transaction_duration">params_property_apm_transaction_duration</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">apm.transaction_duration</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_apm_transaction_error_rate_rule_request"><code>create_apm_transaction_error_rate_rule_request</code> - Create APM transaction error rate rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that sends notifications when the rate of transaction errors in a service exceeds a threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_apm_transaction_error_rate">params_property_apm_transaction_error_rate</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">apm.transaction_error_rate</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_es_query_rule_request"><code>create_es_query_rule_request</code> - Create Elasticsearch query rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that runs a user-configured query, compares the number of matches to a configured threshold, and schedules actions to run when the threshold condition is met.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_es_query_rule">params_es_query_rule</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.es-query</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_geo_containment_rule_request"><code>create_geo_containment_rule_request</code> - Create traacking containment rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that runs an Elasticsearch query over indices to determine whether any documents are currently contained within any boundaries from the specified boundary index. In the event that an entity is contained within a boundary, an alert may be generated.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for an tracking containment rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.geo-containment</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_index_threshold_rule_request"><code>create_index_threshold_rule_request</code> - Create index threshold rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that runs an Elasticsearch query, aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_index_threshold_rule">params_index_threshold_rule</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">.index-threshold</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_infra_inventory_rule_request"><code>create_infra_inventory_rule_request</code> - Create infra inventory rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that sends notifications when a metric has reached or exceeded a value for a specific resource or a group of resources within your infrastructure.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_infra_inventory">params_property_infra_inventory</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">metrics.alert.inventory.threshold</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_infra_metric_anomaly_rule_request"><code>create_infra_metric_anomaly_rule_request</code> - Create infrastructure anomaly rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for an infrastructure anomaly rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">metrics.alert.anomaly</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_infra_metric_threshold_rule_request"><code>create_infra_metric_threshold_rule_request</code> - Create infra metric threshold rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that sends notifications when a metric has reached or exceeded a value for a specific time period.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_infra_metric_threshold">params_property_infra_metric_threshold</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">metrics.alert.threshold</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_log_threshold_rule_request"><code>create_log_threshold_rule_request</code> - Create log threshold rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when a log aggregation exceeds a threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_log_threshold">params_property_log_threshold</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">logs.alert.document.count</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_ccr_exceptions_rule_request"><code>create_monitoring_ccr_exceptions_rule_request</code> - Create CCR read exceptions rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects cross-cluster replication (CCR) read exceptions.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a CCR read exceptions rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_ccr_read_exceptions</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_cluster_health_rule_request"><code>create_monitoring_cluster_health_rule_request</code> - Create cluster health rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the health of the cluster changes.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a cluster health rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_cluster_health</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_cpu_usage_rule_request"><code>create_monitoring_cpu_usage_rule_request</code> - Create CPU usage rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the CPU load for a node is consistently high.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a CPU usage rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_cpu_usage</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_disk_usage_rule_request"><code>create_monitoring_disk_usage_rule_request</code> - Create disk usage rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the disk usage for a node is consistently high.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a disk usage rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_disk_usage</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_elasticsearch_version_mismatch_rule_request"><code>create_monitoring_elasticsearch_version_mismatch_rule_request</code> - Create Elasticsearch version mismatch rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the cluster has multipe versions of Elasticsearch.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a Elasticsearch version mismatch rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_elasticsearch_version_mismatch</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_jvm_memory_usage_rule_request"><code>create_monitoring_jvm_memory_usage_rule_request</code> - Create JVM memory usage rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when a node reports high memory usage.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a JVM memory usage rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_jvm_memory_usage</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_kibana_version_mismatch_rule_request"><code>create_monitoring_kibana_version_mismatch_rule_request</code> - Create Kibana version mismatch rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the cluster has multiple versions of Kibana.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a Kibana version mismatch rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_kibana_version_mismatch</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_license_expiration_rule_request"><code>create_monitoring_license_expiration_rule_request</code> - Create license expiration rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the cluster license is about to expire.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a license expiration rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_license_expiration</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_logstash_version_mismatch_rule_request"><code>create_monitoring_logstash_version_mismatch_rule_request</code> - Create Logstash version mismatch rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the cluster has multiple versions of Logstash.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a Logstash version mismatch rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_logstash_version_mismatch</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_missing_data_rule_request"><code>create_monitoring_missing_data_rule_request</code> - Create missing monitoring data rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when monitoring data is missing.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a missing monitoring data rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_missing_monitoring_data</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_nodes_changed_rule_request"><code>create_monitoring_nodes_changed_rule_request</code> - Create nodes changed rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when nodes are added, removed, or restarted.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a nodes changed rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_nodes_changed</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_shard_size_rule_request"><code>create_monitoring_shard_size_rule_request</code> - Create shard size rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the average shard size is larger than a threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a shard size rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_shard_size</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_thread_pool_search_rejections_rule_request"><code>create_monitoring_thread_pool_search_rejections_rule_request</code> - Create thread pool search rejections rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the number of rejections in the thread pool exceeds a threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a thread pool search rejections rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_thread_pool_search_rejections</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_monitoring_thread_pool_write_rejections_rule_request"><code>create_monitoring_thread_pool_write_rejections_rule_request</code> - Create thread pool write rejections rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the number of rejections in the write thread pool exceeds a threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a thread pool write rejections rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">monitoring_alert_thread_pool_write_rejections</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_rule_request"><code>create_rule_request</code> - Create rule request body properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The properties vary depending on the rule type.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_synthetics_monitor_status">params_property_synthetics_monitor_status</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">xpack.uptime.alerts.monitorStatus</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_siem_eql_rule_request"><code>create_siem_eql_rule_request</code> - Create event correlation rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that uses Event Query Language (EQL) to match events, generate sequences, and stack data.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for an event correlation rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">siem.eqlRule</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_siem_indicator_rule_request"><code>create_siem_indicator_rule_request</code> - Create indicator match rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that uses indicators from intelligence sources to detect matching events and alerts.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for an indicator match rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">siem.indicatorRule</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_siem_ml_rule_request"><code>create_siem_ml_rule_request</code> - Create machine learning rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when a machine learning job discovers an anomaly above the defined threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a machine learning rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">siem.mlRule</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_siem_new_terms_rule_request"><code>create_siem_new_terms_rule_request</code> - Create new terms rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that finds documents with values that appear for the first time.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a new terms rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">siem.newTermsRule</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_siem_notifications_rule_request"><code>create_siem_notifications_rule_request</code> - Create security solution notification (legacy) rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a notification rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">siem.notifications</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_siem_query_rule_request"><code>create_siem_query_rule_request</code> - Create custom query rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that uses KQL or Lucene to detect issues across indices.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a custom query rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">siem.queryRule</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_siem_saved_query_rule_request"><code>create_siem_saved_query_rule_request</code> - Create saved query rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that searches the defined indices and creates an alert when a document matches the saved search.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a saved query rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">siem.savedQueryRule</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_siem_threshold_rule_request"><code>create_siem_threshold_rule_request</code> - Create threshold rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that aggregates query results to detect when the number of matches exceeds a threshold.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a threshold rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">siem.thresholdRule</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_slo_burn_rate_rule_request"><code>create_slo_burn_rate_rule_request</code> - Create slo burn rate rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when the burn rate is above a defined threshold for two different lookback periods. The two periods are a long period and a short period that is 1/12th of the long period. For each lookback period, the burn rate is computed as the error rate divided by the error budget. When the burn rates for both periods surpass the threshold, an alert occurs.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_slo_burn_rate">params_property_slo_burn_rate</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">slo.rules.burnRate</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_synthetics_monitor_status_rule_request"><code>create_synthetics_monitor_status_rule_request</code> - Create synthetics monitor status rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when a monitor is down or an availability threshold is breached.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the synthetics monitor status rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">xpack.synthetics.alerts.monitorStatus</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_synthetics_uptime_duration_anomaly_rule_request"><code>create_synthetics_uptime_duration_anomaly_rule_request</code> - Create synthetics uptime duration anomaly rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects response durations for all of the geographic locations of each monitor. When a monitor runs for an unusual amount of time, at a particular time, an anomaly is recorded.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the uptime duration anomaly rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">xpack.uptime.alerts.durationAnomaly</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_synthetics_uptime_tls_certificate_rule_request"><code>create_synthetics_uptime_tls_certificate_rule_request</code> - Create TLS certificate rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects when a monitor has a TLS certificate expiring or when it exceeds an age limit.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a TLS certificate rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">xpack.uptime.alerts.tlsCertificate</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_synthetics_uptime_tls_rule_request"><code>create_synthetics_uptime_tls_rule_request</code> - Create synthetics uptime TLS rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_synthetics_uptime_tls">params_property_synthetics_uptime_tls</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">xpack.uptime.alerts.tls</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_transform_health_rule_request"><code>create_transform_health_rule_request</code> - Create transform health rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that monitors transforms health and alerts if an operational issue occurred.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for a transform health rule. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">transform_health</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="create_uptime_monitor_status_rule_request"><code>create_uptime_monitor_status_rule_request</code> - Create uptime monitor status rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A rule that detects monitor errors and outages.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the application or feature that owns the rule. For example: <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">enabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether you want to run the rule on an interval basis after it is created. </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#params_property_synthetics_monitor_status">params_property_synthetics_monitor_status</a></span>  </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The ID of the rule type that you want to call when the rule is scheduled to run. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">xpack.uptime.alerts.monitorStatus</div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="custom_criterion"><code>custom_criterion</code> - custom criterion</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">threshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">comparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">timeUnit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">timeSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">warningThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">warningComparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">custom</div>
-<div class="param">customMetric (optional)</div><div class="param-desc"><span class="param-type"><a href="#custom_criterion_customMetric_inner">array[custom_criterion_customMetric_inner]</a></span>  </div>
-<div class="param">equation (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">label (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="custom_criterion_customMetric_inner"><code>custom_criterion_customMetric_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">count</div>
-<div class="param">field (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">filter (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="custom_criterion_customMetric_inner_oneOf"><code>custom_criterion_customMetric_inner_oneOf</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">avg</div><div class="param-enum">sum</div><div class="param-enum">max</div><div class="param-enum">min</div><div class="param-enum">cardinality</div>
-<div class="param">field (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="custom_criterion_customMetric_inner_oneOf_1"><code>custom_criterion_customMetric_inner_oneOf_1</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">count</div>
-<div class="param">filter (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="filter"><code>filter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the <code>kbn-es-query</code> package.</div>
-    <div class="field-items">
-      <div class="param">meta (optional)</div><div class="param-desc"><span class="param-type"><a href="#filter_meta">filter_meta</a></span>  </div>
-<div class="param">query (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span>  </div>
-<div class="param">Dollarstate (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="filter_meta"><code>filter_meta</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alias (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">controlledBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">disabled (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">field (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">group (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">index (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">isMultiIndex (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">key (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">negate (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">params (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span>  </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">value (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findRules_200_response"><code>findRules_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">data (optional)</div><div class="param-desc"><span class="param-type"><a href="#rule_response_properties">array[rule_response_properties]</a></span>  </div>
-<div class="param">page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">per_page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">total (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findRules_has_reference_parameter"><code>findRules_has_reference_parameter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="findRules_search_fields_parameter"><code>findRules_search_fields_parameter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getAlertingHealth_200_response"><code>getAlertingHealth_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alerting_framework_health (optional)</div><div class="param-desc"><span class="param-type"><a href="#getAlertingHealth_200_response_alerting_framework_health">getAlertingHealth_200_response_alerting_framework_health</a></span>  </div>
-<div class="param">has_permanent_encryption_key (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> If <code>false</code>, the encrypted saved object plugin does not have a permanent encryption key. </div>
-<div class="param">is_sufficiently_secure (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> If <code>false</code>, security is enabled but TLS is not. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getAlertingHealth_200_response_alerting_framework_health"><code>getAlertingHealth_200_response_alerting_framework_health</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Three substates identify the health of the alerting framework: <code>decryption_health</code>, <code>execution_health</code>, and <code>read_health</code>.</div>
-    <div class="field-items">
-      <div class="param">decryption_health (optional)</div><div class="param-desc"><span class="param-type"><a href="#getAlertingHealth_200_response_alerting_framework_health_decryption_health">getAlertingHealth_200_response_alerting_framework_health_decryption_health</a></span>  </div>
-<div class="param">execution_health (optional)</div><div class="param-desc"><span class="param-type"><a href="#getAlertingHealth_200_response_alerting_framework_health_execution_health">getAlertingHealth_200_response_alerting_framework_health_execution_health</a></span>  </div>
-<div class="param">read_health (optional)</div><div class="param-desc"><span class="param-type"><a href="#getAlertingHealth_200_response_alerting_framework_health_read_health">getAlertingHealth_200_response_alerting_framework_health_read_health</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getAlertingHealth_200_response_alerting_framework_health_decryption_health"><code>getAlertingHealth_200_response_alerting_framework_health_decryption_health</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The timestamp and status of the rule decryption.</div>
-    <div class="field-items">
-      <div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">error</div><div class="param-enum">ok</div><div class="param-enum">warn</div>
-<div class="param">timestamp (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getAlertingHealth_200_response_alerting_framework_health_execution_health"><code>getAlertingHealth_200_response_alerting_framework_health_execution_health</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The timestamp and status of the rule run.</div>
-    <div class="field-items">
-      <div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">error</div><div class="param-enum">ok</div><div class="param-enum">warn</div>
-<div class="param">timestamp (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getAlertingHealth_200_response_alerting_framework_health_read_health"><code>getAlertingHealth_200_response_alerting_framework_health_read_health</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The timestamp and status of the rule reading events.</div>
-    <div class="field-items">
-      <div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">error</div><div class="param-enum">ok</div><div class="param-enum">warn</div>
-<div class="param">timestamp (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getRuleTypes_200_response_inner"><code>getRuleTypes_200_response_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">action_groups (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_action_groups_inner">array[getRuleTypes_200_response_inner_action_groups_inner]</a></span> An explicit list of groups for which the rule type can schedule actions, each with the action group's unique ID and human readable name. Rule actions validation uses this configuration to ensure that groups are valid. </div>
-<div class="param">action_variables (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_action_variables">getRuleTypes_200_response_inner_action_variables</a></span>  </div>
-<div class="param">authorized_consumers (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers">getRuleTypes_200_response_inner_authorized_consumers</a></span>  </div>
-<div class="param">default_action_group_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The default identifier for the rule type group. </div>
-<div class="param">does_set_recovery_context (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the rule passes context variables to its recovery action. </div>
-<div class="param">enabled_in_license (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the rule type is enabled or disabled based on the subscription. </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The unique identifier for the rule type. </div>
-<div class="param">is_exportable (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the rule type is exportable in <strong>Stack Management &gt; Saved Objects</strong>. </div>
-<div class="param">minimum_license_required (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The subscriptions required to use the rule type. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The descriptive name of the rule type. </div>
-<div class="param">producer (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> An identifier for the application that produces this rule type. </div>
-<div class="param">recovery_action_group (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_recovery_action_group">getRuleTypes_200_response_inner_recovery_action_group</a></span>  </div>
-<div class="param">rule_task_timeout (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getRuleTypes_200_response_inner_action_groups_inner"><code>getRuleTypes_200_response_inner_action_groups_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getRuleTypes_200_response_inner_action_variables"><code>getRuleTypes_200_response_inner_action_variables</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A list of action variables that the rule type makes available via context and state in action parameter templates, and a short human readable description. When you create a rule in Kibana, it uses this information to prompt you for these variables in action parameter editors.</div>
-    <div class="field-items">
-      <div class="param">context (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_action_variables_context_inner">array[getRuleTypes_200_response_inner_action_variables_context_inner]</a></span>  </div>
-<div class="param">params (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_action_variables_params_inner">array[getRuleTypes_200_response_inner_action_variables_params_inner]</a></span>  </div>
-<div class="param">state (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_action_variables_params_inner">array[getRuleTypes_200_response_inner_action_variables_params_inner]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getRuleTypes_200_response_inner_action_variables_context_inner"><code>getRuleTypes_200_response_inner_action_variables_context_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">useWithTripleBracesInTemplates (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getRuleTypes_200_response_inner_action_variables_params_inner"><code>getRuleTypes_200_response_inner_action_variables_params_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getRuleTypes_200_response_inner_authorized_consumers"><code>getRuleTypes_200_response_inner_authorized_consumers</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The list of the plugins IDs that have access to the rule type.</div>
-    <div class="field-items">
-      <div class="param">alerts (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">apm (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">discover (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">infrastructure (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">logs (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">ml (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">monitoring (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">siem (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">stackAlerts (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-<div class="param">uptime (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_authorized_consumers_alerts">getRuleTypes_200_response_inner_authorized_consumers_alerts</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getRuleTypes_200_response_inner_authorized_consumers_alerts"><code>getRuleTypes_200_response_inner_authorized_consumers_alerts</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">all (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">read (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="getRuleTypes_200_response_inner_recovery_action_group"><code>getRuleTypes_200_response_inner_recovery_action_group</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An action group to use when an alert goes from an active state to an inactive one.</div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="groupby"><code>groupby</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Indicates whether the aggregation is applied over all documents (<code>all</code>) or split into groups (<code>top</code>) using a grouping field (<code>termField</code>). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to <code>termSize</code> number of groups) are checked.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyFindAlerts_200_response"><code>legacyFindAlerts_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">data (optional)</div><div class="param-desc"><span class="param-type"><a href="#alert_response_properties">array[alert_response_properties]</a></span>  </div>
-<div class="param">page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">perPage (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">total (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertTypes_200_response_inner"><code>legacyGetAlertTypes_200_response_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actionGroups (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_action_groups_inner">array[getRuleTypes_200_response_inner_action_groups_inner]</a></span> An explicit list of groups for which the alert type can schedule actions, each with the action group's unique ID and human readable name. Alert actions validation uses this configuration to ensure that groups are valid. </div>
-<div class="param">actionVariables (optional)</div><div class="param-desc"><span class="param-type"><a href="#legacyGetAlertTypes_200_response_inner_actionVariables">legacyGetAlertTypes_200_response_inner_actionVariables</a></span>  </div>
-<div class="param">authorizedConsumers (optional)</div><div class="param-desc"><span class="param-type"><a href="#">Object</a></span> The list of the plugins IDs that have access to the alert type. </div>
-<div class="param">defaultActionGroupId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The default identifier for the alert type group. </div>
-<div class="param">enabledInLicense (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the rule type is enabled based on the subscription. </div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The unique identifier for the alert type. </div>
-<div class="param">isExportable (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the alert type is exportable in Saved Objects Management UI. </div>
-<div class="param">minimumLicenseRequired (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The subscriptions required to use the alert type. </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The descriptive name of the alert type. </div>
-<div class="param">producer (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> An identifier for the application that produces this alert type. </div>
-<div class="param">recoveryActionGroup (optional)</div><div class="param-desc"><span class="param-type"><a href="#legacyGetAlertTypes_200_response_inner_recoveryActionGroup">legacyGetAlertTypes_200_response_inner_recoveryActionGroup</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertTypes_200_response_inner_actionVariables"><code>legacyGetAlertTypes_200_response_inner_actionVariables</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>A list of action variables that the alert type makes available via context and state in action parameter templates, and a short human readable description. The Alert UI will use this information to prompt users for these variables in action parameter editors.</div>
-    <div class="field-items">
-      <div class="param">context (optional)</div><div class="param-desc"><span class="param-type"><a href="#legacyGetAlertTypes_200_response_inner_actionVariables_context_inner">array[legacyGetAlertTypes_200_response_inner_actionVariables_context_inner]</a></span>  </div>
-<div class="param">params (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_action_variables_params_inner">array[getRuleTypes_200_response_inner_action_variables_params_inner]</a></span>  </div>
-<div class="param">state (optional)</div><div class="param-desc"><span class="param-type"><a href="#getRuleTypes_200_response_inner_action_variables_params_inner">array[getRuleTypes_200_response_inner_action_variables_params_inner]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertTypes_200_response_inner_actionVariables_context_inner"><code>legacyGetAlertTypes_200_response_inner_actionVariables_context_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">description (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertTypes_200_response_inner_recoveryActionGroup"><code>legacyGetAlertTypes_200_response_inner_recoveryActionGroup</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>An action group to use when an alert instance goes from an active state to an inactive one. If it is not specified, the default recovered action group is used.</div>
-    <div class="field-items">
-      <div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">name (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertingHealth_200_response"><code>legacyGetAlertingHealth_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alertingFrameworkHealth (optional)</div><div class="param-desc"><span class="param-type"><a href="#legacyGetAlertingHealth_200_response_alertingFrameworkHealth">legacyGetAlertingHealth_200_response_alertingFrameworkHealth</a></span>  </div>
-<div class="param">hasPermanentEncryptionKey (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> If <code>false</code>, the encrypted saved object plugin does not have a permanent encryption key. </div>
-<div class="param">isSufficientlySecure (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> If <code>false</code>, security is enabled but TLS is not. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertingHealth_200_response_alertingFrameworkHealth"><code>legacyGetAlertingHealth_200_response_alertingFrameworkHealth</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Three substates identify the health of the alerting framework: <code>decryptionHealth</code>, <code>executionHealth</code>, and <code>readHealth</code>.</div>
-    <div class="field-items">
-      <div class="param">decryptionHealth (optional)</div><div class="param-desc"><span class="param-type"><a href="#legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth">legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth</a></span>  </div>
-<div class="param">executionHealth (optional)</div><div class="param-desc"><span class="param-type"><a href="#legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth">legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth</a></span>  </div>
-<div class="param">readHealth (optional)</div><div class="param-desc"><span class="param-type"><a href="#legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth">legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth"><code>legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The timestamp and status of the alert decryption.</div>
-    <div class="field-items">
-      <div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">error</div><div class="param-enum">ok</div><div class="param-enum">warn</div>
-<div class="param">timestamp (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth"><code>legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The timestamp and status of the alert execution.</div>
-    <div class="field-items">
-      <div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">error</div><div class="param-enum">ok</div><div class="param-enum">warn</div>
-<div class="param">timestamp (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth"><code>legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The timestamp and status of the alert reading events.</div>
-    <div class="field-items">
-      <div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">error</div><div class="param-enum">ok</div><div class="param-enum">warn</div>
-<div class="param">timestamp (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="non_count_criterion"><code>non_count_criterion</code> - non count criterion</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">threshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">comparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">timeUnit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">timeSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">warningThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">warningComparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">metric (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">avg</div><div class="param-enum">max</div><div class="param-enum">min</div><div class="param-enum">cardinality</div><div class="param-enum">rate</div><div class="param-enum">count</div><div class="param-enum">sum</div><div class="param-enum">p95</div><div class="param-enum">p99</div><div class="param-enum">custom</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="notify_when"><code>notify_when</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>Indicates how often alerts generate actions. Valid values include: <code>onActionGroupChange</code>: Actions run when the alert status changes; <code>onActiveAlert</code>: Actions run when the alert becomes active and at each check interval while the rule conditions are met; <code>onThrottleInterval</code>: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify <code>notify_when</code> at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_es_query_rule"><code>params_es_query_rule</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">aggField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the numeric field that is used in the aggregation. This property is required when <code>aggType</code> is <code>avg</code>, <code>max</code>, <code>min</code> or <code>sum</code>. </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#aggtype">aggtype</a></span>  </div>
-<div class="param">excludeHitsFromPreviousRun (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether to exclude matches from previous runs. If <code>true</code>, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified. </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#groupby">groupby</a></span>  </div>
-<div class="param">searchConfiguration (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_es_query_rule_oneOf_searchConfiguration">params_es_query_rule_oneOf_searchConfiguration</a></span>  </div>
-<div class="param">searchType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of query, in this case a query that uses Elasticsearch Query DSL. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">esQuery</div>
-<div class="param">size </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The number of documents to pass to the configured actions when the threshold condition is met. </div>
-<div class="param">termField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> This property is required when <code>groupBy</code> is <code>top</code>. The name of the field that is used for grouping the aggregation. </div>
-<div class="param">termSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> This property is required when <code>groupBy</code> is <code>top</code>. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. </div>
-<div class="param">threshold </div><div class="param-desc"><span class="param-type"><a href="#integer">array[Integer]</a></span> The threshold value that is used with the <code>thresholdComparator</code>. If the <code>thresholdComparator</code> is <code>between</code> or <code>notBetween</code>, you must specify the boundary values. </div>
-<div class="param">thresholdComparator </div><div class="param-desc"><span class="param-type"><a href="#thresholdcomparator">thresholdcomparator</a></span>  </div>
-<div class="param">timeField </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The field that is used to calculate the time window. </div>
-<div class="param">timeWindowSize </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The size of the time window (in <code>timeWindowUnit</code> units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. </div>
-<div class="param">timeWindowUnit </div><div class="param-desc"><span class="param-type"><a href="#timewindowunit">timewindowunit</a></span>  </div>
-<div class="param">esQuery </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The query definition, which uses Elasticsearch Query DSL. </div>
-<div class="param">index </div><div class="param-desc"><span class="param-type"><a href="#oneOf<array,string>">oneOf<array,string></a></span> The indices to query. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_es_query_rule_oneOf"><code>params_es_query_rule_oneOf</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The parameters for an Elasticsearch query rule that uses KQL or Lucene to define the query.</div>
-    <div class="field-items">
-      <div class="param">aggField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the numeric field that is used in the aggregation. This property is required when <code>aggType</code> is <code>avg</code>, <code>max</code>, <code>min</code> or <code>sum</code>. </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#aggtype">aggtype</a></span>  </div>
-<div class="param">excludeHitsFromPreviousRun (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether to exclude matches from previous runs. If <code>true</code>, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified. </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#groupby">groupby</a></span>  </div>
-<div class="param">searchConfiguration (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_es_query_rule_oneOf_searchConfiguration">params_es_query_rule_oneOf_searchConfiguration</a></span>  </div>
-<div class="param">searchType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of query, in this case a text-based query that uses KQL or Lucene. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">searchSource</div>
-<div class="param">size </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The number of documents to pass to the configured actions when the threshold condition is met. </div>
-<div class="param">termField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> This property is required when <code>groupBy</code> is <code>top</code>. The name of the field that is used for grouping the aggregation. </div>
-<div class="param">termSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> This property is required when <code>groupBy</code> is <code>top</code>. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. </div>
-<div class="param">threshold </div><div class="param-desc"><span class="param-type"><a href="#integer">array[Integer]</a></span> The threshold value that is used with the <code>thresholdComparator</code>. If the <code>thresholdComparator</code> is <code>between</code> or <code>notBetween</code>, you must specify the boundary values. </div>
-<div class="param">thresholdComparator </div><div class="param-desc"><span class="param-type"><a href="#thresholdcomparator">thresholdcomparator</a></span>  </div>
-<div class="param">timeField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The field that is used to calculate the time window. </div>
-<div class="param">timeWindowSize </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The size of the time window (in <code>timeWindowUnit</code> units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. </div>
-<div class="param">timeWindowUnit </div><div class="param-desc"><span class="param-type"><a href="#timewindowunit">timewindowunit</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_es_query_rule_oneOf_1"><code>params_es_query_rule_oneOf_1</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The parameters for an Elasticsearch query rule that uses Elasticsearch Query DSL to define the query.</div>
-    <div class="field-items">
-      <div class="param">aggField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the numeric field that is used in the aggregation. This property is required when <code>aggType</code> is <code>avg</code>, <code>max</code>, <code>min</code> or <code>sum</code>. </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#aggtype">aggtype</a></span>  </div>
-<div class="param">esQuery </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The query definition, which uses Elasticsearch Query DSL. </div>
-<div class="param">excludeHitsFromPreviousRun (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether to exclude matches from previous runs. If <code>true</code>, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified. </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#groupby">groupby</a></span>  </div>
-<div class="param">index </div><div class="param-desc"><span class="param-type"><a href="#oneOf<array,string>">oneOf<array,string></a></span> The indices to query. </div>
-<div class="param">searchType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The type of query, in this case a query that uses Elasticsearch Query DSL. </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">esQuery</div>
-<div class="param">size (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The number of documents to pass to the configured actions when the threshold condition is met. </div>
-<div class="param">termField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> This property is required when <code>groupBy</code> is <code>top</code>. The name of the field that is used for grouping the aggregation. </div>
-<div class="param">termSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> This property is required when <code>groupBy</code> is <code>top</code>. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. </div>
-<div class="param">threshold </div><div class="param-desc"><span class="param-type"><a href="#integer">array[Integer]</a></span> The threshold value that is used with the <code>thresholdComparator</code>. If the <code>thresholdComparator</code> is <code>between</code> or <code>notBetween</code>, you must specify the boundary values. </div>
-<div class="param">thresholdComparator </div><div class="param-desc"><span class="param-type"><a href="#thresholdcomparator">thresholdcomparator</a></span>  </div>
-<div class="param">timeField </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The field that is used to calculate the time window. </div>
-<div class="param">timeWindowSize </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The size of the time window (in <code>timeWindowUnit</code> units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. </div>
-<div class="param">timeWindowUnit </div><div class="param-desc"><span class="param-type"><a href="#timewindowunit">timewindowunit</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_es_query_rule_oneOf_searchConfiguration"><code>params_es_query_rule_oneOf_searchConfiguration</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch.</div>
-    <div class="field-items">
-      <div class="param">filter (optional)</div><div class="param-desc"><span class="param-type"><a href="#filter">array[filter]</a></span>  </div>
-<div class="param">index (optional)</div><div class="param-desc"><span class="param-type"><a href="#oneOf<string,array>">oneOf<string,array></a></span> The indices to query. </div>
-<div class="param">query (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_es_query_rule_oneOf_searchConfiguration_query">params_es_query_rule_oneOf_searchConfiguration_query</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_es_query_rule_oneOf_searchConfiguration_query"><code>params_es_query_rule_oneOf_searchConfiguration_query</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">language (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">query (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_index_threshold_rule"><code>params_index_threshold_rule</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The parameters for an index threshold rule.</div>
-    <div class="field-items">
-      <div class="param">aggField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the numeric field that is used in the aggregation. This property is required when <code>aggType</code> is <code>avg</code>, <code>max</code>, <code>min</code> or <code>sum</code>. </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#aggtype">aggtype</a></span>  </div>
-<div class="param">filterKuery (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A KQL expression thats limits the scope of alerts. </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#groupby">groupby</a></span>  </div>
-<div class="param">index </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The indices to query. </div>
-<div class="param">termField (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> This property is required when <code>groupBy</code> is <code>top</code>. The name of the field that is used for grouping the aggregation. </div>
-<div class="param">termSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> This property is required when <code>groupBy</code> is <code>top</code>. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. </div>
-<div class="param">threshold </div><div class="param-desc"><span class="param-type"><a href="#integer">array[Integer]</a></span> The threshold value that is used with the <code>thresholdComparator</code>. If the <code>thresholdComparator</code> is <code>between</code> or <code>notBetween</code>, you must specify the boundary values. </div>
-<div class="param">thresholdComparator </div><div class="param-desc"><span class="param-type"><a href="#thresholdcomparator">thresholdcomparator</a></span>  </div>
-<div class="param">timeField </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The field that is used to calculate the time window. </div>
-<div class="param">timeWindowSize </div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The size of the time window (in <code>timeWindowUnit</code> units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. </div>
-<div class="param">timeWindowUnit </div><div class="param-desc"><span class="param-type"><a href="#timewindowunit">timewindowunit</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_apm_anomaly"><code>params_property_apm_anomaly</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">serviceName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The service name from APM </div>
-<div class="param">transactionType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The transaction type from APM </div>
-<div class="param">windowSize </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The window size </div>
-<div class="param">windowUnit </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The window size unit </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">m</div><div class="param-enum">h</div><div class="param-enum">d</div>
-<div class="param">environment </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The environment from APM </div>
-<div class="param">anomalySeverityType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The anomaly threshold value </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">critical</div><div class="param-enum">major</div><div class="param-enum">minor</div><div class="param-enum">warning</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_apm_error_count"><code>params_property_apm_error_count</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">serviceName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The service name from APM </div>
-<div class="param">windowSize </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The window size </div>
-<div class="param">windowUnit </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The window size unit </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">m</div><div class="param-enum">h</div><div class="param-enum">d</div>
-<div class="param">environment </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The environment from APM </div>
-<div class="param">threshold </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The error count threshold value </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">set[String]</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        
-<div class="param">errorGroupingKey (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_apm_transaction_duration"><code>params_property_apm_transaction_duration</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">serviceName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The service name from APM </div>
-<div class="param">transactionType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The transaction type from APM </div>
-<div class="param">transactionName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The transaction name from APM </div>
-<div class="param">windowSize </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The window size </div>
-<div class="param">windowUnit </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> ç </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">m</div><div class="param-enum">h</div><div class="param-enum">d</div>
-<div class="param">environment </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">threshold </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The latency threshold value </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">set[String]</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        
-<div class="param">aggregationType </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">avg</div><div class="param-enum">95th</div><div class="param-enum">99th</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_apm_transaction_error_rate"><code>params_property_apm_transaction_error_rate</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">serviceName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The service name from APM </div>
-<div class="param">transactionType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The transaction type from APM </div>
-<div class="param">transactionName (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The transaction name from APM </div>
-<div class="param">windowSize </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The window size </div>
-<div class="param">windowUnit </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The window size unit </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">m</div><div class="param-enum">h</div><div class="param-enum">d</div>
-<div class="param">environment </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The environment from APM </div>
-<div class="param">threshold </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The error rate threshold value </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">set[String]</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_infra_inventory"><code>params_property_infra_inventory</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">criteria (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_property_infra_inventory_criteria_inner">array[params_property_infra_inventory_criteria_inner]</a></span>  </div>
-<div class="param">filterQuery (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">filterQueryText (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">nodeType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">host</div><div class="param-enum">pod</div><div class="param-enum">container</div><div class="param-enum">awsEC2</div><div class="param-enum">awsS3</div><div class="param-enum">awsSQS</div><div class="param-enum">awsRDS</div>
-<div class="param">sourceId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">alertOnNoData (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_infra_inventory_criteria_inner"><code>params_property_infra_inventory_criteria_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">metric (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">count</div><div class="param-enum">cpu</div><div class="param-enum">diskLatency</div><div class="param-enum">load</div><div class="param-enum">memory</div><div class="param-enum">memoryTotal</div><div class="param-enum">tx</div><div class="param-enum">rx</div><div class="param-enum">logRate</div><div class="param-enum">diskIOReadBytes</div><div class="param-enum">diskIOWriteBytes</div><div class="param-enum">s3TotalRequests</div><div class="param-enum">s3NumberOfObjects</div><div class="param-enum">s3BucketSize</div><div class="param-enum">s3DownloadBytes</div><div class="param-enum">s3UploadBytes</div><div class="param-enum">rdsConnections</div><div class="param-enum">rdsQueriesExecuted</div><div class="param-enum">rdsActiveTransactions</div><div class="param-enum">rdsLatency</div><div class="param-enum">sqsMessagesVisible</div><div class="param-enum">sqsMessagesDelayed</div><div class="param-enum">sqsMessagesSent</div><div class="param-enum">sqsMessagesEmpty</div><div class="param-enum">sqsOldestMessage</div><div class="param-enum">custom</div>
-<div class="param">timeSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">timeUnit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">s</div><div class="param-enum">m</div><div class="param-enum">h</div><div class="param-enum">d</div>
-<div class="param">sourceId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">threshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">comparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">customMetric (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_property_infra_inventory_criteria_inner_customMetric">params_property_infra_inventory_criteria_inner_customMetric</a></span>  </div>
-<div class="param">warningThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">warningComparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_infra_inventory_criteria_inner_customMetric"><code>params_property_infra_inventory_criteria_inner_customMetric</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">type (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">custom</div>
-<div class="param">field (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">aggregation (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">avg</div><div class="param-enum">max</div><div class="param-enum">min</div><div class="param-enum">rate</div>
-<div class="param">id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">label (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_infra_metric_threshold"><code>params_property_infra_metric_threshold</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">criteria (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_property_infra_metric_threshold_criteria_inner">array[params_property_infra_metric_threshold_criteria_inner]</a></span>  </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#findRules_search_fields_parameter">findRules_search_fields_parameter</a></span>  </div>
-<div class="param">filterQuery (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">sourceId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">alertOnNoData (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">alertOnGroupDisappear (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_infra_metric_threshold_criteria_inner"><code>params_property_infra_metric_threshold_criteria_inner</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">threshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">comparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">timeUnit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">timeSize (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">warningThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">array[BigDecimal]</a></span>  </div>
-<div class="param">warningComparator (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum"><</div><div class="param-enum"><=</div><div class="param-enum">></div><div class="param-enum">>=</div><div class="param-enum">between</div><div class="param-enum">outside</div>
-<div class="param">metric (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">aggType (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">custom</div>
-<div class="param">customMetric (optional)</div><div class="param-desc"><span class="param-type"><a href="#custom_criterion_customMetric_inner">array[custom_criterion_customMetric_inner]</a></span>  </div>
-<div class="param">equation (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">label (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_log_threshold"><code>params_property_log_threshold</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">criteria (optional)</div><div class="param-desc"><span class="param-type"><a href="#array">array[array[Object]]</a></span>  </div>
-<div class="param">count </div><div class="param-desc"><span class="param-type"><a href="#Count_count">Count_count</a></span>  </div>
-<div class="param">timeSize </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">timeUnit </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-        <div class="param-enum-header">Enum:</div>
-        <div class="param-enum">s</div><div class="param-enum">m</div><div class="param-enum">h</div><div class="param-enum">d</div>
-<div class="param">logView </div><div class="param-desc"><span class="param-type"><a href="#Count_logView">Count_logView</a></span>  </div>
-<div class="param">groupBy (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_slo_burn_rate"><code>params_property_slo_burn_rate</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">sloId (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The SLO identifier used by the rule </div>
-<div class="param">burnRateThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The burn rate threshold used to trigger the alert </div>
-<div class="param">maxBurnRateThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The maximum burn rate threshold value defined by the SLO error budget </div>
-<div class="param">longWindow (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_property_slo_burn_rate_longWindow">params_property_slo_burn_rate_longWindow</a></span>  </div>
-<div class="param">shortWindow (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_property_slo_burn_rate_shortWindow">params_property_slo_burn_rate_shortWindow</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_slo_burn_rate_longWindow"><code>params_property_slo_burn_rate_longWindow</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The duration of the long window used to compute the burn rate</div>
-    <div class="field-items">
-      <div class="param">value (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The duration value </div>
-<div class="param">unit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The duration unit </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_slo_burn_rate_shortWindow"><code>params_property_slo_burn_rate_shortWindow</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The duration of the short window used to compute the burn rate</div>
-    <div class="field-items">
-      <div class="param">value (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span> The duration value </div>
-<div class="param">unit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The duration unit </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_synthetics_monitor_status"><code>params_property_synthetics_monitor_status</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">availability (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_property_synthetics_monitor_status_availability">params_property_synthetics_monitor_status_availability</a></span>  </div>
-<div class="param">filters (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_property_synthetics_monitor_status_filters">params_property_synthetics_monitor_status_filters</a></span>  </div>
-<div class="param">locations (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">numTimes </div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">search (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">shouldCheckStatus </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">shouldCheckAvailability </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">timerangeCount (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">timerangeUnit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">timerange (optional)</div><div class="param-desc"><span class="param-type"><a href="#params_property_synthetics_monitor_status_timerange">params_property_synthetics_monitor_status_timerange</a></span>  </div>
-<div class="param">version (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">isAutoGenerated (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_synthetics_monitor_status_availability"><code>params_property_synthetics_monitor_status_availability</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">range (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">rangeUnit (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">threshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_synthetics_monitor_status_filters"><code>params_property_synthetics_monitor_status_filters</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">monitorPeriodtype (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">observerPeriodgeoPeriodname (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">urlPeriodport (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_synthetics_monitor_status_filters_oneOf"><code>params_property_synthetics_monitor_status_filters_oneOf</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">monitorPeriodtype (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">observerPeriodgeoPeriodname (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">urlPeriodport (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_synthetics_monitor_status_timerange"><code>params_property_synthetics_monitor_status_timerange</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">from (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">to (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="params_property_synthetics_uptime_tls"><code>params_property_synthetics_uptime_tls</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">search (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">certExpirationThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-<div class="param">certAgeThreshold (optional)</div><div class="param-desc"><span class="param-type"><a href="#number">BigDecimal</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="rule_response_properties"><code>rule_response_properties</code> - Rule response properties</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">actions </div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">api_key_created_by_user (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the API key that is associated with the rule was created by the user. </div>
-<div class="param">api_key_owner </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The owner of the API key that is associated with the rule and used to run background tasks. </div>
-<div class="param">consumer </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The application or feature that owns the rule. For example, <code>alerts</code>, <code>apm</code>, <code>discover</code>, <code>infrastructure</code>, <code>logs</code>, <code>metrics</code>, <code>ml</code>, <code>monitoring</code>, <code>securitySolution</code>, <code>siem</code>, <code>stackAlerts</code>, or <code>uptime</code>. </div>
-<div class="param">created_at </div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span> The date and time that the rule was created. format: date-time</div>
-<div class="param">created_by </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the user that created the rule. </div>
-<div class="param">enabled </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the rule is currently enabled. </div>
-<div class="param">execution_status </div><div class="param-desc"><span class="param-type"><a href="#rule_response_properties_execution_status">rule_response_properties_execution_status</a></span>  </div>
-<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the rule. </div>
-<div class="param">last_run (optional)</div><div class="param-desc"><span class="param-type"><a href="#rule_response_properties_last_run">rule_response_properties_last_run</a></span>  </div>
-<div class="param">muted_alert_ids </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">mute_all </div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. </div>
-<div class="param">next_run (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Indicates how often alerts generate actions. </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the rule. </div>
-<div class="param">revision (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span> The rule revision number. </div>
-<div class="param">rule_type_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the type of rule. For example, <code>.es-query</code>, <code>.index-threshold</code>, <code>logs.alert.document.count</code>, <code>monitoring_alert_cluster_health</code>, <code>siem.thresholdRule</code>, or <code>xpack.ml.anomaly_detection_alert</code>. </div>
-<div class="param">running (optional)</div><div class="param-desc"><span class="param-type"><a href="#boolean">Boolean</a></span> Indicates whether the rule is running. </div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">scheduled_task_id (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">tags </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-<div class="param">updated_at </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The date and time that the rule was updated most recently. </div>
-<div class="param">updated_by </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The identifier for the user that updated this rule most recently. </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="rule_response_properties_execution_status"><code>rule_response_properties_execution_status</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">last_duration (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">last_execution_date (optional)</div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
-<div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="rule_response_properties_last_run"><code>rule_response_properties_last_run</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">alerts_count (optional)</div><div class="param-desc"><span class="param-type"><a href="#rule_response_properties_last_run_alerts_count">rule_response_properties_last_run_alerts_count</a></span>  </div>
-<div class="param">outcome (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-<div class="param">outcome_msg (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span>  </div>
-<div class="param">outcome_order (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">warning (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="rule_response_properties_last_run_alerts_count"><code>rule_response_properties_last_run_alerts_count</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-      <div class="param">active (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">ignored (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">new (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-<div class="param">recovered (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="schedule"><code>schedule</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The check interval, which specifies how frequently the rule conditions are checked. The interval is specified in seconds, minutes, hours, or days.</div>
-    <div class="field-items">
-      <div class="param">interval (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
-    </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="thresholdcomparator"><code>thresholdcomparator</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The comparison function for the threshold. For example, &quot;is above&quot;, &quot;is above or equals&quot;, &quot;is below&quot;, &quot;is below or equals&quot;, &quot;is between&quot;, and &quot;is not between&quot;.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="timewindowunit"><code>timewindowunit</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The type of units for the time window: seconds, minutes, hours, or days.</div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
-  <div class="model">
-    <h3><a name="update_rule_request"><code>update_rule_request</code> - Update rule request</a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'>The update rule API request body varies depending on the type of rule and actions.</div>
-    <div class="field-items">
-      <div class="param">actions (optional)</div><div class="param-desc"><span class="param-type"><a href="#actions_inner">array[actions_inner]</a></span>  </div>
-<div class="param">name </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The name of the rule. </div>
-<div class="param">notify_when (optional)</div><div class="param-desc"><span class="param-type"><a href="#notify_when">notify_when</a></span>  </div>
-<div class="param">params </div><div class="param-desc"><span class="param-type"><a href="#AnyType">map[String, oas_any_type_not_mapped]</a></span> The parameters for the rule. </div>
-<div class="param">schedule </div><div class="param-desc"><span class="param-type"><a href="#schedule">schedule</a></span>  </div>
-<div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The tags for the rule. </div>
-<div class="param">throttle (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if <code>notify_when</code> is set to <code>onThrottleInterval</code>. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. </div>
-    </div>  <!-- field-items -->
-  </div>
-</div>
-++++
diff --git a/docs/api-generated/rules/rule-apis.asciidoc b/docs/api-generated/rules/rule-apis.asciidoc
deleted file mode 100644
index fb963582fb6da..0000000000000
--- a/docs/api-generated/rules/rule-apis.asciidoc
+++ /dev/null
@@ -1,10 +0,0 @@
-[[rule-apis]]
-== Alert and rule APIs
-
-preview::[]
-
-////
-This file includes content that has been generated from https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/docs/openapi. Any modifications required must be done in that open API specification.
-////
-
-include::rule-apis-passthru.asciidoc[]
\ No newline at end of file
diff --git a/docs/api-generated/template/index.mustache b/docs/api-generated/template/index.mustache
deleted file mode 100644
index 8c1162f909508..0000000000000
--- a/docs/api-generated/template/index.mustache
+++ /dev/null
@@ -1,170 +0,0 @@
-////
-This content is generated from the open API specification.
-Any modifications made to this file will be overwritten.
-////
-
-++++
-<div class="openapi">
-  <h2>Access</h2>
-  {{#hasAuthMethods}}
-    <ol>
-    {{#authMethods}}
-      <li>{{#isBasic}}HTTP Basic Authentication{{/isBasic}}{{#isOAuth}}OAuth AuthorizationUrl:{{authorizationUrl}}TokenUrl:{{tokenUrl}}{{/isOAuth}}{{#isApiKey}}APIKey KeyParamName:{{keyParamName}} KeyInQuery:{{isKeyInQuery}} KeyInHeader:{{isKeyInHeader}}{{/isApiKey}}</li>
-    {{/authMethods}}
-    </ol>
-  {{/hasAuthMethods}}
-
-  <h2><a name="__Methods">Methods</a></h2>
-  [ Jump to <a href="#__Models">Models</a> ]
-
-  {{! for the tables of content, I cheat and don't use CSS styles.... }}
-  <h3>Table of Contents </h3>
-  <div class="method-summary">{{access}}</div>
-  {{#apiInfo}}
-  {{#apis}}
-  {{#operations}}
-  <h4><a href="#{{baseName}}">{{baseName}}</a></h4>
-  <ul>
-  {{#operation}}
-  <li><a href="#{{nickname}}"><code><span class="http-method">{{httpMethod}}</span> {{path}}</code></a></li>
-  {{/operation}}
-  </ul>
-  {{/operations}}
-  {{/apis}}
-  {{/apiInfo}}
-
-  {{#apiInfo}}
-  {{#apis}}
-  {{#operations}}
-  <h1><a name="{{baseName}}">{{baseName}}</a></h1>
-  {{#operation}}
-  <div class="method"><a name="{{nickname}}"/>
-    <div class="method-path">
-    <a class="up" href="#__Methods">Up</a>
-    <pre class="{{httpMethod}}"><code class="huge"><span class="http-method">{{httpMethod}}</span> {{path}}</code></pre></div>
-    <div class="method-summary">{{summary}} (<span class="nickname">{{nickname}}</span>)</div>
-    {{! notes is operation.description. So why rename it and make it super confusing???? }}
-    <div class="method-notes">{{notes}}</div>
-
-    {{#hasPathParams}}
-    <h3 class="field-label">Path parameters</h3>
-    <div class="field-items">
-      {{#pathParams}}{{>pathParam}}{{/pathParams}}
-    </div>  <!-- field-items -->
-    {{/hasPathParams}}
-
-    {{#hasConsumes}}
-    <h3 class="field-label">Consumes</h3>
-    This API call consumes the following media types via the <span class="header">Content-Type</span> request header:
-    <ul>
-    {{#consumes}}
-      <li><code>{{{mediaType}}}</code></li>
-    {{/consumes}}
-    </ul>
-    {{/hasConsumes}}
-
-    {{#hasBodyParam}}
-    <h3 class="field-label">Request body</h3>
-    <div class="field-items">
-      {{#bodyParams}}{{>bodyParam}}{{/bodyParams}}
-    </div>  <!-- field-items -->
-    {{/hasBodyParam}}
-
-    {{#hasHeaderParams}}
-    <h3 class="field-label">Request headers</h3>
-    <div class="field-items">
-      {{#headerParams}}{{>headerParam}}{{/headerParams}}
-    </div>  <!-- field-items -->
-    {{/hasHeaderParams}}
-
-    {{#hasQueryParams}}
-    <h3 class="field-label">Query parameters</h3>
-    <div class="field-items">
-      {{#queryParams}}{{>queryParam}}{{/queryParams}}
-    </div>  <!-- field-items -->
-    {{/hasQueryParams}}
-
-    {{#hasFormParams}}
-    <h3 class="field-label">Form parameters</h3>
-    <div class="field-items">
-      {{#formParams}}{{>formParam}}{{/formParams}}
-    </div>  <!-- field-items -->
-    {{/hasFormParams}}
-
-    {{#returnType}}
-    <h3 class="field-label">Return type</h3>
-    <div class="return-type">
-      {{#hasReference}}{{^returnSimpleType}}{{returnContainer}}[{{/returnSimpleType}}<a href="#{{returnBaseType}}">{{returnBaseType}}</a>{{^returnSimpleType}}]{{/returnSimpleType}}{{/hasReference}}
-      {{^hasReference}}{{returnType}}{{/hasReference}}
-    </div>
-    {{/returnType}}
-
-    <!--Todo: process Response Object and its headers, schema, examples -->
-
-    {{#hasExamples}}
-    {{#examples}}
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: {{{contentType}}}</div>
-    <pre class="example"><code>{{{example}}}</code></pre>
-    {{/examples}}
-    {{/hasExamples}}
-
-    {{#hasProduces}}
-    <h3 class="field-label">Produces</h3>
-    This API call produces the following media types according to the <span class="header">Accept</span> request header;
-    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
-    <ul>
-    {{#produces}}
-      <li><code>{{{mediaType}}}</code></li>
-    {{/produces}}
-    </ul>
-    {{/hasProduces}}
-
-    <h3 class="field-label">Responses</h3>
-    {{#responses}}
-    <h4 class="field-label">{{code}}</h4>
-    {{message}}
-        {{^containerType}}<a href="#{{dataType}}">{{dataType}}</a>{{/containerType}}
-    {{#examples}}
-    <h3 class="field-label">Example data</h3>
-    <div class="example-data-content-type">Content-Type: {{{contentType}}}</div>
-    <pre class="example"><code>{{example}}</code></pre>
-    {{/examples}}
-    {{/responses}}
-  </div> <!-- method -->
-  <hr/>
-  {{/operation}}
-  {{/operations}}
-  {{/apis}}
-  {{/apiInfo}}
-
-  <h2><a name="__Models">Models</a></h2>
-  [ Jump to <a href="#__Methods">Methods</a> ]
-
-  <h3>Table of Contents</h3>
-  <ol>
-  {{#models}}
-  {{#model}}
-    <li><a href="#{{name}}"><code>{{name}}</code>{{#title}} - {{.}}{{/title}}</a></li>
-  {{/model}}
-  {{/models}}
-  </ol>
-
-  {{#models}}
-  {{#model}}
-  <div class="model">
-    <h3><a name="{{name}}"><code>{{name}}</code>{{#title}} - {{.}}{{/title}}</a> <a class="up" href="#__Models">Up</a></h3>
-    {{#unescapedDescription}}<div class='model-description'>{{.}}</div>{{/unescapedDescription}}
-    <div class="field-items">
-      {{#vars}}<div class="param">{{name}} {{^required}}(optional){{/required}}</div><div class="param-desc"><span class="param-type">{{^isPrimitiveType}}<a href="#{{complexType}}">{{dataType}}</a>{{/isPrimitiveType}}</span> {{unescapedDescription}} {{#dataFormat}}format: {{{.}}}{{/dataFormat}}</div>
-      {{#isEnum}}
-        <div class="param-enum-header">Enum:</div>
-        {{#_enum}}<div class="param-enum">{{this}}</div>{{/_enum}}
-      {{/isEnum}}
-      {{/vars}}
-    </div>  <!-- field-items -->
-  </div>
-  {{/model}}
-  {{/models}}
-</div>
-++++
diff --git a/docs/api/actions-and-connectors/create.asciidoc b/docs/api/actions-and-connectors/create.asciidoc
index 259c5dfee00af..55168ecf796ca 100644
--- a/docs/api/actions-and-connectors/create.asciidoc
+++ b/docs/api/actions-and-connectors/create.asciidoc
@@ -9,7 +9,7 @@ Creates a connector.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <<connector-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification].
 ====
 
 [[create-connector-api-request]]
diff --git a/docs/api/actions-and-connectors/delete.asciidoc b/docs/api/actions-and-connectors/delete.asciidoc
index d908f276b7461..81619cdf26b5c 100644
--- a/docs/api/actions-and-connectors/delete.asciidoc
+++ b/docs/api/actions-and-connectors/delete.asciidoc
@@ -11,7 +11,7 @@ WARNING: When you delete a connector, _it cannot be recovered_.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <<connector-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification].
 ====
 
 [discrete]
diff --git a/docs/api/actions-and-connectors/execute.asciidoc b/docs/api/actions-and-connectors/execute.asciidoc
index 6d94c61f6232b..1f241202b4adc 100644
--- a/docs/api/actions-and-connectors/execute.asciidoc
+++ b/docs/api/actions-and-connectors/execute.asciidoc
@@ -9,7 +9,7 @@ Runs a connector by ID.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <<connector-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification].
 ====
 
 [[execute-connector-api-request]]
diff --git a/docs/api/actions-and-connectors/get.asciidoc b/docs/api/actions-and-connectors/get.asciidoc
index a43787dc2a33e..92414babd1638 100644
--- a/docs/api/actions-and-connectors/get.asciidoc
+++ b/docs/api/actions-and-connectors/get.asciidoc
@@ -9,7 +9,7 @@ Retrieves a connector by ID.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <<connector-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification].
 ====
 
 [discrete]
diff --git a/docs/api/actions-and-connectors/get_all.asciidoc b/docs/api/actions-and-connectors/get_all.asciidoc
index 2b5fbe20bf56e..ba2cab86b654f 100644
--- a/docs/api/actions-and-connectors/get_all.asciidoc
+++ b/docs/api/actions-and-connectors/get_all.asciidoc
@@ -9,7 +9,7 @@ Retrieves all connectors.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <<connector-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification].
 ====
 
 [discrete]
diff --git a/docs/api/actions-and-connectors/list.asciidoc b/docs/api/actions-and-connectors/list.asciidoc
index d7658cdd11da4..e978f75d36c1f 100644
--- a/docs/api/actions-and-connectors/list.asciidoc
+++ b/docs/api/actions-and-connectors/list.asciidoc
@@ -9,7 +9,7 @@ Retrieves a list of all connector types.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <<connector-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification].
 ====
 
 [[list-connector-types-api-request]]
diff --git a/docs/api/actions-and-connectors/update.asciidoc b/docs/api/actions-and-connectors/update.asciidoc
index b690d3fac995b..7fe3d85ad0ca7 100644
--- a/docs/api/actions-and-connectors/update.asciidoc
+++ b/docs/api/actions-and-connectors/update.asciidoc
@@ -9,7 +9,7 @@ Updates the attributes for a connector.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <<connector-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification].
 ====
 
 [[update-connector-api-request]]
diff --git a/docs/api/alerting/create_rule.asciidoc b/docs/api/alerting/create_rule.asciidoc
index 2bce4a1c49193..faac08b2b613e 100644
--- a/docs/api/alerting/create_rule.asciidoc
+++ b/docs/api/alerting/create_rule.asciidoc
@@ -9,7 +9,7 @@ Create {kib} rules.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[create-rule-api-request]]
diff --git a/docs/api/alerting/delete_rule.asciidoc b/docs/api/alerting/delete_rule.asciidoc
index 143507fa20600..220b4dfa9ece4 100644
--- a/docs/api/alerting/delete_rule.asciidoc
+++ b/docs/api/alerting/delete_rule.asciidoc
@@ -11,7 +11,7 @@ WARNING: After you delete a rule, you cannot recover it.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[delete-rule-api-request]]
diff --git a/docs/api/alerting/disable_rule.asciidoc b/docs/api/alerting/disable_rule.asciidoc
index d1c41eed9eaf1..8f370072a689c 100644
--- a/docs/api/alerting/disable_rule.asciidoc
+++ b/docs/api/alerting/disable_rule.asciidoc
@@ -9,7 +9,7 @@ Disable a rule.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[disable-rule-api-request]]
diff --git a/docs/api/alerting/enable_rule.asciidoc b/docs/api/alerting/enable_rule.asciidoc
index b87c0b9228b1b..f51f6c9295332 100644
--- a/docs/api/alerting/enable_rule.asciidoc
+++ b/docs/api/alerting/enable_rule.asciidoc
@@ -11,7 +11,7 @@ WARNING: This API supports <<token-api-authentication>> only.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[enable-rule-api-request]]
diff --git a/docs/api/alerting/find_rules.asciidoc b/docs/api/alerting/find_rules.asciidoc
index 0879cc77770aa..a9a9ee225db7e 100644
--- a/docs/api/alerting/find_rules.asciidoc
+++ b/docs/api/alerting/find_rules.asciidoc
@@ -9,7 +9,7 @@ Retrieve a paginated set of rules based on condition.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[find-rules-api-request]]
diff --git a/docs/api/alerting/get_rules.asciidoc b/docs/api/alerting/get_rules.asciidoc
index 60c879116948a..ff60d5bad52d1 100644
--- a/docs/api/alerting/get_rules.asciidoc
+++ b/docs/api/alerting/get_rules.asciidoc
@@ -9,7 +9,7 @@ Retrieve a rule by ID.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[get-rule-api-request]]
diff --git a/docs/api/alerting/health.asciidoc b/docs/api/alerting/health.asciidoc
index 2a37abc864878..cd9d1c9449a82 100644
--- a/docs/api/alerting/health.asciidoc
+++ b/docs/api/alerting/health.asciidoc
@@ -9,7 +9,7 @@ Retrieve the health status of the alerting framework.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[get-alerting-framework-health-api-request]]
diff --git a/docs/api/alerting/list_rule_types.asciidoc b/docs/api/alerting/list_rule_types.asciidoc
index 32b4be086705a..7640d50b3ccd0 100644
--- a/docs/api/alerting/list_rule_types.asciidoc
+++ b/docs/api/alerting/list_rule_types.asciidoc
@@ -9,7 +9,7 @@ Retrieve a list of rule types that the user is authorized to access.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 
diff --git a/docs/api/alerting/mute_alert.asciidoc b/docs/api/alerting/mute_alert.asciidoc
index 3ac99f0d3dda0..ad6d87848dfee 100644
--- a/docs/api/alerting/mute_alert.asciidoc
+++ b/docs/api/alerting/mute_alert.asciidoc
@@ -9,7 +9,7 @@ Mute an alert.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[mute-alert-api-request]]
diff --git a/docs/api/alerting/mute_all_alerts.asciidoc b/docs/api/alerting/mute_all_alerts.asciidoc
index a3c1fc0084245..b33d337d473ca 100644
--- a/docs/api/alerting/mute_all_alerts.asciidoc
+++ b/docs/api/alerting/mute_all_alerts.asciidoc
@@ -9,7 +9,7 @@ Mute all alerts.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[mute-all-alerts-api-request]]
diff --git a/docs/api/alerting/unmute_alert.asciidoc b/docs/api/alerting/unmute_alert.asciidoc
index 8efa95a16edd7..81bb641b259f9 100644
--- a/docs/api/alerting/unmute_alert.asciidoc
+++ b/docs/api/alerting/unmute_alert.asciidoc
@@ -9,7 +9,7 @@ Unmute an alert.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[unmute-alert-api-request]]
diff --git a/docs/api/alerting/unmute_all_alerts.asciidoc b/docs/api/alerting/unmute_all_alerts.asciidoc
index a4e2a91847397..0594727c71268 100644
--- a/docs/api/alerting/unmute_all_alerts.asciidoc
+++ b/docs/api/alerting/unmute_all_alerts.asciidoc
@@ -9,7 +9,7 @@ Unmute all alerts.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[unmute-all-alerts-api-all-request]]
diff --git a/docs/api/alerting/update_rule.asciidoc b/docs/api/alerting/update_rule.asciidoc
index 11ca1dc35fc85..124adc79582fe 100644
--- a/docs/api/alerting/update_rule.asciidoc
+++ b/docs/api/alerting/update_rule.asciidoc
@@ -9,7 +9,7 @@ Update the attributes for an existing rule.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <<rule-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification].
 ====
 
 [[update-rule-api-request]]
diff --git a/docs/api/cases/cases-api-add-comment.asciidoc b/docs/api/cases/cases-api-add-comment.asciidoc
index 48c3ffb5845b8..28b8959d5a017 100644
--- a/docs/api/cases/cases-api-add-comment.asciidoc
+++ b/docs/api/cases/cases-api-add-comment.asciidoc
@@ -9,7 +9,7 @@ Adds a comment or alert to a case.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-create.asciidoc b/docs/api/cases/cases-api-create.asciidoc
index f124d3500228c..2145acd360532 100644
--- a/docs/api/cases/cases-api-create.asciidoc
+++ b/docs/api/cases/cases-api-create.asciidoc
@@ -9,7 +9,7 @@ Creates a case.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-delete-cases.asciidoc b/docs/api/cases/cases-api-delete-cases.asciidoc
index 013dc9567db2e..abf518d212095 100644
--- a/docs/api/cases/cases-api-delete-cases.asciidoc
+++ b/docs/api/cases/cases-api-delete-cases.asciidoc
@@ -9,7 +9,7 @@ Deletes one or more cases.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-delete-comments.asciidoc b/docs/api/cases/cases-api-delete-comments.asciidoc
index 130158bd021c2..dc8fe0e120574 100644
--- a/docs/api/cases/cases-api-delete-comments.asciidoc
+++ b/docs/api/cases/cases-api-delete-comments.asciidoc
@@ -9,7 +9,7 @@ Deletes one or all comments and alerts from a case.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-find-case-activity.asciidoc b/docs/api/cases/cases-api-find-case-activity.asciidoc
index e59540c654e28..d15e2a8bea9d5 100644
--- a/docs/api/cases/cases-api-find-case-activity.asciidoc
+++ b/docs/api/cases/cases-api-find-case-activity.asciidoc
@@ -9,7 +9,7 @@ Finds user activity for a case.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-find-cases.asciidoc b/docs/api/cases/cases-api-find-cases.asciidoc
index 9d9151b13d7e8..4a791a8ddb9d3 100644
--- a/docs/api/cases/cases-api-find-cases.asciidoc
+++ b/docs/api/cases/cases-api-find-cases.asciidoc
@@ -9,7 +9,7 @@ Retrieves a paginated subset of cases.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-find-connectors.asciidoc b/docs/api/cases/cases-api-find-connectors.asciidoc
index 6968bc55d88bb..974e3e9a2211b 100644
--- a/docs/api/cases/cases-api-find-connectors.asciidoc
+++ b/docs/api/cases/cases-api-find-connectors.asciidoc
@@ -13,7 +13,7 @@ returned. Refer to the list of supported external incident management systems in
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-get-alerts.asciidoc b/docs/api/cases/cases-api-get-alerts.asciidoc
index 1b9c1da1bd926..fea5b5f9a7354 100644
--- a/docs/api/cases/cases-api-get-alerts.asciidoc
+++ b/docs/api/cases/cases-api-get-alerts.asciidoc
@@ -11,7 +11,7 @@ Gets all alerts attached to a case.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-get-case-activity.asciidoc b/docs/api/cases/cases-api-get-case-activity.asciidoc
index db5835709a6ab..2baa19ebf6985 100644
--- a/docs/api/cases/cases-api-get-case-activity.asciidoc
+++ b/docs/api/cases/cases-api-get-case-activity.asciidoc
@@ -11,7 +11,7 @@ deprecated::[8.1.0,Use <<cases-api-find-case-activity>> instead.]
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-get-case.asciidoc b/docs/api/cases/cases-api-get-case.asciidoc
index b5942f0424408..fe2b4c54b85e5 100644
--- a/docs/api/cases/cases-api-get-case.asciidoc
+++ b/docs/api/cases/cases-api-get-case.asciidoc
@@ -9,7 +9,7 @@ Returns information about a case.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-get-cases-by-alert.asciidoc b/docs/api/cases/cases-api-get-cases-by-alert.asciidoc
index 14b45f9b4b0e7..47a0c5973830a 100644
--- a/docs/api/cases/cases-api-get-cases-by-alert.asciidoc
+++ b/docs/api/cases/cases-api-get-cases-by-alert.asciidoc
@@ -11,7 +11,7 @@ Returns the cases associated with a specific alert.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 
diff --git a/docs/api/cases/cases-api-get-comments.asciidoc b/docs/api/cases/cases-api-get-comments.asciidoc
index 5f7bb938f588a..fb0e497f4ebf1 100644
--- a/docs/api/cases/cases-api-get-comments.asciidoc
+++ b/docs/api/cases/cases-api-get-comments.asciidoc
@@ -9,7 +9,7 @@ Gets a comment or all comments for a case.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-get-configuration.asciidoc b/docs/api/cases/cases-api-get-configuration.asciidoc
index fec5eb8bdedd6..e78eaa634f716 100644
--- a/docs/api/cases/cases-api-get-configuration.asciidoc
+++ b/docs/api/cases/cases-api-get-configuration.asciidoc
@@ -10,7 +10,7 @@ default connector for cases.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-get-reporters.asciidoc b/docs/api/cases/cases-api-get-reporters.asciidoc
index 9792bc77ae517..48f373c65986a 100644
--- a/docs/api/cases/cases-api-get-reporters.asciidoc
+++ b/docs/api/cases/cases-api-get-reporters.asciidoc
@@ -9,7 +9,7 @@ Returns information about the users who opened cases.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 
diff --git a/docs/api/cases/cases-api-get-status.asciidoc b/docs/api/cases/cases-api-get-status.asciidoc
index a6d64bc4e9585..ce9205febae5a 100644
--- a/docs/api/cases/cases-api-get-status.asciidoc
+++ b/docs/api/cases/cases-api-get-status.asciidoc
@@ -9,7 +9,7 @@ Returns the number of cases that are open, closed, and in progress.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 deprecated::[8.1.0]
diff --git a/docs/api/cases/cases-api-get-tags.asciidoc b/docs/api/cases/cases-api-get-tags.asciidoc
index e22a2f08cfda5..993c7d88f538a 100644
--- a/docs/api/cases/cases-api-get-tags.asciidoc
+++ b/docs/api/cases/cases-api-get-tags.asciidoc
@@ -9,7 +9,7 @@ Aggregates and returns a list of case tags.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-push.asciidoc b/docs/api/cases/cases-api-push.asciidoc
index 5f7a0c268ff1c..e3bf2464d19b7 100644
--- a/docs/api/cases/cases-api-push.asciidoc
+++ b/docs/api/cases/cases-api-push.asciidoc
@@ -9,7 +9,7 @@ Pushes a case to an external service.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-set-configuration.asciidoc b/docs/api/cases/cases-api-set-configuration.asciidoc
index a32cc555ed052..6d7e9320672e6 100644
--- a/docs/api/cases/cases-api-set-configuration.asciidoc
+++ b/docs/api/cases/cases-api-set-configuration.asciidoc
@@ -10,7 +10,7 @@ default connector for cases.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-update-comment.asciidoc b/docs/api/cases/cases-api-update-comment.asciidoc
index 13adb2218029e..fc8d97e779fd0 100644
--- a/docs/api/cases/cases-api-update-comment.asciidoc
+++ b/docs/api/cases/cases-api-update-comment.asciidoc
@@ -9,7 +9,7 @@ Updates a comment or alert in a case.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-update-configuration.asciidoc b/docs/api/cases/cases-api-update-configuration.asciidoc
index dcfe01ef84179..b30a8f0bb79b2 100644
--- a/docs/api/cases/cases-api-update-configuration.asciidoc
+++ b/docs/api/cases/cases-api-update-configuration.asciidoc
@@ -10,7 +10,7 @@ connector for cases.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/cases/cases-api-update.asciidoc b/docs/api/cases/cases-api-update.asciidoc
index ca75e34597afc..46c5ac7763600 100644
--- a/docs/api/cases/cases-api-update.asciidoc
+++ b/docs/api/cases/cases-api-update.asciidoc
@@ -9,7 +9,7 @@ Updates one or more cases.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification]. For a preview, check out <<case-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[open API specification].
 ====
 
 === {api-request-title}
diff --git a/docs/api/machine-learning/sync.asciidoc b/docs/api/machine-learning/sync.asciidoc
index af4f797ade1f2..bd65ce56dd5d1 100644
--- a/docs/api/machine-learning/sync.asciidoc
+++ b/docs/api/machine-learning/sync.asciidoc
@@ -9,7 +9,7 @@ Synchronizes {kib} saved objects for {ml} jobs and trained models.
 [NOTE]
 ====
 For the most up-to-date API details, refer to the
-{kib-repo}/tree/{branch}/x-pack/plugins/ml/common/openapi[open API specification]. For a preview, check out <<machine-learning-apis>>.
+{kib-repo}/tree/{branch}/x-pack/plugins/ml/common/openapi[open API specification].
 ====
 
 [[machine-learning-api-sync-request]]
diff --git a/docs/api/saved-objects/bulk_create.asciidoc b/docs/api/saved-objects/bulk_create.asciidoc
index 73feb14acf483..1e56735fa52a2 100644
--- a/docs/api/saved-objects/bulk_create.asciidoc
+++ b/docs/api/saved-objects/bulk_create.asciidoc
@@ -38,7 +38,7 @@ For the most up-to-date API details, refer to the
 ==== Request body
 
 `type`::
-  (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`.
+  (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`.
 
 `id`::
   (Optional, string) Specifies an ID instead of using a randomly generated ID.
diff --git a/docs/api/saved-objects/create.asciidoc b/docs/api/saved-objects/create.asciidoc
index 7e26a329fb54d..154a58bb72025 100644
--- a/docs/api/saved-objects/create.asciidoc
+++ b/docs/api/saved-objects/create.asciidoc
@@ -32,7 +32,7 @@ For the most up-to-date API details, refer to the
   (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
 
 `<type>`::
-  (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`.
+  (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`.
 
 `<id>`::
   (Optional, string) Specifies an ID instead of using a randomly generated ID.
diff --git a/docs/apis.asciidoc b/docs/apis.asciidoc
deleted file mode 100644
index d85d9ce3f35eb..0000000000000
--- a/docs/apis.asciidoc
+++ /dev/null
@@ -1,17 +0,0 @@
-[role="exclude",id="apis"]
-= APIs
-
-[partintro]
---
-
-preview::[]
-
-These APIs are documented using the OpenAPI specification. The current supported
-version of the specification is 3.0. For more information, go to https://openapi-generator.tech/[OpenAPI Generator]
-
---
-
-include::api-generated/cases/case-apis.asciidoc[]
-include::api-generated/connectors/connector-apis.asciidoc[]
-include::api-generated/machine-learning/ml-apis.asciidoc[]
-include::api-generated/rules/rule-apis.asciidoc[]
\ No newline at end of file
diff --git a/docs/developer/advanced/upgrading-nodejs.asciidoc b/docs/developer/advanced/upgrading-nodejs.asciidoc
index 547ef0080cee8..1126a0631265e 100644
--- a/docs/developer/advanced/upgrading-nodejs.asciidoc
+++ b/docs/developer/advanced/upgrading-nodejs.asciidoc
@@ -4,6 +4,12 @@
 {kib} requires a specific Node.js version to run.
 When running {kib} from source, you must have this version installed locally.
 
+=== Step 1: Generate custom Node.js builds
+
+Before making a PR to upgrade Node.js, we must first <<start-new-nodejs-build,generate the required custom Node.js builds>> matching the desired Node.js version.
+
+=== Step 2: Create PR to upgrade Node.js
+
 The required version of Node.js is listed in several different files throughout the {kib} source code.
 These files must be updated when upgrading Node.js:
 
@@ -16,8 +22,8 @@ These files must be updated when upgrading Node.js:
   - {kib-repo}blob/{branch}/package.json[`package.json`] - The version is specified in the `engines.node` field (if possible, also upgrade `@types/node` to match the new version, both under `devDependencies` and `resolutions`).
   - {kib-repo}blob/{branch}/WORKSPACE.bazel[`WORKSPACE.bazel`] - The version is specified in the `node_version` property.
     Besides this property, the list of files under `node_repositories` must be updated along with their respective SHA256 hashes.
-    These can be found on the https://nodejs.org[nodejs.org] website.
-    Example for Node.js v18.18.2: https://nodejs.org/dist/v18.18.2/SHASUMS256.txt.asc
+    These can be found in the `SHASUMS256.txt` file inside the public `kibana-custom-node-artifacts` GCP bucket.
+    Example for Node.js v18.18.2: https://storage.googleapis.com/kibana-custom-node-artifacts/node-glibc-217/dist/v18.18.2/SHASUMS256.txt[kibana-custom-node-artifacts/node-glibc-217/dist/v18.18.2/SHASUMS256.txt]
 
 See PR {kib-repo}pull/128123[#128123] for an example of how the Node.js version has been upgraded previously.
 
@@ -37,6 +43,13 @@ Due to Node.js 16 coming to an https://nodejs.org/en/blog/announcements/nodejs16
 To keep support for these older platforms, we're bundling the Linux distributable of {kib} with a https://github.com/elastic/kibana-custom-nodejs-builds[custom build of Node.js] with extended backwards compatibility.
 The only difference between the offical Node.js build and our custom build, is the version of `glibc` that it's compiled against.
 
+[[start-new-nodejs-build]]
+==== How to start a new build
+
+To generate a new custom Node.js build, https://buildkite.com/elastic/kibana-custom-node-dot-js-builds#new[start a new build] on our dedicated Buildkite pipeline (requires Elastic employee permissions).
+Give it a clear name (e.g. `Node 18.18.2`) and remember so set the custom `OVERRIDE_TARGET_VERSION` environment variable to the desired Node.js version - e.g. `OVERRIDE_TARGET_VERSION=18.18.2`.
+You find the "Environment Variables" field by expanding "Options >" in the "New Build" dialog.
+
 === Backporting
 
 The following rules are not set in stone.
diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index d72b97a76af2a..ac9f1f6a28e5d 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -17,7 +17,5 @@ include::CHANGELOG.asciidoc[]
 
 include::developer/index.asciidoc[]
 
-include::apis.asciidoc[]
-
 include::redirects.asciidoc[]
 
diff --git a/docs/management/connectors/images/bedrock-connector.png b/docs/management/connectors/images/bedrock-connector.png
index 22a537183171d..cfdb19f3fc6c2 100644
Binary files a/docs/management/connectors/images/bedrock-connector.png and b/docs/management/connectors/images/bedrock-connector.png differ
diff --git a/docs/management/connectors/images/bedrock-params.png b/docs/management/connectors/images/bedrock-params.png
index f6857e6d0ffee..23dcfe7e12091 100644
Binary files a/docs/management/connectors/images/bedrock-params.png and b/docs/management/connectors/images/bedrock-params.png differ
diff --git a/docs/redirects.asciidoc b/docs/redirects.asciidoc
index eac4ff0c800d8..be017fbd1c94e 100644
--- a/docs/redirects.asciidoc
+++ b/docs/redirects.asciidoc
@@ -426,4 +426,10 @@ This content has moved. Refer to <<enhancements-and-bug-fixes-v8.10.0-revised>>
 [role="exclude",id="gen-ai-action-type"]
 == Generative AI connector and action
 
-This connector was renamed. Refer to <<openai-action-type>>.
\ No newline at end of file
+This connector was renamed. Refer to <<openai-action-type>>.
+
+[role="exclude",id="apis"]
+== APIs
+
+For the most up-to-date API details, refer to the
+{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[alerting], {kib-repo}/tree/{branch}/x-pack/plugins/cases/docs/openapi[cases], {kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[connectors], and {kib-repo}/tree/{branch}/x-pack/plugins/ml/common/openapi[machine learning] open API specifications.
\ No newline at end of file
diff --git a/docs/settings/fleet-settings.asciidoc b/docs/settings/fleet-settings.asciidoc
index a222e4e5af578..d3cad6b4dfdbc 100644
--- a/docs/settings/fleet-settings.asciidoc
+++ b/docs/settings/fleet-settings.asciidoc
@@ -188,7 +188,7 @@ NOTE: The `xpack.fleet.outputs` settings are intended for advanced configuration
   `name`::: 
     Output name.
   `type`::: 
-    Type of Output. Currently we only support "elasticsearch".
+    Type of Output. Currently we support "elasticsearch", "logstash", "kafka".
   `hosts`::: 
     Array that contains the list of host for that output.
   `config`::: 
diff --git a/docs/user/alerting/images/rule-types-index-threshold-example-action-summary.png b/docs/user/alerting/images/rule-types-index-threshold-example-action-summary.png
new file mode 100644
index 0000000000000..337171d995676
Binary files /dev/null and b/docs/user/alerting/images/rule-types-index-threshold-example-action-summary.png differ
diff --git a/docs/user/alerting/images/rule-types-index-threshold-example-action.png b/docs/user/alerting/images/rule-types-index-threshold-example-action.png
index 278a722921757..da4fb66dc6400 100644
Binary files a/docs/user/alerting/images/rule-types-index-threshold-example-action.png and b/docs/user/alerting/images/rule-types-index-threshold-example-action.png differ
diff --git a/docs/user/alerting/rule-types/es-query.asciidoc b/docs/user/alerting/rule-types/es-query.asciidoc
index 029ec2e1eaa46..2f5e53b7b342d 100644
--- a/docs/user/alerting/rule-types/es-query.asciidoc
+++ b/docs/user/alerting/rule-types/es-query.asciidoc
@@ -1,18 +1,17 @@
 [[rule-type-es-query]]
-== {es} query
-
-:frontmatter-description: Create an {es} query rule, which generates alerts when your query meets a threshold.
+== Create an {es} query rule
+:frontmatter-description: Generate alerts when an {es} query meets a threshold.
 :frontmatter-tags-products: [kibana,alerting]
-:frontmatter-tags-content-type: [overview]
+:frontmatter-tags-content-type: [how-to]
 :frontmatter-tags-user-goals: [analyze]
+++++
+<titleabbrev>{es} query</titleabbrev>
+++++
 
 The {es} query rule type runs a user-configured query, compares the number of 
 matches to a configured threshold, and schedules actions to run when the 
 threshold condition is met.
 
-[float]
-=== Create the rule
-
 In *{stack-manage-app}* > *{rules-ui}*, click *Create rule*, fill in the name and optional tags, then select *{es} query*.
 An {es} query rule can be defined using KQL/Lucene or Query DSL.
 
@@ -66,14 +65,14 @@ image::images/es-query-rule-action-summary.png[UI for defining alert summary act
 Alternatively, you can set the action frequency such that actions run for each alert.
 Choose how often the action runs (at each check interval, only when the alert status changes, or at a custom action interval).
 You must also choose an action group, which indicates whether the action runs when the query is matched or when the alert is recovered.
+Each connector supports a specific set of actions for each action group.
 For example:
 
 [role="screenshot"]
 image::images/es-query-rule-action-query-matched.png[UI for defining a recovery action]
 // NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
-Each connector supports a specific set of actions for each action group.
-For more details, refer to <<action-types>>.
+You can further refine the conditions under which actions run by specifying that actions only run they match a KQL query or when an alert occurs within a specific time frame.
 
 [float]
 === Add action variables
diff --git a/docs/user/alerting/rule-types/geo-rule-types.asciidoc b/docs/user/alerting/rule-types/geo-rule-types.asciidoc
index f8c750acea62c..95fd9e0625881 100644
--- a/docs/user/alerting/rule-types/geo-rule-types.asciidoc
+++ b/docs/user/alerting/rule-types/geo-rule-types.asciidoc
@@ -1,6 +1,12 @@
-[role="xpack"]
 [[geo-alerting]]
-== Tracking containment
+== Create a tracking containment rule
+:frontmatter-description: Generate alerts when a geographic entity is contained or no longer contained within a boundary.
+:frontmatter-tags-products: [kibana,alerting]
+:frontmatter-tags-content-type: [how-to]
+:frontmatter-tags-user-goals: [analyze]
+++++
+<titleabbrev>Tracking containment</titleabbrev>
+++++
 
 The tracking containment rule alerts when an entity is contained or no longer contained within a boundary. 
 
diff --git a/docs/user/alerting/rule-types/index-threshold.asciidoc b/docs/user/alerting/rule-types/index-threshold.asciidoc
index 69cdd2c3bbbcc..9945b58df8bb7 100644
--- a/docs/user/alerting/rule-types/index-threshold.asciidoc
+++ b/docs/user/alerting/rule-types/index-threshold.asciidoc
@@ -1,13 +1,17 @@
 [[rule-type-index-threshold]]
-== Index threshold
-
-:frontmatter-description: An index threshold rule generates alerts when an aggregated query meets a threshold. 
+== Create an index threshold rule
+:frontmatter-description: Generate alerts when an aggregated query meets a threshold. 
 :frontmatter-tags-products: [kibana,alerting] 
-:frontmatter-tags-content-type: [overview] 
+:frontmatter-tags-content-type: [how-to] 
 :frontmatter-tags-user-goals: [analyze]
+++++
+<titleabbrev>Index threshold</titleabbrev>
+++++
 
 The index threshold rule type runs an {es} query. It aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met.
 
+In *{stack-manage-app}* > *{rules-ui}*, click *Create rule*, fill in the name and optional tags, then select *Index threshold*.
+
 [float]
 === Define the conditions
 
@@ -31,13 +35,35 @@ If data is available and all clauses have been defined, a preview chart will ren
 [[actions-index-threshold]]
 === Add actions
 
-You can <<defining-rules-actions-details,add actions>> to your rule to generate notifications.
+You can optionally send notifications when the rule conditions are met and when they are no longer met.
+In particular, this rule type supports:
+
+* alert summaries
+* actions that run when the threshold is met
+* recovery actions that run when the rule conditions are no longer met
+
+For each action, you must choose a connector, which provides connection information for a {kib} service or third party integration.
+For more information about all the supported connectors, go to <<action-types>>.
+
+After you select a connector, you must set the action frequency.
+You can choose to create a summary of alerts on each check interval or on a custom interval.
+For example, summarize the new, ongoing, and recovered alerts at a custom interval:
+
+[role="screenshot"]
+image::user/alerting/images/rule-types-index-threshold-example-action-summary.png[UI for defining alert summary action in an index threshold rule]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
+
+Alternatively, you can set the action frequency such that actions run for each alert.
+Choose how often the action runs (at each check interval, only when the alert status changes, or at a custom action interval).
+You must also choose an action group, which indicates whether the action runs when the threshold is met or when the alert is recovered.
+Each connector supports a specific set of actions for each action group.
+For example:
 
-Each action uses a connector, which provides connection information for a {kib} service or third party integration, depending on where you want to send the notifications.
+[role="screenshot"]
+image::user/alerting/images/rule-types-index-threshold-example-action.png[UI for defining an action for each alert]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
-After you choose a connector, you must choose an action group, which affects when the action runs.
-The valid action groups for an index threshold rule are: `Threshold met` and `Recovered`.
-Each connector supports a specific set of actions for each action group. For more details, refer to <<action-types>>.
+You can further refine the conditions under which actions run by specifying that actions only run they match a KQL query or when an alert occurs within a specific time frame.
 
 [float]
 [[action-variables-index-threshold]]
@@ -118,8 +144,6 @@ For example, add an action that uses a server log connector to write an entry to
 image::user/alerting/images/rule-types-index-threshold-example-action.png[Add an action to the rule]
 // NOTE: This is an autogenerated screenshot. Do not edit it directly.
 
-NOTE: The index threshold rule does not support alert summaries; therefore they do not appear in the action frequency options.
-
 The unique action variables that you can use in the notification are listed in <<action-variables-index-threshold>>. For more information, refer to <<defining-rules-actions-details>> and <<action-types>>.
 --
 
diff --git a/package.json b/package.json
index 5718ec17493f3..8947a3c3680b0 100644
--- a/package.json
+++ b/package.json
@@ -101,7 +101,7 @@
     "@elastic/charts": "60.0.0",
     "@elastic/datemath": "5.0.3",
     "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@8.9.1-canary.1",
-    "@elastic/ems-client": "8.4.0",
+    "@elastic/ems-client": "8.5.0",
     "@elastic/eui": "89.0.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/node-crypto": "1.2.1",
@@ -560,6 +560,7 @@
     "@kbn/object-versioning": "link:packages/kbn-object-versioning",
     "@kbn/observability-ai-assistant-plugin": "link:x-pack/plugins/observability_ai_assistant",
     "@kbn/observability-alert-details": "link:x-pack/packages/observability/alert_details",
+    "@kbn/observability-alerting-test-data": "link:x-pack/packages/observability/alerting_test_data",
     "@kbn/observability-fixtures-plugin": "link:x-pack/test/cases_api_integration/common/plugins/observability",
     "@kbn/observability-log-explorer-plugin": "link:x-pack/plugins/observability_log_explorer",
     "@kbn/observability-onboarding-plugin": "link:x-pack/plugins/observability_onboarding",
@@ -904,6 +905,7 @@
     "getopts": "^2.2.5",
     "getos": "^3.1.0",
     "globby": "^11.1.0",
+    "gpt-tokenizer": "^2.1.2",
     "handlebars": "4.7.7",
     "he": "^1.2.0",
     "history": "^4.9.0",
diff --git a/packages/cloud/deployment_details/deployment_details.tsx b/packages/cloud/deployment_details/deployment_details.tsx
index 278709f7b6d32..54d70866e91d0 100644
--- a/packages/cloud/deployment_details/deployment_details.tsx
+++ b/packages/cloud/deployment_details/deployment_details.tsx
@@ -25,8 +25,14 @@ const hasActiveModifierKey = (event: React.MouseEvent): boolean => {
 };
 
 export const DeploymentDetails = ({ closeModal }: { closeModal?: () => void }) => {
-  const { cloudId, elasticsearchUrl, managementUrl, learnMoreUrl, navigateToUrl } =
-    useDeploymentDetails();
+  const {
+    cloudId,
+    elasticsearchUrl,
+    managementUrl,
+    apiKeysLearnMoreUrl,
+    cloudIdLearnMoreUrl,
+    navigateToUrl,
+  } = useDeploymentDetails();
   const isInsideModal = !!closeModal;
 
   if (!cloudId) {
@@ -39,7 +45,7 @@ export const DeploymentDetails = ({ closeModal }: { closeModal?: () => void }) =
       {elasticsearchUrl && <DeploymentDetailsEsInput elasticsearchUrl={elasticsearchUrl} />}
 
       {/* Cloud ID */}
-      <DeploymentDetailsCloudIdInput cloudId={cloudId} />
+      <DeploymentDetailsCloudIdInput cloudId={cloudId} learnMoreUrl={cloudIdLearnMoreUrl} />
 
       <EuiSpacer size="m" />
 
@@ -67,7 +73,7 @@ export const DeploymentDetails = ({ closeModal }: { closeModal?: () => void }) =
           </EuiFlexItem>
           {!isInsideModal && (
             <EuiFlexItem grow={false}>
-              <EuiLink external href={learnMoreUrl} target="_blank">
+              <EuiLink external href={apiKeysLearnMoreUrl} target="_blank">
                 {i18n.translate('cloud.deploymentDetails.learnMoreButtonLabel', {
                   defaultMessage: 'Learn more',
                 })}
diff --git a/packages/cloud/deployment_details/deployment_details_cloudid_input.tsx b/packages/cloud/deployment_details/deployment_details_cloudid_input.tsx
index a749fe4371715..802e11aa05fcf 100644
--- a/packages/cloud/deployment_details/deployment_details_cloudid_input.tsx
+++ b/packages/cloud/deployment_details/deployment_details_cloudid_input.tsx
@@ -5,7 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-import React, { type FC } from 'react';
+import React, { useState, type FC } from 'react';
 import {
   EuiFormRow,
   EuiFieldText,
@@ -13,17 +13,68 @@ import {
   EuiButtonIcon,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiText,
+  EuiLink,
+  EuiPopover,
 } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
 
-export const DeploymentDetailsCloudIdInput: FC<{ cloudId: string }> = ({ cloudId }) => {
+const LearnMoreLink: FC<{ learnMoreUrl: string }> = ({ learnMoreUrl }) => (
+  <EuiLink href={learnMoreUrl}>
+    {i18n.translate('cloud.deploymentDetails.cloudIDLabelToolip.learnMoreLink', {
+      defaultMessage: 'Learn more',
+    })}
+  </EuiLink>
+);
+
+const Label: FC<{ learnMoreUrl: string }> = ({ learnMoreUrl }) => {
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+
+  return (
+    <EuiFlexGroup css={{ minWidth: '200px' }} alignItems="center" gutterSize="xs">
+      <EuiFlexItem grow={false}>
+        <EuiText size="xs" css={{ fontWeight: 600 }}>
+          {i18n.translate('cloud.deploymentDetails.cloudIDLabel', {
+            defaultMessage: 'Cloud ID',
+          })}
+        </EuiText>
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <EuiPopover
+          button={
+            <EuiButtonIcon
+              iconType="questionInCircle"
+              onClick={() => {
+                setIsPopoverOpen(true);
+              }}
+            />
+          }
+          isOpen={isPopoverOpen}
+          closePopover={() => {
+            setIsPopoverOpen(false);
+          }}
+          anchorPosition="upCenter"
+        >
+          <p style={{ width: 270 }}>
+            <FormattedMessage
+              id="cloud.deploymentDetails.cloudIDLabelToolip"
+              defaultMessage="Get started with Elastic Agent or Logstash quickly. The Cloud ID simplifies sending data to Elastic. {link}"
+              values={{ link: <LearnMoreLink learnMoreUrl={learnMoreUrl} /> }}
+            />
+          </p>
+        </EuiPopover>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+export const DeploymentDetailsCloudIdInput: FC<{ cloudId: string; learnMoreUrl: string }> = ({
+  cloudId,
+  learnMoreUrl,
+}) => {
   return (
-    <EuiFormRow
-      label={i18n.translate('cloud.deploymentDetails.cloudIDLabel', {
-        defaultMessage: 'Cloud ID',
-      })}
-      fullWidth
-    >
+    <EuiFormRow label={<Label learnMoreUrl={learnMoreUrl} />} fullWidth>
       <EuiFlexGroup gutterSize="s">
         <EuiFlexItem>
           <EuiFieldText
diff --git a/packages/cloud/deployment_details/deployment_details_es_input.tsx b/packages/cloud/deployment_details/deployment_details_es_input.tsx
index 2998b5bade543..862cc0f6faf9a 100644
--- a/packages/cloud/deployment_details/deployment_details_es_input.tsx
+++ b/packages/cloud/deployment_details/deployment_details_es_input.tsx
@@ -22,7 +22,7 @@ export const DeploymentDetailsEsInput: FC<{ elasticsearchUrl: string }> = ({
   return (
     <EuiFormRow
       label={i18n.translate('cloud.deploymentDetails.elasticEndpointLabel', {
-        defaultMessage: 'Elastic endpoint',
+        defaultMessage: 'Elasticsearch endpoint',
       })}
       fullWidth
     >
diff --git a/packages/cloud/deployment_details/deployment_details_modal.tsx b/packages/cloud/deployment_details/deployment_details_modal.tsx
index 2f3d628c2ca47..c715b2d830c85 100644
--- a/packages/cloud/deployment_details/deployment_details_modal.tsx
+++ b/packages/cloud/deployment_details/deployment_details_modal.tsx
@@ -26,7 +26,7 @@ interface Props {
 }
 
 export const DeploymentDetailsModal: FC<Props> = ({ closeModal }) => {
-  const { learnMoreUrl } = useDeploymentDetails();
+  const { apiKeysLearnMoreUrl } = useDeploymentDetails();
 
   return (
     <EuiModal
@@ -49,7 +49,7 @@ export const DeploymentDetailsModal: FC<Props> = ({ closeModal }) => {
       <EuiModalFooter>
         <EuiFlexGroup alignItems="baseline" justifyContent="flexEnd">
           <EuiFlexItem grow={false}>
-            <EuiLink external href={learnMoreUrl} target="_blank">
+            <EuiLink external href={apiKeysLearnMoreUrl} target="_blank">
               {i18n.translate('cloud.deploymentDetails.modal.learnMoreButtonLabel', {
                 defaultMessage: 'Learn more',
               })}
diff --git a/packages/cloud/deployment_details/services.tsx b/packages/cloud/deployment_details/services.tsx
index c4e8be12bb547..f25575cf8b01d 100644
--- a/packages/cloud/deployment_details/services.tsx
+++ b/packages/cloud/deployment_details/services.tsx
@@ -12,7 +12,8 @@ export interface DeploymentDetailsContextValue {
   cloudId?: string;
   elasticsearchUrl?: string;
   managementUrl?: string;
-  learnMoreUrl: string;
+  apiKeysLearnMoreUrl: string;
+  cloudIdLearnMoreUrl: string;
   navigateToUrl(url: string): Promise<void>;
 }
 
@@ -64,6 +65,9 @@ export interface DeploymentDetailsKibanaDependencies {
       fleet: {
         apiKeysLearnMore: string;
       };
+      cloud: {
+        beatsAndLogstashConfiguration: string;
+      };
     };
   };
 }
@@ -86,6 +90,7 @@ export const DeploymentDetailsKibanaProvider: FC<DeploymentDetailsKibanaDependen
     docLinks: {
       links: {
         fleet: { apiKeysLearnMore },
+        cloud: { beatsAndLogstashConfiguration },
       },
     },
   } = services;
@@ -99,7 +104,8 @@ export const DeploymentDetailsKibanaProvider: FC<DeploymentDetailsKibanaDependen
       cloudId={isCloudEnabled ? cloudId : undefined}
       elasticsearchUrl={elasticsearchUrl}
       managementUrl={managementUrl}
-      learnMoreUrl={apiKeysLearnMore}
+      apiKeysLearnMoreUrl={apiKeysLearnMore}
+      cloudIdLearnMoreUrl={beatsAndLogstashConfiguration}
       navigateToUrl={navigateToUrl}
     >
       {children}
diff --git a/packages/cloud/tsconfig.json b/packages/cloud/tsconfig.json
index c4703bc51cf6c..f56351356720a 100644
--- a/packages/cloud/tsconfig.json
+++ b/packages/cloud/tsconfig.json
@@ -17,5 +17,6 @@
   ],
   "kbn_references": [
     "@kbn/i18n",
+    "@kbn/i18n-react",
   ]
 }
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/chrome_service.tsx b/packages/core/chrome/core-chrome-browser-internal/src/chrome_service.tsx
index bf44390d13294..7cd8cec951a3e 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/chrome_service.tsx
+++ b/packages/core/chrome/core-chrome-browser-internal/src/chrome_service.tsx
@@ -80,6 +80,7 @@ export class ChromeService {
   private readonly docTitle = new DocTitleService();
   private readonly projectNavigation = new ProjectNavigationService();
   private mutationObserver: MutationObserver | undefined;
+  private readonly isSideNavCollapsed$ = new BehaviorSubject<boolean>(true);
 
   constructor(private readonly params: ConstructorParams) {}
 
@@ -386,6 +387,9 @@ export class ChromeService {
                 docLinks={docLinks}
                 kibanaVersion={injectedMetadata.getKibanaVersion()}
                 prependBasePath={http.basePath.prepend}
+                toggleSideNav={(isCollapsed) => {
+                  this.isSideNavCollapsed$.next(isCollapsed);
+                }}
               >
                 <SideNavComponent activeNodes={activeNodes} />
               </ProjectHeader>
@@ -508,6 +512,7 @@ export class ChromeService {
       getBodyClasses$: () => bodyClasses$.pipe(takeUntil(this.stop$)),
       setChromeStyle,
       getChromeStyle$: () => chromeStyle$.pipe(takeUntil(this.stop$)),
+      getIsSideNavCollapsed$: () => this.isSideNavCollapsed$.asObservable(),
       project: {
         setHome: setProjectHome,
         setProjectsUrl,
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/ui/project/app_menu.tsx b/packages/core/chrome/core-chrome-browser-internal/src/ui/project/app_menu.tsx
index 0c0e4dbdf9167..5c939752250ae 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/ui/project/app_menu.tsx
+++ b/packages/core/chrome/core-chrome-browser-internal/src/ui/project/app_menu.tsx
@@ -17,13 +17,17 @@ interface AppMenuBarProps {
 }
 export const AppMenuBar = ({ headerActionMenuMounter }: AppMenuBarProps) => {
   const { euiTheme } = useEuiTheme();
+  const zIndex =
+    typeof euiTheme.levels.header === 'number'
+      ? euiTheme.levels.header - 1 // We want it to appear right below the header
+      : euiTheme.levels.header;
 
   return (
     <div
       className="header__actionMenu"
       data-test-subj="kibanaProjectHeaderActionMenu"
       css={css`
-        z-index: ${euiTheme.levels.header};
+        z-index: ${zIndex};
         background: ${euiTheme.colors.emptyShade};
         border-bottom: ${euiTheme.border.thin};
         display: flex;
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/ui/project/header.test.tsx b/packages/core/chrome/core-chrome-browser-internal/src/ui/project/header.test.tsx
index d4886d8180c47..703d1f0b5de5f 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/ui/project/header.test.tsx
+++ b/packages/core/chrome/core-chrome-browser-internal/src/ui/project/header.test.tsx
@@ -36,6 +36,7 @@ describe('Header', () => {
     navControlsCenter$: Rx.of([]),
     navControlsRight$: Rx.of([]),
     prependBasePath: (str) => `hello/world/${str}`,
+    toggleSideNav: jest.fn(),
   };
 
   it('renders', async () => {
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/ui/project/header.tsx b/packages/core/chrome/core-chrome-browser-internal/src/ui/project/header.tsx
index 8767c1f9c53f7..7ac11ecb5bc54 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/ui/project/header.tsx
+++ b/packages/core/chrome/core-chrome-browser-internal/src/ui/project/header.tsx
@@ -110,6 +110,7 @@ export interface Props {
   navControlsCenter$: Observable<ChromeNavControl[]>;
   navControlsRight$: Observable<ChromeNavControl[]>;
   prependBasePath: (url: string) => string;
+  toggleSideNav: (isCollapsed: boolean) => void;
 }
 
 const LOADING_DEBOUNCE_TIME = 80;
@@ -172,6 +173,7 @@ export const ProjectHeader = ({
   children,
   prependBasePath,
   docLinks,
+  toggleSideNav,
   ...observables
 }: Props) => {
   const headerActionMenuMounter = useHeaderActionMenuMounter(observables.actionMenu$);
@@ -196,7 +198,7 @@ export const ProjectHeader = ({
           <EuiHeader position="fixed" className="header__firstBar">
             <EuiHeaderSection grow={false}>
               <Router history={application.history}>
-                <ProjectNavigation>{children}</ProjectNavigation>
+                <ProjectNavigation toggleSideNav={toggleSideNav}>{children}</ProjectNavigation>
               </Router>
 
               <EuiHeaderSectionItem>
diff --git a/packages/core/chrome/core-chrome-browser-internal/src/ui/project/navigation.tsx b/packages/core/chrome/core-chrome-browser-internal/src/ui/project/navigation.tsx
index adc6b3f28c2e5..b8eea90c71c23 100644
--- a/packages/core/chrome/core-chrome-browser-internal/src/ui/project/navigation.tsx
+++ b/packages/core/chrome/core-chrome-browser-internal/src/ui/project/navigation.tsx
@@ -6,24 +6,39 @@
  * Side Public License, v 1.
  */
 
+import React, { useEffect, useRef } from 'react';
 import { EuiCollapsibleNavBeta } from '@elastic/eui';
-import React from 'react';
 import useLocalStorage from 'react-use/lib/useLocalStorage';
 
 const LOCAL_STORAGE_IS_COLLAPSED_KEY = 'PROJECT_NAVIGATION_COLLAPSED' as const;
 
-export const ProjectNavigation: React.FC = ({ children }) => {
+export const ProjectNavigation: React.FC<{
+  toggleSideNav: (isVisible: boolean) => void;
+}> = ({ children, toggleSideNav }) => {
+  const isMounted = useRef(false);
   const [isCollapsed, setIsCollapsed] = useLocalStorage(LOCAL_STORAGE_IS_COLLAPSED_KEY, false);
   const onCollapseToggle = (nextIsCollapsed: boolean) => {
     setIsCollapsed(nextIsCollapsed);
+    toggleSideNav(nextIsCollapsed);
   };
 
+  useEffect(() => {
+    if (!isMounted.current && isCollapsed !== undefined) {
+      toggleSideNav(isCollapsed);
+    }
+    isMounted.current = true;
+  }, [isCollapsed, toggleSideNav]);
+
   return (
     <EuiCollapsibleNavBeta
       data-test-subj="projectLayoutSideNav"
       initialIsCollapsed={isCollapsed}
       onCollapseToggle={onCollapseToggle}
-      css={isCollapsed ? { display: 'none;' } : {}}
+      css={
+        isCollapsed
+          ? { display: 'none;' }
+          : { overflow: 'visible', clipPath: 'polygon(0 0, 300% 0, 300% 100%, 0 100%)' }
+      }
     >
       {children}
     </EuiCollapsibleNavBeta>
diff --git a/packages/core/chrome/core-chrome-browser-mocks/src/chrome_service.mock.ts b/packages/core/chrome/core-chrome-browser-mocks/src/chrome_service.mock.ts
index 225263674e595..d6a7a2e065945 100644
--- a/packages/core/chrome/core-chrome-browser-mocks/src/chrome_service.mock.ts
+++ b/packages/core/chrome/core-chrome-browser-mocks/src/chrome_service.mock.ts
@@ -50,6 +50,7 @@ const createStartContractMock = () => {
     setBadge: jest.fn(),
     getBreadcrumbs$: jest.fn(),
     setBreadcrumbs: jest.fn(),
+    getIsSideNavCollapsed$: jest.fn(),
     getBreadcrumbsAppendExtension$: jest.fn(),
     setBreadcrumbsAppendExtension: jest.fn(),
     getGlobalHelpExtensionMenuLinks$: jest.fn(),
diff --git a/packages/core/chrome/core-chrome-browser/index.ts b/packages/core/chrome/core-chrome-browser/index.ts
index 2e587cbcda497..207864f16a844 100644
--- a/packages/core/chrome/core-chrome-browser/index.ts
+++ b/packages/core/chrome/core-chrome-browser/index.ts
@@ -37,8 +37,10 @@ export type {
   CloudLinkId,
   SideNavCompProps,
   SideNavComponent,
+  SideNavNodeStatus,
   ChromeProjectBreadcrumb,
   ChromeSetProjectBreadcrumbsParams,
   NodeDefinition,
   NodeDefinitionWithChildren,
+  NodeRenderAs,
 } from './src';
diff --git a/packages/core/chrome/core-chrome-browser/src/contracts.ts b/packages/core/chrome/core-chrome-browser/src/contracts.ts
index c9893ed3863ce..328c0142df9cc 100644
--- a/packages/core/chrome/core-chrome-browser/src/contracts.ts
+++ b/packages/core/chrome/core-chrome-browser/src/contracts.ts
@@ -171,4 +171,9 @@ export interface ChromeStart {
    * Get an observable of the current style type of the chrome.
    */
   getChromeStyle$(): Observable<ChromeStyle>;
+
+  /**
+   * Get an observable of the current collapsed state of the side nav.
+   */
+  getIsSideNavCollapsed$(): Observable<boolean>;
 }
diff --git a/packages/core/chrome/core-chrome-browser/src/index.ts b/packages/core/chrome/core-chrome-browser/src/index.ts
index b931f05ecd327..6c9a68dc75018 100644
--- a/packages/core/chrome/core-chrome-browser/src/index.ts
+++ b/packages/core/chrome/core-chrome-browser/src/index.ts
@@ -36,8 +36,10 @@ export type {
   CloudLinkId,
   SideNavCompProps,
   SideNavComponent,
+  SideNavNodeStatus,
   ChromeSetProjectBreadcrumbsParams,
   ChromeProjectBreadcrumb,
   NodeDefinition,
   NodeDefinitionWithChildren,
+  RenderAs as NodeRenderAs,
 } from './project_navigation';
diff --git a/packages/core/chrome/core-chrome-browser/src/project_navigation.ts b/packages/core/chrome/core-chrome-browser/src/project_navigation.ts
index 2d35272e43679..601e7391f4a0f 100644
--- a/packages/core/chrome/core-chrome-browser/src/project_navigation.ts
+++ b/packages/core/chrome/core-chrome-browser/src/project_navigation.ts
@@ -8,7 +8,7 @@
 
 import type { ComponentType } from 'react';
 import type { Location } from 'history';
-import { EuiAccordionProps } from '@elastic/eui';
+import { EuiAccordionProps, IconType } from '@elastic/eui';
 import type { AppId as DevToolsApp, DeepLinkId as DevToolsLink } from '@kbn/deeplinks-devtools';
 import type {
   AppId as AnalyticsApp,
@@ -49,6 +49,10 @@ export type AppDeepLinkId =
 /** @public */
 export type CloudLinkId = 'userAndRoles' | 'performance' | 'billingAndSub' | 'deployment';
 
+export type SideNavNodeStatus = 'hidden' | 'visible';
+
+export type RenderAs = 'block' | 'accordion' | 'panelOpener' | 'item';
+
 export type GetIsActiveFn = (params: {
   /** The current path name including the basePath + hash value but **without** any query params */
   pathNameSerialized: string;
@@ -58,8 +62,99 @@ export type GetIsActiveFn = (params: {
   prepend: (path: string) => string;
 }) => boolean;
 
+/**
+ * Base definition of navigation nodes. A node can either be a "group" or an "item".
+ * Each have commmon properties and specific properties.
+ */
+interface NodeDefinitionBase {
+  /**
+   * Optional icon for the navigation node. Note: not all navigation depth will render the icon
+   */
+  icon?: IconType;
+  /**
+   * href for absolute links only. Internal links should use "link".
+   */
+  href?: string;
+  /**
+   * Optional status to indicate if the breadcrumb should be hidden when this node is active.
+   * @default 'visible'
+   */
+  breadcrumbStatus?: 'hidden' | 'visible';
+  /**
+   * Optional status to for the side navigation. "hidden" and "visible" are self explanatory.
+   * The `renderAsItem` status is _only_ for group nodes (nodes with children declared or with
+   * the "nodeType" set to `group`) and allow to render the node as an "item" instead of the head of
+   * a group. This is usefull to have sub-pages declared in the tree that will correctly be mapped
+   * in the Breadcrumbs, but are not rendered in the side navigation.
+   * @default 'visible'
+   */
+  sideNavStatus?: SideNavNodeStatus;
+  /**
+   * Optional function to get the active state. This function is called whenever the location changes.
+   */
+  getIsActive?: GetIsActiveFn;
+  /**
+   * ----------------------------------------------------------------------------------------------
+   * ------------------------------- GROUP NODES ONLY PROPS ---------------------------------------
+   * ----------------------------------------------------------------------------------------------
+   */
+  /**
+   * ["group" nodes only] Optional flag to indicate if the node must be treated as a group title.
+   * Can not be used with `children`
+   */
+  isGroupTitle?: boolean;
+  /**
+   * ["group" nodes only] Property to indicate how the group should be rendered.
+   * - Accordion: wraps the items in an EuiAccordion
+   * - PanelOpener: renders a button to open a panel on the right of the side nav
+   * - item: renders the group as an item in the side nav
+   * @default 'block'
+   */
+  renderAs?: RenderAs;
+  /**
+   * ["group" nodes only] Optional flag to indicate if a horizontal rule should be rendered after the node.
+   * Note: this property is currently only used for (1) "group" nodes and (2) in the navigation
+   * panel opening on the right of the side nav.
+   */
+  appendHorizontalRule?: boolean;
+  /**
+   * ["group" nodes only] Temp prop. Will be removed once the new navigation is fully implemented.
+   */
+  accordionProps?: Partial<EuiAccordionProps>;
+  /**
+   * ----------------------------------------------------------------------------------------------
+   * -------------------------------- ITEM NODES ONLY PROPS ---------------------------------------
+   * ----------------------------------------------------------------------------------------------
+   */
+  /**
+   * ["item" nodes only] Optional flag to indicate if the target page should be opened in a new Browser tab.
+   * Note: this property is currently only used in the navigation panel opening on the right of the side nav.
+   */
+  openInNewTab?: boolean;
+  /**
+   * ["item" nodes only] Optional flag to indicate if a badge should be rendered next to the text.
+   * Note: this property is currently only used in the navigation panel opening on the right of the side nav.
+   */
+  withBadge?: boolean;
+  /**
+   * ["item" nodes only] If `withBadge` is true, this object can be used to customize the badge.
+   */
+  badgeOptions?: {
+    /** The text of the badge. Default: "Beta" */
+    text?: string;
+  };
+}
+
 /** @public */
-export interface ChromeProjectNavigationNode {
+/**
+ * Chrome project navigation node. This is the tree definition stored in the Chrome service
+ * that is generated based on the NodeDefinition below.
+ * Some of the process that occurs between the 2 are:
+ * - "link" prop get converted to existing ChromNavLink
+ * - "path" is added to each node based on where it is located in the tree
+ * - "isActive" state is set for each node if its URL matches the current location
+ */
+export interface ChromeProjectNavigationNode extends NodeDefinitionBase {
   /** Optional id, if not passed a "link" must be provided. */
   id: string;
   /** Optional title. If not provided and a "link" is provided the title will be the Deep link title */
@@ -68,32 +163,15 @@ export interface ChromeProjectNavigationNode {
   path: string[];
   /** App id or deeplink id */
   deepLink?: ChromeNavLink;
-  /** Optional icon for the navigation node. Note: not all navigation depth will render the icon */
-  icon?: string;
-  /** Optional flag to indicate if the node must be treated as a group title */
-  isGroupTitle?: boolean;
-  /** Optional children of the navigation node */
-  children?: ChromeProjectNavigationNode[];
   /**
-   * href for absolute links only. Internal links should use "link".
+   * Optional children of the navigation node. Once a node has "children" defined it is
+   * considered a "group" node.
    */
-  href?: string;
+  children?: ChromeProjectNavigationNode[];
   /**
    * Flag to indicate if the node is currently active.
    */
   isActive?: boolean;
-  /**
-   * Optional function to get the active state. This function is called whenever the location changes.
-   */
-  getIsActive?: GetIsActiveFn;
-
-  /**
-   * Optional flag to indicate if the breadcrumb should be hidden when this node is active.
-   * @default 'visible'
-   */
-  breadcrumbStatus?: 'hidden' | 'visible';
-
-  accordionProps?: Partial<EuiAccordionProps>;
 }
 
 /** @public */
@@ -120,7 +198,8 @@ export interface ChromeSetProjectBreadcrumbsParams {
   absolute: boolean;
 }
 
-type NonEmptyArray<T> = [T, ...T[]];
+// --- NOTE: The following types are the ones that the consumer uses to configure their navigation.
+// ---       They are converted to the ChromeProjectNavigationNode type above.
 
 /**
  * @public
@@ -134,7 +213,7 @@ export interface NodeDefinition<
   LinkId extends AppDeepLinkId = AppDeepLinkId,
   Id extends string = string,
   ChildrenId extends string = Id
-> {
+> extends NodeDefinitionBase {
   /** Optional id, if not passed a "link" must be provided. */
   id?: Id;
   /** Optional title. If not provided and a "link" is provided the title will be the Deep link title */
@@ -143,31 +222,8 @@ export interface NodeDefinition<
   link?: LinkId;
   /** Cloud link id */
   cloudLink?: CloudLinkId;
-  /** Optional icon for the navigation node. Note: not all navigation depth will render the icon */
-  icon?: string;
-  /**
-   * Optional flag to indicate if the node must be treated as a group title.
-   * Can not be used with `children`
-   */
-  isGroupTitle?: boolean;
   /** Optional children of the navigation node. Can not be used with `isGroupTitle` */
-  children?: NonEmptyArray<NodeDefinition<LinkId, Id, ChildrenId>>;
-  /**
-   * Use href for absolute links only. Internal links should use "link".
-   */
-  href?: string;
-  /**
-   * Optional function to get the active state. This function is called whenever the location changes.
-   */
-  getIsActive?: GetIsActiveFn;
-
-  /**
-   * Optional flag to indicate if the breadcrumb should be hidden when this node is active.
-   * @default 'visible'
-   */
-  breadcrumbStatus?: 'hidden' | 'visible';
-
-  accordionProps?: Partial<EuiAccordionProps>;
+  children?: Array<NodeDefinition<LinkId, Id, ChildrenId>>;
 }
 
 /**
diff --git a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/update.ts b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/update.ts
index e119d6e6303db..fd9c587502d7b 100644
--- a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/update.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/update.ts
@@ -83,7 +83,7 @@ export const executeUpdate = async <T>(
     validation: validationHelper,
   } = helpers;
   const { securityExtension } = extensions;
-
+  const typeDefinition = registry.getType(type)!;
   const {
     version,
     references,
@@ -246,10 +246,18 @@ export const executeUpdate = async <T>(
     // at this point, we already know 1. the document exists 2. we're not doing an upsert
     // therefor we can safely process with the "standard" update sequence.
 
-    const updatedAttributes = mergeForUpdate(
-      { ...migrated!.attributes },
-      await encryptionHelper.optionallyEncryptAttributes(type, id, namespace, attributes)
-    );
+    const updatedAttributes = mergeForUpdate({
+      targetAttributes: {
+        ...migrated!.attributes,
+      },
+      updatedAttributes: await encryptionHelper.optionallyEncryptAttributes(
+        type,
+        id,
+        namespace,
+        attributes
+      ),
+      typeMappings: typeDefinition.mappings,
+    });
     const migratedUpdatedSavedObjectDoc = migrationHelper.migrateInputDocument({
       ...migrated!,
       id,
diff --git a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/utils/merge_for_update.test.ts b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/utils/merge_for_update.test.ts
index 7d859f374a5e2..b7a31cb68d9d3 100644
--- a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/utils/merge_for_update.test.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/utils/merge_for_update.test.ts
@@ -6,11 +6,22 @@
  * Side Public License, v 1.
  */
 
+import type { SavedObjectsTypeMappingDefinition } from '@kbn/core-saved-objects-server';
 import { mergeForUpdate } from './merge_for_update';
 
+const defaultMappings: SavedObjectsTypeMappingDefinition = {
+  properties: {},
+};
+
 describe('mergeForUpdate', () => {
   it('merges top level properties', () => {
-    expect(mergeForUpdate({ foo: 'bar', hello: 'dolly' }, { baz: 42 })).toEqual({
+    expect(
+      mergeForUpdate({
+        targetAttributes: { foo: 'bar', hello: 'dolly' },
+        updatedAttributes: { baz: 42 },
+        typeMappings: defaultMappings,
+      })
+    ).toEqual({
       foo: 'bar',
       hello: 'dolly',
       baz: 42,
@@ -18,7 +29,13 @@ describe('mergeForUpdate', () => {
   });
 
   it('overrides top level properties', () => {
-    expect(mergeForUpdate({ foo: 'bar', hello: 'dolly' }, { baz: 42, foo: '9000' })).toEqual({
+    expect(
+      mergeForUpdate({
+        targetAttributes: { foo: 'bar', hello: 'dolly' },
+        updatedAttributes: { baz: 42, foo: '9000' },
+        typeMappings: defaultMappings,
+      })
+    ).toEqual({
       foo: '9000',
       hello: 'dolly',
       baz: 42,
@@ -26,7 +43,13 @@ describe('mergeForUpdate', () => {
   });
 
   it('ignores undefined top level properties', () => {
-    expect(mergeForUpdate({ foo: 'bar', hello: 'dolly' }, { baz: 42, foo: undefined })).toEqual({
+    expect(
+      mergeForUpdate({
+        targetAttributes: { foo: 'bar', hello: 'dolly' },
+        updatedAttributes: { baz: 42, foo: undefined },
+        typeMappings: defaultMappings,
+      })
+    ).toEqual({
       foo: 'bar',
       hello: 'dolly',
       baz: 42,
@@ -35,7 +58,11 @@ describe('mergeForUpdate', () => {
 
   it('merges nested properties', () => {
     expect(
-      mergeForUpdate({ nested: { foo: 'bar', hello: 'dolly' } }, { nested: { baz: 42 } })
+      mergeForUpdate({
+        targetAttributes: { nested: { foo: 'bar', hello: 'dolly' } },
+        updatedAttributes: { nested: { baz: 42 } },
+        typeMappings: defaultMappings,
+      })
     ).toEqual({
       nested: {
         foo: 'bar',
@@ -47,10 +74,11 @@ describe('mergeForUpdate', () => {
 
   it('overrides nested properties', () => {
     expect(
-      mergeForUpdate(
-        { nested: { foo: 'bar', hello: 'dolly' } },
-        { nested: { baz: 42, foo: '9000' } }
-      )
+      mergeForUpdate({
+        targetAttributes: { nested: { foo: 'bar', hello: 'dolly' } },
+        updatedAttributes: { nested: { baz: 42, foo: '9000' } },
+        typeMappings: defaultMappings,
+      })
     ).toEqual({
       nested: {
         foo: '9000',
@@ -62,10 +90,11 @@ describe('mergeForUpdate', () => {
 
   it('ignores undefined nested properties', () => {
     expect(
-      mergeForUpdate(
-        { nested: { foo: 'bar', hello: 'dolly' } },
-        { nested: { baz: 42, foo: undefined } }
-      )
+      mergeForUpdate({
+        targetAttributes: { nested: { foo: 'bar', hello: 'dolly' } },
+        updatedAttributes: { nested: { baz: 42, foo: undefined } },
+        typeMappings: defaultMappings,
+      })
     ).toEqual({
       nested: {
         foo: 'bar',
@@ -77,10 +106,17 @@ describe('mergeForUpdate', () => {
 
   it('functions with mixed levels of properties', () => {
     expect(
-      mergeForUpdate(
-        { rootPropA: 'A', nested: { foo: 'bar', hello: 'dolly', deep: { deeper: 'we need' } } },
-        { rootPropB: 'B', nested: { baz: 42, foo: '9000', deep: { deeper: 'we are' } } }
-      )
+      mergeForUpdate({
+        targetAttributes: {
+          rootPropA: 'A',
+          nested: { foo: 'bar', hello: 'dolly', deep: { deeper: 'we need' } },
+        },
+        updatedAttributes: {
+          rootPropB: 'B',
+          nested: { baz: 42, foo: '9000', deep: { deeper: 'we are' } },
+        },
+        typeMappings: defaultMappings,
+      })
     ).toEqual({
       rootPropA: 'A',
       rootPropB: 'B',
@@ -94,4 +130,45 @@ describe('mergeForUpdate', () => {
       },
     });
   });
+
+  describe('with flattened fields', () => {
+    const mappingsWithFlattened: SavedObjectsTypeMappingDefinition = {
+      properties: {
+        flattened: {
+          type: 'flattened',
+        },
+        nested: {
+          properties: {
+            deepFlat: {
+              type: 'flattened',
+            },
+          },
+        },
+      },
+    };
+
+    it('replaces top level flattened properties', () => {
+      expect(
+        mergeForUpdate({
+          targetAttributes: { flattened: { before: 42 }, notFlattened: { before: 42 } },
+          updatedAttributes: { flattened: { after: 9000 }, notFlattened: { after: 9000 } },
+          typeMappings: mappingsWithFlattened,
+        })
+      ).toEqual({ flattened: { after: 9000 }, notFlattened: { before: 42, after: 9000 } });
+    });
+
+    it('replaces nested flattened properties', () => {
+      expect(
+        mergeForUpdate({
+          targetAttributes: { nested: { deepFlat: { before: 42 }, notFlattened: { before: 42 } } },
+          updatedAttributes: {
+            nested: { deepFlat: { after: 9000 }, notFlattened: { after: 9000 } },
+          },
+          typeMappings: mappingsWithFlattened,
+        })
+      ).toEqual({
+        nested: { deepFlat: { after: 9000 }, notFlattened: { before: 42, after: 9000 } },
+      });
+    });
+  });
 });
diff --git a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/utils/merge_for_update.ts b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/utils/merge_for_update.ts
index a3ad081fa74d7..c0c7feaa9e90c 100644
--- a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/utils/merge_for_update.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/apis/utils/merge_for_update.ts
@@ -8,18 +8,38 @@
 
 import { isPlainObject } from 'lodash';
 import { set } from '@kbn/safer-lodash-set';
+import type { MappingProperty as EsMappingProperty } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import type {
+  SavedObjectsTypeMappingDefinition,
+  SavedObjectsFieldMapping,
+} from '@kbn/core-saved-objects-server';
 
-export const mergeForUpdate = (
-  targetAttributes: Record<string, any>,
-  updatedAttributes: any
-): Record<string, any> => {
-  return recursiveMerge(targetAttributes, updatedAttributes, []);
+type MaybeMappings = SavedObjectsFieldMapping | EsMappingProperty | undefined;
+
+export const mergeForUpdate = ({
+  targetAttributes,
+  updatedAttributes,
+  typeMappings,
+}: {
+  targetAttributes: Record<string, any>;
+  updatedAttributes: any;
+  typeMappings: SavedObjectsTypeMappingDefinition;
+}): Record<string, any> => {
+  const rootMappings: SavedObjectsFieldMapping = {
+    properties: typeMappings.properties,
+  };
+  return recursiveMerge(targetAttributes, updatedAttributes, [], rootMappings);
 };
 
-const recursiveMerge = (target: Record<string, any>, value: any, keys: string[] = []) => {
-  if (isPlainObject(value) && Object.keys(value).length > 0) {
+const recursiveMerge = (
+  target: Record<string, any>,
+  value: any,
+  keys: string[],
+  mappings: MaybeMappings
+) => {
+  if (shouldRecursiveMerge(value, mappings)) {
     for (const [subKey, subVal] of Object.entries(value)) {
-      recursiveMerge(target, subVal, [...keys, subKey]);
+      recursiveMerge(target, subVal, [...keys, subKey], getFieldMapping(mappings, subKey));
     }
   } else if (keys.length > 0 && value !== undefined) {
     set(target, keys, value);
@@ -27,3 +47,20 @@ const recursiveMerge = (target: Record<string, any>, value: any, keys: string[]
 
   return target;
 };
+
+const getFieldMapping = (parentMapping: MaybeMappings, fieldName: string): MaybeMappings => {
+  if (parentMapping && 'properties' in parentMapping) {
+    return parentMapping.properties?.[fieldName];
+  }
+  return undefined;
+};
+
+const shouldRecursiveMerge = (value: any, mappings: MaybeMappings): boolean => {
+  if (mappings && 'type' in mappings && mappings.type === 'flattened') {
+    return false;
+  }
+  if (isPlainObject(value) && Object.keys(value).length > 0) {
+    return true;
+  }
+  return false;
+};
diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/create_schema_from_field_map.ts b/packages/kbn-alerts-as-data-utils/src/schemas/create_schema_from_field_map.ts
index b06bda3a36278..e2d45b876fb57 100644
--- a/packages/kbn-alerts-as-data-utils/src/schemas/create_schema_from_field_map.ts
+++ b/packages/kbn-alerts-as-data-utils/src/schemas/create_schema_from_field_map.ts
@@ -150,7 +150,7 @@ const generateSchemaLines = ({
         break;
       case 'object':
       case 'nested':
-        if (!isEnabled) {
+        if (!isEnabled || !isArray) {
           lineWriter.addLine(`${keyToWrite}: ${getSchemaDefinition('schemaUnknown', isArray)},`);
         } else if (isArray && null != fieldMap.properties) {
           lineWriter.addLineAndIndent(`${keyToWrite}: rt.array(`);
diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/generated/ecs_schema.ts b/packages/kbn-alerts-as-data-utils/src/schemas/generated/ecs_schema.ts
index 840fc2187321c..a3d3ef6f0a8a7 100644
--- a/packages/kbn-alerts-as-data-utils/src/schemas/generated/ecs_schema.ts
+++ b/packages/kbn-alerts-as-data-utils/src/schemas/generated/ecs_schema.ts
@@ -152,6 +152,7 @@ const EcsOptional = rt.partial({
   'container.image.hash.all': schemaStringArray,
   'container.image.name': schemaString,
   'container.image.tag': schemaStringArray,
+  'container.labels': schemaUnknown,
   'container.memory.usage': schemaStringOrNumber,
   'container.name': schemaString,
   'container.network.egress.bytes': schemaStringOrNumber,
@@ -307,6 +308,7 @@ const EcsOptional = rt.partial({
   'faas.execution': schemaString,
   'faas.id': schemaString,
   'faas.name': schemaString,
+  'faas.trigger': schemaUnknown,
   'faas.version': schemaString,
   'file.accessed': schemaDate,
   'file.attributes': schemaStringArray,
@@ -471,12 +473,14 @@ const EcsOptional = rt.partial({
   'http.response.mime_type': schemaString,
   'http.response.status_code': schemaStringOrNumber,
   'http.version': schemaString,
+  labels: schemaUnknown,
   'log.file.path': schemaString,
   'log.level': schemaString,
   'log.logger': schemaString,
   'log.origin.file.line': schemaStringOrNumber,
   'log.origin.file.name': schemaString,
   'log.origin.function': schemaString,
+  'log.syslog': schemaUnknown,
   message: schemaString,
   'network.application': schemaString,
   'network.bytes': schemaStringOrNumber,
@@ -484,6 +488,7 @@ const EcsOptional = rt.partial({
   'network.direction': schemaString,
   'network.forwarded_ip': schemaString,
   'network.iana_number': schemaString,
+  'network.inner': schemaUnknown,
   'network.name': schemaString,
   'network.packets': schemaStringOrNumber,
   'network.protocol': schemaString,
@@ -491,6 +496,7 @@ const EcsOptional = rt.partial({
   'network.type': schemaString,
   'network.vlan.id': schemaString,
   'network.vlan.name': schemaString,
+  'observer.egress': schemaUnknown,
   'observer.geo.city_name': schemaString,
   'observer.geo.continent_code': schemaString,
   'observer.geo.continent_name': schemaString,
@@ -503,6 +509,7 @@ const EcsOptional = rt.partial({
   'observer.geo.region_name': schemaString,
   'observer.geo.timezone': schemaString,
   'observer.hostname': schemaString,
+  'observer.ingress': schemaUnknown,
   'observer.ip': schemaStringArray,
   'observer.mac': schemaStringArray,
   'observer.name': schemaString,
@@ -628,6 +635,7 @@ const EcsOptional = rt.partial({
   'process.entry_leader.start': schemaDate,
   'process.entry_leader.supplemental_groups.id': schemaString,
   'process.entry_leader.supplemental_groups.name': schemaString,
+  'process.entry_leader.tty': schemaUnknown,
   'process.entry_leader.user.id': schemaString,
   'process.entry_leader.user.name': schemaString,
   'process.entry_leader.working_directory': schemaString,
@@ -656,6 +664,7 @@ const EcsOptional = rt.partial({
   'process.group_leader.start': schemaDate,
   'process.group_leader.supplemental_groups.id': schemaString,
   'process.group_leader.supplemental_groups.name': schemaString,
+  'process.group_leader.tty': schemaUnknown,
   'process.group_leader.user.id': schemaString,
   'process.group_leader.user.name': schemaString,
   'process.group_leader.working_directory': schemaString,
@@ -667,6 +676,7 @@ const EcsOptional = rt.partial({
   'process.hash.ssdeep': schemaString,
   'process.hash.tlsh': schemaString,
   'process.interactive': schemaBoolean,
+  'process.io': schemaUnknown,
   'process.name': schemaString,
   'process.parent.args': schemaStringArray,
   'process.parent.args_count': schemaStringOrNumber,
@@ -757,6 +767,7 @@ const EcsOptional = rt.partial({
   'process.parent.thread.id': schemaStringOrNumber,
   'process.parent.thread.name': schemaString,
   'process.parent.title': schemaString,
+  'process.parent.tty': schemaUnknown,
   'process.parent.uptime': schemaStringOrNumber,
   'process.parent.user.id': schemaString,
   'process.parent.user.name': schemaString,
@@ -810,6 +821,7 @@ const EcsOptional = rt.partial({
   'process.session_leader.start': schemaDate,
   'process.session_leader.supplemental_groups.id': schemaString,
   'process.session_leader.supplemental_groups.name': schemaString,
+  'process.session_leader.tty': schemaUnknown,
   'process.session_leader.user.id': schemaString,
   'process.session_leader.user.name': schemaString,
   'process.session_leader.working_directory': schemaString,
@@ -819,6 +831,7 @@ const EcsOptional = rt.partial({
   'process.thread.id': schemaStringOrNumber,
   'process.thread.name': schemaString,
   'process.title': schemaString,
+  'process.tty': schemaUnknown,
   'process.uptime': schemaStringOrNumber,
   'process.user.id': schemaString,
   'process.user.name': schemaString,
@@ -951,6 +964,7 @@ const EcsOptional = rt.partial({
   tags: schemaStringArray,
   'threat.enrichments': rt.array(
     rt.partial({
+      indicator: schemaUnknown,
       'matched.atomic': schemaString,
       'matched.field': schemaString,
       'matched.id': schemaString,
diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_apm_schema.ts b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_apm_schema.ts
index b15fe189b7e25..41431d4581aa9 100644
--- a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_apm_schema.ts
+++ b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_apm_schema.ts
@@ -73,6 +73,7 @@ const ObservabilityApmAlertOptional = rt.partial({
   'agent.name': schemaString,
   'error.grouping_key': schemaString,
   'error.grouping_name': schemaString,
+  'kibana.alert.context': schemaUnknown,
   'kibana.alert.evaluation.threshold': schemaStringOrNumber,
   'kibana.alert.evaluation.value': schemaStringOrNumber,
   'kibana.alert.evaluation.values': schemaStringOrNumberArray,
@@ -82,6 +83,7 @@ const ObservabilityApmAlertOptional = rt.partial({
       value: schemaString,
     })
   ),
+  labels: schemaUnknown,
   'processor.event': schemaString,
   'service.environment': schemaString,
   'service.language.name': schemaString,
diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_logs_schema.ts b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_logs_schema.ts
index 62b23dcab24ee..dd87a5b0e6c9d 100644
--- a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_logs_schema.ts
+++ b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_logs_schema.ts
@@ -71,6 +71,7 @@ export const schemaGeoPointArray = rt.array(schemaGeoPoint);
 const ObservabilityLogsAlertRequired = rt.type({
 });
 const ObservabilityLogsAlertOptional = rt.partial({
+  'kibana.alert.context': schemaUnknown,
   'kibana.alert.evaluation.threshold': schemaStringOrNumber,
   'kibana.alert.evaluation.value': schemaStringOrNumber,
   'kibana.alert.evaluation.values': schemaStringOrNumberArray,
diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_metrics_schema.ts b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_metrics_schema.ts
index 3806f2d096bd2..2e34e72f88257 100644
--- a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_metrics_schema.ts
+++ b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_metrics_schema.ts
@@ -71,6 +71,7 @@ export const schemaGeoPointArray = rt.array(schemaGeoPoint);
 const ObservabilityMetricsAlertRequired = rt.type({
 });
 const ObservabilityMetricsAlertOptional = rt.partial({
+  'kibana.alert.context': schemaUnknown,
   'kibana.alert.evaluation.threshold': schemaStringOrNumber,
   'kibana.alert.evaluation.value': schemaStringOrNumber,
   'kibana.alert.evaluation.values': schemaStringOrNumberArray,
diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_slo_schema.ts b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_slo_schema.ts
index 62ad6c82c6391..523e79ecf07a9 100644
--- a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_slo_schema.ts
+++ b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_slo_schema.ts
@@ -70,6 +70,7 @@ export const schemaGeoPointArray = rt.array(schemaGeoPoint);
 const ObservabilitySloAlertRequired = rt.type({
 });
 const ObservabilitySloAlertOptional = rt.partial({
+  'kibana.alert.context': schemaUnknown,
   'kibana.alert.evaluation.threshold': schemaStringOrNumber,
   'kibana.alert.evaluation.value': schemaStringOrNumber,
   'kibana.alert.evaluation.values': schemaStringOrNumberArray,
diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_uptime_schema.ts b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_uptime_schema.ts
index 12a54768d71e4..d8693417f77dc 100644
--- a/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_uptime_schema.ts
+++ b/packages/kbn-alerts-as-data-utils/src/schemas/generated/observability_uptime_schema.ts
@@ -74,6 +74,7 @@ const ObservabilityUptimeAlertOptional = rt.partial({
   'anomaly.bucket_span.minutes': schemaString,
   'anomaly.start': schemaDate,
   'error.message': schemaString,
+  'kibana.alert.context': schemaUnknown,
   'kibana.alert.evaluation.threshold': schemaStringOrNumber,
   'kibana.alert.evaluation.value': schemaStringOrNumber,
   'kibana.alert.evaluation.values': schemaStringOrNumberArray,
diff --git a/packages/kbn-alerts-as-data-utils/src/schemas/generated/security_schema.ts b/packages/kbn-alerts-as-data-utils/src/schemas/generated/security_schema.ts
index e27f8c1c8157b..f8648bfa4218d 100644
--- a/packages/kbn-alerts-as-data-utils/src/schemas/generated/security_schema.ts
+++ b/packages/kbn-alerts-as-data-utils/src/schemas/generated/security_schema.ts
@@ -182,6 +182,7 @@ const SecurityAlertOptional = rt.partial({
   'kibana.alert.suppression.terms.field': schemaStringArray,
   'kibana.alert.suppression.terms.value': schemaStringArray,
   'kibana.alert.system_status': schemaString,
+  'kibana.alert.threshold_result.cardinality': schemaUnknown,
   'kibana.alert.threshold_result.count': schemaStringOrNumber,
   'kibana.alert.threshold_result.from': schemaDate,
   'kibana.alert.threshold_result.terms': rt.array(
diff --git a/packages/kbn-doc-links/src/get_doc_links.ts b/packages/kbn-doc-links/src/get_doc_links.ts
index 65183620e756d..b8d46bad40cc4 100644
--- a/packages/kbn-doc-links/src/get_doc_links.ts
+++ b/packages/kbn-doc-links/src/get_doc_links.ts
@@ -65,6 +65,7 @@ export const getDocLinks = ({ kibanaBranch }: GetDocLinkOptions): DocLinks => {
       guide: `${KIBANA_DOCS}canvas.html`,
     },
     cloud: {
+      beatsAndLogstashConfiguration: `${ELASTIC_WEBSITE_URL}guide/en/cloud/current/ec-cloud-id.html`,
       indexManagement: `${ELASTIC_WEBSITE_URL}guide/en/cloud/current/ec-configure-index-management.html`,
     },
     console: {
@@ -456,6 +457,7 @@ export const getDocLinks = ({ kibanaBranch }: GetDocLinkOptions): DocLinks => {
       },
       privileges: `${SECURITY_SOLUTION_DOCS}endpoint-management-req.html`,
       manageDetectionRules: `${SECURITY_SOLUTION_DOCS}rules-ui-management.html`,
+      createEsqlRuleType: `${SECURITY_SOLUTION_DOCS}rules-ui-create.html#create-esql-rule`,
     },
     query: {
       eql: `${ELASTICSEARCH_DOCS}eql.html`,
@@ -855,9 +857,6 @@ export const getDocLinks = ({ kibanaBranch }: GetDocLinkOptions): DocLinks => {
     synthetics: {
       featureRoles: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/synthetics-feature-roles.html`,
     },
-    esql: {
-      statsBy: `${ELASTICSEARCH_DOCS}esql.html`,
-    },
     telemetry: {
       settings: `${KIBANA_DOCS}telemetry-settings-kbn.html`,
     },
diff --git a/packages/kbn-doc-links/src/types.ts b/packages/kbn-doc-links/src/types.ts
index 6d4245b769a27..adc7f13c6c612 100644
--- a/packages/kbn-doc-links/src/types.ts
+++ b/packages/kbn-doc-links/src/types.ts
@@ -46,6 +46,7 @@ export interface DocLinks {
     readonly guide: string;
   };
   readonly cloud: {
+    readonly beatsAndLogstashConfiguration: string;
     readonly indexManagement: string;
   };
   readonly console: {
@@ -347,6 +348,7 @@ export interface DocLinks {
     };
     readonly privileges: string;
     readonly manageDetectionRules: string;
+    readonly createEsqlRuleType: string;
   };
   readonly query: {
     readonly eql: string;
@@ -612,9 +614,6 @@ export interface DocLinks {
   readonly synthetics: {
     readonly featureRoles: string;
   };
-  readonly esql: {
-    readonly statsBy: string;
-  };
   readonly telemetry: {
     readonly settings: string;
   };
diff --git a/packages/kbn-es/src/serverless_resources/operator_users.yml b/packages/kbn-es/src/serverless_resources/operator_users.yml
index 7e8e7163e6a84..769d52c25f65a 100644
--- a/packages/kbn-es/src/serverless_resources/operator_users.yml
+++ b/packages/kbn-es/src/serverless_resources/operator_users.yml
@@ -1,19 +1,5 @@
 operator:
-  - usernames:
-      [
-        'elastic_serverless',
-        'system_indices_superuser',
-        't1_analyst',
-        't2_analyst',
-        't3_analyst',
-        'threat_intelligence_analyst',
-        'rule_author',
-        'soc_manager',
-        'detections_admin',
-        'platform_engineer',
-        'endpoint_operations_analyst',
-        'endpoint_policy_manager',
-      ]
+  - usernames: ['elastic_serverless', 'system_indices_superuser']
     realm_type: 'file'
     auth_type: 'realm'
   - usernames: ['elastic/kibana']
diff --git a/packages/kbn-es/src/serverless_resources/roles.yml b/packages/kbn-es/src/serverless_resources/roles.yml
index c631f596a8cac..5777f282ff7a4 100644
--- a/packages/kbn-es/src/serverless_resources/roles.yml
+++ b/packages/kbn-es/src/serverless_resources/roles.yml
@@ -117,6 +117,7 @@ t1_analyst:
         - metrics-endpoint.metadata_current_*
         - ".fleet-agents*"
         - ".fleet-actions*"
+        - "risk-score.risk-score-*"
       privileges:
         - read
   applications:
@@ -157,6 +158,7 @@ t2_analyst:
         - metrics-endpoint.metadata_current_*
         - .fleet-agents*
         - .fleet-actions*
+        - "risk-score.risk-score-*"
       privileges:
         - read
   applications:
@@ -204,6 +206,7 @@ t3_analyst:
         - metrics-endpoint.metadata_current_*
         - .fleet-agents*
         - .fleet-actions*
+        - "risk-score.risk-score-*"
       privileges:
         - read
   applications:
@@ -256,6 +259,7 @@ threat_intelligence_analyst:
         - metrics-endpoint.metadata_current_*
         - .fleet-agents*
         - .fleet-actions*
+        - "risk-score.risk-score-*"
       privileges:
         - read
   applications:
@@ -307,6 +311,7 @@ rule_author:
         - metrics-endpoint.metadata_current_*
         - .fleet-agents*
         - .fleet-actions*
+        - "risk-score.risk-score-*"
       privileges:
         - read
   applications:
@@ -363,6 +368,7 @@ soc_manager:
         - metrics-endpoint.metadata_current_*
         - .fleet-agents*
         - .fleet-actions*
+        - risk-score.risk-score-*
       privileges:
         - read
   applications:
@@ -391,7 +397,7 @@ soc_manager:
       resources: "*"
 
 detections_admin:
-  cluster:
+  cluster: ["manage_index_templates", "manage_transform"]
   indices:
     - names:
         - apm-*-transaction*
@@ -418,6 +424,10 @@ detections_admin:
         - .fleet-actions*
       privileges:
         - read
+    - names:
+        - risk-score.risk-score-*
+      privileges:
+        - all
   applications:
     - application: "kibana-.kibana"
       privileges:
@@ -450,6 +460,7 @@ platform_engineer:
         - .siem-signals-*
         - .preview.alerts-security*
         - .internal.preview.alerts-security*
+        - risk-score.risk-score-*
       privileges:
         - all
   applications:
@@ -482,6 +493,7 @@ endpoint_operations_analyst:
         - metrics-endpoint.metadata_current_*
         - .fleet-agents*
         - .fleet-actions*
+        - risk-score.risk-score-*
       privileges:
         - read
     - names:
@@ -537,6 +549,7 @@ endpoint_policy_manager:
         - metrics-endpoint.metadata_current_*
         - .fleet-agents*
         - .fleet-actions*
+        - risk-score.risk-score-*
       privileges:
         - read
     - names:
diff --git a/packages/kbn-eslint-plugin-i18n/README.mdx b/packages/kbn-eslint-plugin-i18n/README.mdx
index 0a22ff846726e..f72f01c06a632 100644
--- a/packages/kbn-eslint-plugin-i18n/README.mdx
+++ b/packages/kbn-eslint-plugin-i18n/README.mdx
@@ -8,6 +8,10 @@ tags: ['kibana', 'dev', 'contributor', 'operations', 'eslint', 'i18n']
 
 `@kbn/eslint-plugin-i18n` is an ESLint plugin providing custom rules for validating JSXCode in the Kibana repo to make sure they are translated.
 
+Note: At the moment these rules only work for apps that are inside `/x-pack/plugins`.
+
+If you want to enable this rule on code that is outside of this path, adjust `/helpers/get_i18n_identifier_from_file_path.ts`.
+
 ## `@kbn/i18n/strings_should_be_translated_with_i18n`
 
 This rule warns engineers to translate their strings by using i18n.translate from the '@kbn/i18n' package. It provides an autofix that takes into account the context of the translatable string in the JSX tree to generate a translation ID.
diff --git a/packages/kbn-eslint-plugin-i18n/helpers/get_i18n_identifier_from_file_path.ts b/packages/kbn-eslint-plugin-i18n/helpers/get_i18n_identifier_from_file_path.ts
index 360f70e0b3fa8..288e2692bd76a 100644
--- a/packages/kbn-eslint-plugin-i18n/helpers/get_i18n_identifier_from_file_path.ts
+++ b/packages/kbn-eslint-plugin-i18n/helpers/get_i18n_identifier_from_file_path.ts
@@ -25,5 +25,5 @@ export function getI18nIdentifierFromFilePath(fileName: string, cwd: string) {
 
   return i18nrc && i18nrc.paths
     ? findKey(i18nrc.paths, (v) => v === path) ?? 'app_not_found_in_i18nrc'
-    : 'app_not_found_in_i18nrc';
+    : 'could_not_find_i18nrc';
 }
diff --git a/packages/kbn-eslint-plugin-i18n/index.ts b/packages/kbn-eslint-plugin-i18n/index.ts
index d6fba728b7d21..be5661cf46dec 100644
--- a/packages/kbn-eslint-plugin-i18n/index.ts
+++ b/packages/kbn-eslint-plugin-i18n/index.ts
@@ -10,7 +10,7 @@ import { StringsShouldBeTranslatedWithI18n } from './rules/strings_should_be_tra
 import { StringsShouldBeTranslatedWithFormattedMessage } from './rules/strings_should_be_translated_with_formatted_message';
 
 /**
- * Custom ESLint rules, add `'@kbn/eslint-plugin-telemetry'` to your eslint config to use them
+ * Custom ESLint rules, add `'@kbn/eslint-plugin-i18n'` to your eslint config to use them
  * @internal
  */
 export const rules = {
diff --git a/packages/kbn-field-utils/index.ts b/packages/kbn-field-utils/index.ts
index c9f85c9cfcec5..1ad361feced99 100644
--- a/packages/kbn-field-utils/index.ts
+++ b/packages/kbn-field-utils/index.ts
@@ -18,5 +18,9 @@ export { getFieldIconType } from './src/utils/get_field_icon_type';
 export { getFieldType } from './src/utils/get_field_type';
 export { getFieldTypeDescription } from './src/utils/get_field_type_description';
 export { getFieldTypeName, UNKNOWN_FIELD_TYPE_MESSAGE } from './src/utils/get_field_type_name';
+export {
+  fieldNameWildcardMatcher,
+  getFieldSearchMatchingHighlight,
+} from './src/utils/field_name_wildcard_matcher';
 
 export { FieldIcon, type FieldIconProps, getFieldIconProps } from './src/components/field_icon';
diff --git a/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.test.tsx b/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.test.tsx
new file mode 100644
index 0000000000000..1311d1c5bbc2f
--- /dev/null
+++ b/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.test.tsx
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { type DataViewField } from '@kbn/data-views-plugin/common';
+import {
+  fieldNameWildcardMatcher,
+  getFieldSearchMatchingHighlight,
+} from './field_name_wildcard_matcher';
+
+const name = 'test.this_value.maybe';
+describe('fieldNameWildcardMatcher', function () {
+  describe('fieldNameWildcardMatcher()', () => {
+    it('should work correctly with wildcard', async () => {
+      expect(fieldNameWildcardMatcher({ displayName: 'test' } as DataViewField, 'no')).toBe(false);
+      expect(
+        fieldNameWildcardMatcher({ displayName: 'test', name: 'yes' } as DataViewField, 'yes')
+      ).toBe(true);
+
+      const search = 'test*ue';
+      expect(fieldNameWildcardMatcher({ displayName: 'test' } as DataViewField, search)).toBe(
+        false
+      );
+      expect(fieldNameWildcardMatcher({ displayName: 'test.value' } as DataViewField, search)).toBe(
+        true
+      );
+      expect(fieldNameWildcardMatcher({ name: 'test.this_value' } as DataViewField, search)).toBe(
+        true
+      );
+      expect(fieldNameWildcardMatcher({ name: 'message.test' } as DataViewField, search)).toBe(
+        false
+      );
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, search)).toBe(false);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, `${search}*`)).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, '*value*')).toBe(true);
+    });
+
+    it('should work correctly with spaces', async () => {
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test maybe    ')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test maybe*')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test. this')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'this      _value be')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'this')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, '  value  ')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'be')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test this here')).toBe(false);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test that')).toBe(false);
+      expect(fieldNameWildcardMatcher({ name } as DataViewField, '    ')).toBe(false);
+      expect(fieldNameWildcardMatcher({ name: 'geo.location3' } as DataViewField, '3')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name: 'geo_location3' } as DataViewField, 'geo 3')).toBe(
+        true
+      );
+    });
+
+    it('should be case-insensitive', async () => {
+      expect(fieldNameWildcardMatcher({ name: 'Test' } as DataViewField, 'test')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name: 'test' } as DataViewField, 'Test')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name: 'tesT' } as DataViewField, 'Tes*')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name: 'tesT' } as DataViewField, 'tes*')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name: 'tesT' } as DataViewField, 't T')).toBe(true);
+      expect(fieldNameWildcardMatcher({ name: 'tesT' } as DataViewField, 't t')).toBe(true);
+    });
+  });
+
+  describe('getFieldSearchMatchingHighlight()', function () {
+    it('should correctly return only partial match', async () => {
+      expect(getFieldSearchMatchingHighlight('test this', 'test')).toBe('test');
+      expect(getFieldSearchMatchingHighlight('test this', 'this')).toBe('this');
+      expect(getFieldSearchMatchingHighlight('test this')).toBe('');
+    });
+
+    it('should correctly return a full match for a wildcard search', async () => {
+      expect(getFieldSearchMatchingHighlight('Test this', 'test*')).toBe('Test this');
+      expect(getFieldSearchMatchingHighlight('test this', '*this')).toBe('test this');
+      expect(getFieldSearchMatchingHighlight('test this', ' te th')).toBe('test this');
+    });
+  });
+});
diff --git a/packages/kbn-unified-field-list/src/utils/field_name_wildcard_matcher.ts b/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts
similarity index 73%
rename from packages/kbn-unified-field-list/src/utils/field_name_wildcard_matcher.ts
rename to packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts
index eadf5597b171b..063ca3a16e01a 100644
--- a/packages/kbn-unified-field-list/src/utils/field_name_wildcard_matcher.ts
+++ b/packages/kbn-field-utils/src/utils/field_name_wildcard_matcher.ts
@@ -41,3 +41,23 @@ export const fieldNameWildcardMatcher = (
   const regExp = makeRegEx(fieldSearchHighlight);
   return (!!field.displayName && regExp.test(field.displayName)) || regExp.test(field.name);
 };
+
+/**
+ * Get `highlight` string to be used together with `EuiHighlight`
+ * @param displayName
+ * @param fieldSearchHighlight
+ */
+export function getFieldSearchMatchingHighlight(
+  displayName: string,
+  fieldSearchHighlight?: string
+): string {
+  const searchHighlight = (fieldSearchHighlight || '').trim();
+  if (
+    (searchHighlight.includes('*') || searchHighlight.includes(' ')) &&
+    fieldNameWildcardMatcher({ name: displayName }, searchHighlight)
+  ) {
+    return displayName;
+  }
+
+  return searchHighlight;
+}
diff --git a/packages/kbn-management/settings/setting_ids/index.ts b/packages/kbn-management/settings/setting_ids/index.ts
index 9a1188b868961..1ef2c6b223df4 100644
--- a/packages/kbn-management/settings/setting_ids/index.ts
+++ b/packages/kbn-management/settings/setting_ids/index.ts
@@ -52,7 +52,6 @@ export const TIMEPICKER_TIME_DEFAULTS_ID = 'timepicker:timeDefaults';
 // Presentation labs settings
 export const LABS_CANVAS_BY_VALUE_EMBEDDABLE_ID = 'labs:canvas:byValueEmbeddable';
 export const LABS_CANVAS_ENABLE_UI_ID = 'labs:canvas:enable_ui';
-export const LABS_DASHBOARD_CONTROLS_ID = 'labs:dashboard:dashboardControls';
 export const LABS_DASHBOARD_DEFER_BELOW_FOLD_ID = 'labs:dashboard:deferBelowFold';
 export const LABS_DASHBOARDS_ENABLE_UI_ID = 'labs:dashboard:enable_ui';
 
diff --git a/packages/kbn-profiling-utils/common/frame_group.test.ts b/packages/kbn-profiling-utils/common/frame_group.test.ts
index b6bfa6161a175..0a2d1eb7b05a4 100644
--- a/packages/kbn-profiling-utils/common/frame_group.test.ts
+++ b/packages/kbn-profiling-utils/common/frame_group.test.ts
@@ -40,7 +40,7 @@ const elfSymbolizedTests = [
       sourceFilename: '',
       functionName: 'strlen()',
     },
-    expected: 'elf;libc;strlen()',
+    expected: 'elf;0x0123456789ABCDEF;strlen()',
   },
   {
     params: {
@@ -50,7 +50,7 @@ const elfSymbolizedTests = [
       sourceFilename: '',
       functionName: 'strtok()',
     },
-    expected: 'elf;libc;strtok()',
+    expected: 'elf;0xFEDCBA9876543210;strtok()',
   },
 ];
 
diff --git a/packages/kbn-profiling-utils/common/frame_group.ts b/packages/kbn-profiling-utils/common/frame_group.ts
index 56a190ee58062..32452ca293797 100644
--- a/packages/kbn-profiling-utils/common/frame_group.ts
+++ b/packages/kbn-profiling-utils/common/frame_group.ts
@@ -41,7 +41,7 @@ export function createFrameGroupID(
   }
 
   if (sourceFilename === '') {
-    return `elf;${exeFilename};${functionName}`;
+    return `elf;${fileID};${functionName}`;
   }
 
   return `full;${exeFilename};${functionName};${stripLeadingSubdirs(sourceFilename || '')}`;
diff --git a/packages/kbn-search-connectors/types/connectors.ts b/packages/kbn-search-connectors/types/connectors.ts
index 8f649c15f348f..4df4a0394546e 100644
--- a/packages/kbn-search-connectors/types/connectors.ts
+++ b/packages/kbn-search-connectors/types/connectors.ts
@@ -68,7 +68,7 @@ export type ConnectorConfiguration = Record<
 > & {
   extract_full_html?: { label: string; value: boolean }; // This only exists for Crawler
   use_document_level_security?: ConnectorConfigProperties;
-  use_text_extraction_service?: ConnectorConfigProperties; // This only exists for SharePoint Online
+  use_text_extraction_service?: ConnectorConfigProperties;
 };
 
 export interface ConnectorScheduling {
diff --git a/packages/kbn-search-connectors/types/native_connectors.ts b/packages/kbn-search-connectors/types/native_connectors.ts
index 69a2d64184465..c618aa8aa70d4 100644
--- a/packages/kbn-search-connectors/types/native_connectors.ts
+++ b/packages/kbn-search-connectors/types/native_connectors.ts
@@ -444,6 +444,21 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         ],
         value: 50,
       },
+      use_document_level_security: {
+        default_value: null,
+        depends_on: [],
+        display: DisplayType.TOGGLE,
+        label: ENABLE_DOCUMENT_LEVEL_SECURITY_LABEL,
+        options: [],
+        order: 6,
+        required: true,
+        sensitive: false,
+        tooltip: ENABLE_DOCUMENT_LEVEL_SECURITY_TOOLTIP,
+        type: FieldType.BOOLEAN,
+        ui_restrictions: [],
+        validations: [],
+        value: false,
+      },
       use_text_extraction_service: {
         default_value: false,
         depends_on: [],
@@ -730,7 +745,6 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         ui_restrictions: ['advanced'],
         validations: [],
         value: 3,
-        display_value: 3,
       },
       use_text_extraction_service: {
         default_value: null,
@@ -743,7 +757,7 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         sensitive: false,
         tooltip: USE_TEXT_EXTRACTION_SERVICE_TOOLTIP,
         type: FieldType.BOOLEAN,
-        ui_restrictions: [],
+        ui_restrictions: ['advanced'],
         validations: [],
         value: false,
       },
@@ -963,7 +977,7 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         sensitive: false,
         tooltip: USE_TEXT_EXTRACTION_SERVICE_TOOLTIP,
         type: FieldType.BOOLEAN,
-        ui_restrictions: [],
+        ui_restrictions: ['advanced'],
         validations: [],
         value: false,
       },
@@ -1204,6 +1218,21 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         ],
         value: 100,
       },
+      use_document_level_security: {
+        default_value: null,
+        depends_on: [],
+        display: DisplayType.TOGGLE,
+        label: ENABLE_DOCUMENT_LEVEL_SECURITY_LABEL,
+        options: [],
+        order: 6,
+        required: true,
+        sensitive: false,
+        tooltip: ENABLE_DOCUMENT_LEVEL_SECURITY_TOOLTIP,
+        type: FieldType.BOOLEAN,
+        ui_restrictions: [],
+        validations: [],
+        value: false,
+      },
       use_text_extraction_service: {
         default_value: false,
         depends_on: [],
@@ -1845,6 +1874,21 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         validations: [],
         value: '',
       },
+      use_document_level_security: {
+        default_value: null,
+        depends_on: [],
+        display: DisplayType.TOGGLE,
+        label: ENABLE_DOCUMENT_LEVEL_SECURITY_LABEL,
+        options: [],
+        order: 6,
+        required: true,
+        sensitive: false,
+        tooltip: ENABLE_DOCUMENT_LEVEL_SECURITY_TOOLTIP,
+        type: FieldType.BOOLEAN,
+        ui_restrictions: [],
+        validations: [],
+        value: false,
+      },
     },
     features: {
       [FeatureName.SYNC_RULES]: {
@@ -2559,6 +2603,56 @@ export const NATIVE_CONNECTOR_DEFINITIONS: Record<string, NativeConnector | unde
         validations: [],
         value: true,
       },
+      enumerate_all_sites: {
+        default_value: true,
+        depends_on: [],
+        display: DisplayType.TOGGLE,
+        label: i18n.translate(
+          'searchConnectors.nativeConnectors.sharepoint_online.configuration.enumerateAllSitesLabel',
+          { defaultMessage: 'Enumerate all sites?' }
+        ),
+        options: [],
+        order: 6,
+        required: false,
+        sensitive: false,
+        tooltip: i18n.translate(
+          'searchConnectors.nativeConnectors.sharepoint_online.configuration.enumerateAllSitesTooltip',
+          {
+            defaultMessage:
+              'If enabled, sites will be fetched in bulk, then filtered down to the configured list of sites. This is efficient when syncing many sites. If disabled, each configured site will be fetched with an individual request. This is efficient when syncing fewer sites.',
+          }
+        ),
+        type: FieldType.BOOLEAN,
+        ui_restrictions: [],
+        validations: [],
+        value: true,
+      },
+      fetch_subsites: {
+        default_value: false,
+        depends_on: [{ field: 'enumerate_all_sites', value: false }],
+        display: DisplayType.TOGGLE,
+        label: i18n.translate(
+          'searchConnectors.nativeConnectors.sharepoint_online.configuration.fetchSubsitesLabel',
+          {
+            defaultMessage: 'Fetch sub-sites of configured sites?',
+          }
+        ),
+        options: [],
+        order: 7,
+        required: false,
+        sensitive: false,
+        tooltip: i18n.translate(
+          'searchConnectors.nativeConnectors.sharepoint_online.configuration.fetchSubsitesTooltip',
+          {
+            defaultMessage:
+              'Whether subsites of the configured site(s) should be automatically fetched.',
+          }
+        ),
+        type: FieldType.BOOLEAN,
+        ui_restrictions: [],
+        validations: [],
+        value: true,
+      },
     },
     features: {
       [FeatureName.SYNC_RULES]: {
diff --git a/packages/kbn-test/jest-preset.js b/packages/kbn-test/jest-preset.js
index ed5a174e2db80..8d50a88e23073 100644
--- a/packages/kbn-test/jest-preset.js
+++ b/packages/kbn-test/jest-preset.js
@@ -105,7 +105,7 @@ module.exports = {
   transformIgnorePatterns: [
     // ignore all node_modules except monaco-editor and react-monaco-editor which requires babel transforms to handle dynamic import()
     // since ESM modules are not natively supported in Jest yet (https://github.com/facebook/jest/issues/4842)
-    '[/\\\\]node_modules(?![\\/\\\\](byte-size|monaco-editor|monaco-yaml|vscode-languageserver-types|react-monaco-editor|d3-interpolate|d3-color|langchain|langsmith|@cfworker))[/\\\\].+\\.js$',
+    '[/\\\\]node_modules(?![\\/\\\\](byte-size|monaco-editor|monaco-yaml|vscode-languageserver-types|react-monaco-editor|d3-interpolate|d3-color|langchain|langsmith|@cfworker|gpt-tokenizer))[/\\\\].+\\.js$',
     'packages/kbn-pm/dist/index.js',
     '[/\\\\]node_modules(?![\\/\\\\](langchain|langsmith))/dist/[/\\\\].+\\.js$',
     '[/\\\\]node_modules(?![\\/\\\\](langchain|langsmith))/dist/util/[/\\\\].+\\.js$',
diff --git a/packages/kbn-test/jest_integration_node/jest-preset.js b/packages/kbn-test/jest_integration_node/jest-preset.js
index 92b8aedb5ee88..631b2c4f9350e 100644
--- a/packages/kbn-test/jest_integration_node/jest-preset.js
+++ b/packages/kbn-test/jest_integration_node/jest-preset.js
@@ -22,7 +22,7 @@ module.exports = {
   // An array of regexp pattern strings that are matched against, matched files will skip transformation:
   transformIgnorePatterns: [
     // since ESM modules are not natively supported in Jest yet (https://github.com/facebook/jest/issues/4842)
-    '[/\\\\]node_modules(?![\\/\\\\](langchain|langsmith))[/\\\\].+\\.js$',
+    '[/\\\\]node_modules(?![\\/\\\\](langchain|langsmith|gpt-tokenizer))[/\\\\].+\\.js$',
     '[/\\\\]node_modules(?![\\/\\\\](langchain|langsmith))/dist/[/\\\\].+\\.js$',
     '[/\\\\]node_modules(?![\\/\\\\](langchain|langsmith))/dist/util/[/\\\\].+\\.js$',
   ],
diff --git a/packages/kbn-text-based-editor/src/editor_footer.tsx b/packages/kbn-text-based-editor/src/editor_footer.tsx
index f89a14d06f106..5070e2d5789e7 100644
--- a/packages/kbn-text-based-editor/src/editor_footer.tsx
+++ b/packages/kbn-text-based-editor/src/editor_footer.tsx
@@ -58,14 +58,12 @@ export function ErrorsWarningsPopover({
   isPopoverOpen,
   items,
   type,
-  refreshErrors,
   setIsPopoverOpen,
   onErrorClick,
 }: {
   isPopoverOpen: boolean;
   items: MonacoError[];
   type: 'error' | 'warning';
-  refreshErrors: () => void;
   setIsPopoverOpen: (flag: boolean) => void;
   onErrorClick: (error: MonacoError) => void;
 }) {
@@ -89,7 +87,6 @@ export function ErrorsWarningsPopover({
                   }
                 `}
                 onClick={() => {
-                  refreshErrors();
                   setIsPopoverOpen(!isPopoverOpen);
                 }}
               >
@@ -184,7 +181,6 @@ export const EditorFooter = memo(function EditorFooter({
               isPopoverOpen={isPopoverOpen}
               items={errors}
               type="error"
-              refreshErrors={refreshErrors}
               setIsPopoverOpen={setIsPopoverOpen}
               onErrorClick={onErrorClick}
             />
@@ -194,7 +190,6 @@ export const EditorFooter = memo(function EditorFooter({
               isPopoverOpen={isPopoverOpen}
               items={warning}
               type="warning"
-              refreshErrors={refreshErrors}
               setIsPopoverOpen={setIsPopoverOpen}
               onErrorClick={onErrorClick}
             />
diff --git a/packages/kbn-unified-doc-viewer/src/components/field_name/field_name.tsx b/packages/kbn-unified-doc-viewer/src/components/field_name/field_name.tsx
index 4a525d7136214..0228732709eb1 100644
--- a/packages/kbn-unified-doc-viewer/src/components/field_name/field_name.tsx
+++ b/packages/kbn-unified-doc-viewer/src/components/field_name/field_name.tsx
@@ -36,7 +36,7 @@ export function FieldName({
   const typeName = getFieldTypeName(fieldType);
   const displayName =
     fieldMapping && fieldMapping.displayName ? fieldMapping.displayName : fieldName;
-  const tooltip = displayName !== fieldName ? `${fieldName} (${displayName})` : fieldName;
+  const tooltip = displayName !== fieldName ? `${displayName} (${fieldName})` : fieldName;
   const subTypeMulti = fieldMapping && getDataViewFieldSubtypeMulti(fieldMapping.spec);
   const isMultiField = !!subTypeMulti?.multi;
 
diff --git a/packages/kbn-unified-field-list/src/components/field_item_button/field_item_button.tsx b/packages/kbn-unified-field-list/src/components/field_item_button/field_item_button.tsx
index 8ef947fc7bb8f..6842fb8d3eeb4 100644
--- a/packages/kbn-unified-field-list/src/components/field_item_button/field_item_button.tsx
+++ b/packages/kbn-unified-field-list/src/components/field_item_button/field_item_button.tsx
@@ -12,9 +12,8 @@ import classnames from 'classnames';
 import { FieldButton, type FieldButtonProps } from '@kbn/react-field';
 import { EuiButtonIcon, EuiButtonIconProps, EuiHighlight, EuiIcon, EuiToolTip } from '@elastic/eui';
 import type { DataViewField } from '@kbn/data-views-plugin/common';
-import { FieldIcon, getFieldIconProps } from '@kbn/field-utils';
+import { FieldIcon, getFieldIconProps, getFieldSearchMatchingHighlight } from '@kbn/field-utils';
 import { type FieldListItem, type GetCustomFieldType } from '../../types';
-import { fieldNameWildcardMatcher } from '../../utils/field_name_wildcard_matcher';
 import './field_item_button.scss';
 
 /**
@@ -197,7 +196,7 @@ export function FieldItemButton<T extends FieldListItem = DataViewField>({
       fieldIcon={<FieldIcon {...iconProps} />}
       fieldName={
         <EuiHighlight
-          search={getSearchHighlight(displayName, fieldSearchHighlight)}
+          search={getFieldSearchMatchingHighlight(displayName, fieldSearchHighlight)}
           title={title}
           data-test-subj={`field-${field.name}`}
         >
@@ -233,15 +232,3 @@ function FieldConflictInfoIcon() {
     </EuiToolTip>
   );
 }
-
-function getSearchHighlight(displayName: string, fieldSearchHighlight?: string): string {
-  const searchHighlight = (fieldSearchHighlight || '').trim();
-  if (
-    (searchHighlight.includes('*') || searchHighlight.includes(' ')) &&
-    fieldNameWildcardMatcher({ name: displayName }, searchHighlight)
-  ) {
-    return displayName;
-  }
-
-  return searchHighlight;
-}
diff --git a/packages/kbn-unified-field-list/src/hooks/use_field_filters.ts b/packages/kbn-unified-field-list/src/hooks/use_field_filters.ts
index badf101195d9e..d507c20c6049e 100644
--- a/packages/kbn-unified-field-list/src/hooks/use_field_filters.ts
+++ b/packages/kbn-unified-field-list/src/hooks/use_field_filters.ts
@@ -10,10 +10,9 @@ import { useMemo, useState } from 'react';
 import { htmlIdGenerator } from '@elastic/eui';
 import { type DataViewField } from '@kbn/data-views-plugin/common';
 import type { CoreStart } from '@kbn/core-lifecycle-browser';
-import { type FieldTypeKnown, getFieldIconType } from '@kbn/field-utils';
+import { type FieldTypeKnown, getFieldIconType, fieldNameWildcardMatcher } from '@kbn/field-utils';
 import { type FieldListFiltersProps } from '../components/field_list_filters';
 import { type FieldListItem, GetCustomFieldType } from '../types';
-import { fieldNameWildcardMatcher } from '../utils/field_name_wildcard_matcher';
 
 const htmlId = htmlIdGenerator('fieldList');
 
diff --git a/packages/kbn-unified-field-list/src/utils/field_name_wildcard_matcher.test.tsx b/packages/kbn-unified-field-list/src/utils/field_name_wildcard_matcher.test.tsx
deleted file mode 100644
index 56ee45f5eb207..0000000000000
--- a/packages/kbn-unified-field-list/src/utils/field_name_wildcard_matcher.test.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { type DataViewField } from '@kbn/data-views-plugin/common';
-import { fieldNameWildcardMatcher } from './field_name_wildcard_matcher';
-
-const name = 'test.this_value.maybe';
-describe('UnifiedFieldList fieldNameWildcardMatcher()', () => {
-  it('should work correctly with wildcard', async () => {
-    expect(fieldNameWildcardMatcher({ displayName: 'test' } as DataViewField, 'no')).toBe(false);
-    expect(
-      fieldNameWildcardMatcher({ displayName: 'test', name: 'yes' } as DataViewField, 'yes')
-    ).toBe(true);
-
-    const search = 'test*ue';
-    expect(fieldNameWildcardMatcher({ displayName: 'test' } as DataViewField, search)).toBe(false);
-    expect(fieldNameWildcardMatcher({ displayName: 'test.value' } as DataViewField, search)).toBe(
-      true
-    );
-    expect(fieldNameWildcardMatcher({ name: 'test.this_value' } as DataViewField, search)).toBe(
-      true
-    );
-    expect(fieldNameWildcardMatcher({ name: 'message.test' } as DataViewField, search)).toBe(false);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, search)).toBe(false);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, `${search}*`)).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, '*value*')).toBe(true);
-  });
-
-  it('should work correctly with spaces', async () => {
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test maybe    ')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test maybe*')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test. this')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'this      _value be')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'this')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, '  value  ')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'be')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test this here')).toBe(false);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, 'test that')).toBe(false);
-    expect(fieldNameWildcardMatcher({ name } as DataViewField, '    ')).toBe(false);
-    expect(fieldNameWildcardMatcher({ name: 'geo.location3' } as DataViewField, '3')).toBe(true);
-    expect(fieldNameWildcardMatcher({ name: 'geo_location3' } as DataViewField, 'geo 3')).toBe(
-      true
-    );
-  });
-});
diff --git a/packages/shared-ux/chrome/navigation/index.ts b/packages/shared-ux/chrome/navigation/index.ts
index c6d56e6011fe9..0659fe0461664 100644
--- a/packages/shared-ux/chrome/navigation/index.ts
+++ b/packages/shared-ux/chrome/navigation/index.ts
@@ -12,11 +12,15 @@ export { DefaultNavigation, getPresets, Navigation } from './src/ui';
 
 export type {
   GroupDefinition,
+  PresetDefinition,
+  ItemDefinition,
   NavigationGroupPreset,
   NavigationTreeDefinition,
   ProjectNavigationDefinition,
   RecentlyAccessedDefinition,
   RootNavigationItemDefinition,
+  PanelComponentProps,
+  PanelContent,
 } from './src/ui';
 
 export type { NavigationServices } from './types';
diff --git a/packages/shared-ux/chrome/navigation/mocks/src/jest.ts b/packages/shared-ux/chrome/navigation/mocks/src/jest.ts
index d2e7f9b77ca22..e1761de6be6fd 100644
--- a/packages/shared-ux/chrome/navigation/mocks/src/jest.ts
+++ b/packages/shared-ux/chrome/navigation/mocks/src/jest.ts
@@ -29,6 +29,7 @@ export const getServicesMock = ({
     navigateToUrl,
     onProjectNavigationChange: jest.fn(),
     activeNodes$: of(activeNodes),
+    isSideNavCollapsed: false,
     cloudLinks: {
       billingAndSub: {
         title: 'Mock Billing & Subscriptions',
diff --git a/packages/shared-ux/chrome/navigation/mocks/src/storybook.ts b/packages/shared-ux/chrome/navigation/mocks/src/storybook.ts
index d8ed78c48e7a9..df1416ec0f793 100644
--- a/packages/shared-ux/chrome/navigation/mocks/src/storybook.ts
+++ b/packages/shared-ux/chrome/navigation/mocks/src/storybook.ts
@@ -44,6 +44,7 @@ export class StorybookMock extends AbstractStorybookMock<{}, NavigationServices>
       navLinks$: params.navLinks$ ?? new BehaviorSubject([]),
       onProjectNavigationChange: params.onProjectNavigationChange ?? (() => undefined),
       activeNodes$: params.activeNodes$ ?? new BehaviorSubject([]),
+      isSideNavCollapsed: true,
       cloudLinks: {
         billingAndSub: {
           title: 'Billing & Subscriptions',
diff --git a/packages/shared-ux/chrome/navigation/src/services.tsx b/packages/shared-ux/chrome/navigation/src/services.tsx
index ebe7846b33378..fd3f774bd72fb 100644
--- a/packages/shared-ux/chrome/navigation/src/services.tsx
+++ b/packages/shared-ux/chrome/navigation/src/services.tsx
@@ -7,6 +7,7 @@
  */
 
 import React, { FC, useContext, useMemo } from 'react';
+import useObservable from 'react-use/lib/useObservable';
 import { NavigationKibanaDependencies, NavigationServices } from '../types';
 import { CloudLinks, getCloudLinks } from './cloud_links';
 
@@ -32,6 +33,7 @@ export const NavigationKibanaProvider: FC<NavigationKibanaDependencies> = ({
   const { navigateToUrl } = core.application;
 
   const cloudLinks: CloudLinks = useMemo(() => (cloud ? getCloudLinks(cloud) : {}), [cloud]);
+  const isSideNavCollapsed = useObservable(chrome.getIsSideNavCollapsed$(), true);
 
   const value: NavigationServices = {
     basePath,
@@ -42,6 +44,7 @@ export const NavigationKibanaProvider: FC<NavigationKibanaDependencies> = ({
     onProjectNavigationChange: serverless.setNavigation,
     activeNodes$: serverless.getActiveNavigationNodes$(),
     cloudLinks,
+    isSideNavCollapsed,
   };
 
   return <Context.Provider value={value}>{children}</Context.Provider>;
diff --git a/packages/shared-ux/chrome/navigation/src/ui/__snapshots__/default_navigation.test.tsx.snap b/packages/shared-ux/chrome/navigation/src/ui/__snapshots__/default_navigation.test.tsx.snap
index 46ffd04af56d8..734d4e459a897 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/__snapshots__/default_navigation.test.tsx.snap
+++ b/packages/shared-ux/chrome/navigation/src/ui/__snapshots__/default_navigation.test.tsx.snap
@@ -10,10 +10,12 @@ Array [
         "href": undefined,
         "id": "item1",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "group1",
           "item1",
         ],
+        "sideNavStatus": "visible",
         "title": "Item 1",
       },
       Object {
@@ -28,10 +30,12 @@ Array [
         "href": undefined,
         "id": "item2",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "group1",
           "item2",
         ],
+        "sideNavStatus": "visible",
         "title": "Title from deeplink!",
       },
       Object {
@@ -46,10 +50,12 @@ Array [
         "href": undefined,
         "id": "item3",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "group1",
           "item3",
         ],
+        "sideNavStatus": "visible",
         "title": "Deeplink title overriden",
       },
     ],
@@ -57,9 +63,11 @@ Array [
     "href": undefined,
     "id": "group1",
     "isActive": false,
+    "isGroup": true,
     "path": Array [
       "group1",
     ],
+    "sideNavStatus": "visible",
     "title": "Group 1",
     "type": "navGroup",
   },
@@ -77,10 +85,12 @@ Array [
         "href": undefined,
         "id": "discover",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "rootNav:analytics",
           "discover",
         ],
+        "sideNavStatus": "visible",
         "title": "Deeplink discover",
       },
       Object {
@@ -95,10 +105,12 @@ Array [
         "href": undefined,
         "id": "dashboards",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "rootNav:analytics",
           "dashboards",
         ],
+        "sideNavStatus": "visible",
         "title": "Deeplink dashboards",
       },
       Object {
@@ -113,10 +125,12 @@ Array [
         "href": undefined,
         "id": "visualize",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "rootNav:analytics",
           "visualize",
         ],
+        "sideNavStatus": "visible",
         "title": "Deeplink visualize",
       },
     ],
@@ -125,9 +139,11 @@ Array [
     "icon": "stats",
     "id": "rootNav:analytics",
     "isActive": false,
+    "isGroup": true,
     "path": Array [
       "rootNav:analytics",
     ],
+    "sideNavStatus": "visible",
     "title": "Data exploration",
     "type": "navGroup",
   },
@@ -145,10 +161,12 @@ Array [
         "href": undefined,
         "id": "ml:overview",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "rootNav:ml",
           "ml:overview",
         ],
+        "sideNavStatus": "visible",
         "title": "Deeplink ml:overview",
       },
       Object {
@@ -163,10 +181,12 @@ Array [
         "href": undefined,
         "id": "ml:notifications",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "rootNav:ml",
           "ml:notifications",
         ],
+        "sideNavStatus": "visible",
         "title": "Deeplink ml:notifications",
       },
       Object {
@@ -183,11 +203,13 @@ Array [
             "href": undefined,
             "id": "ml:anomalyDetection",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "anomaly_detection",
               "ml:anomalyDetection",
             ],
+            "sideNavStatus": "visible",
             "title": "Jobs",
           },
           Object {
@@ -202,11 +224,13 @@ Array [
             "href": undefined,
             "id": "ml:anomalyExplorer",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "anomaly_detection",
               "ml:anomalyExplorer",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:anomalyExplorer",
           },
           Object {
@@ -221,11 +245,13 @@ Array [
             "href": undefined,
             "id": "ml:singleMetricViewer",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "anomaly_detection",
               "ml:singleMetricViewer",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:singleMetricViewer",
           },
           Object {
@@ -240,11 +266,13 @@ Array [
             "href": undefined,
             "id": "ml:settings",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "anomaly_detection",
               "ml:settings",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:settings",
           },
         ],
@@ -252,10 +280,12 @@ Array [
         "href": undefined,
         "id": "anomaly_detection",
         "isActive": false,
+        "isGroup": true,
         "path": Array [
           "rootNav:ml",
           "anomaly_detection",
         ],
+        "sideNavStatus": "visible",
         "title": "Anomaly Detection",
       },
       Object {
@@ -272,11 +302,13 @@ Array [
             "href": undefined,
             "id": "ml:dataFrameAnalytics",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "data_frame_analytics",
               "ml:dataFrameAnalytics",
             ],
+            "sideNavStatus": "visible",
             "title": "Jobs",
           },
           Object {
@@ -291,11 +323,13 @@ Array [
             "href": undefined,
             "id": "ml:resultExplorer",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "data_frame_analytics",
               "ml:resultExplorer",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:resultExplorer",
           },
           Object {
@@ -310,11 +344,13 @@ Array [
             "href": undefined,
             "id": "ml:analyticsMap",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "data_frame_analytics",
               "ml:analyticsMap",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:analyticsMap",
           },
         ],
@@ -322,10 +358,12 @@ Array [
         "href": undefined,
         "id": "data_frame_analytics",
         "isActive": false,
+        "isGroup": true,
         "path": Array [
           "rootNav:ml",
           "data_frame_analytics",
         ],
+        "sideNavStatus": "visible",
         "title": "Data Frame Analytics",
       },
       Object {
@@ -342,11 +380,13 @@ Array [
             "href": undefined,
             "id": "ml:nodesOverview",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "model_management",
               "ml:nodesOverview",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:nodesOverview",
           },
           Object {
@@ -361,11 +401,13 @@ Array [
             "href": undefined,
             "id": "ml:nodes",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "model_management",
               "ml:nodes",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:nodes",
           },
         ],
@@ -373,10 +415,12 @@ Array [
         "href": undefined,
         "id": "model_management",
         "isActive": false,
+        "isGroup": true,
         "path": Array [
           "rootNav:ml",
           "model_management",
         ],
+        "sideNavStatus": "visible",
         "title": "Model Management",
       },
       Object {
@@ -393,11 +437,13 @@ Array [
             "href": undefined,
             "id": "ml:fileUpload",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "data_visualizer",
               "ml:fileUpload",
             ],
+            "sideNavStatus": "visible",
             "title": "File",
           },
           Object {
@@ -412,11 +458,13 @@ Array [
             "href": undefined,
             "id": "ml:indexDataVisualizer",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "data_visualizer",
               "ml:indexDataVisualizer",
             ],
+            "sideNavStatus": "visible",
             "title": "Data view",
           },
           Object {
@@ -431,11 +479,13 @@ Array [
             "href": undefined,
             "id": "ml:dataDrift",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "data_visualizer",
               "ml:dataDrift",
             ],
+            "sideNavStatus": "visible",
             "title": "Data drift",
           },
         ],
@@ -443,10 +493,12 @@ Array [
         "href": undefined,
         "id": "data_visualizer",
         "isActive": false,
+        "isGroup": true,
         "path": Array [
           "rootNav:ml",
           "data_visualizer",
         ],
+        "sideNavStatus": "visible",
         "title": "Data Visualizer",
       },
       Object {
@@ -463,11 +515,13 @@ Array [
             "href": undefined,
             "id": "ml:logRateAnalysis",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "aiops_labs",
               "ml:logRateAnalysis",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:logRateAnalysis",
           },
           Object {
@@ -482,11 +536,13 @@ Array [
             "href": undefined,
             "id": "ml:logPatternAnalysis",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "aiops_labs",
               "ml:logPatternAnalysis",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:logPatternAnalysis",
           },
           Object {
@@ -501,11 +557,13 @@ Array [
             "href": undefined,
             "id": "ml:changePointDetections",
             "isActive": false,
+            "isGroup": false,
             "path": Array [
               "rootNav:ml",
               "aiops_labs",
               "ml:changePointDetections",
             ],
+            "sideNavStatus": "visible",
             "title": "Deeplink ml:changePointDetections",
           },
         ],
@@ -513,10 +571,12 @@ Array [
         "href": undefined,
         "id": "aiops_labs",
         "isActive": false,
+        "isGroup": true,
         "path": Array [
           "rootNav:ml",
           "aiops_labs",
         ],
+        "sideNavStatus": "visible",
         "title": "AIOps labs",
       },
     ],
@@ -525,9 +585,11 @@ Array [
     "icon": "machineLearningApp",
     "id": "rootNav:ml",
     "isActive": false,
+    "isGroup": true,
     "path": Array [
       "rootNav:ml",
     ],
+    "sideNavStatus": "visible",
     "title": "Machine Learning",
     "type": "navGroup",
   },
@@ -544,11 +606,13 @@ Array [
     "icon": "editorCodeBlock",
     "id": "devTools",
     "isActive": false,
+    "isGroup": false,
     "path": Array [
       "devTools",
     ],
+    "sideNavStatus": "visible",
     "title": "Developer tools",
-    "type": "navGroup",
+    "type": "navItem",
   },
   Object {
     "breadcrumbStatus": "hidden",
@@ -565,10 +629,12 @@ Array [
         "href": undefined,
         "id": "management",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "project_settings_project_nav",
           "management",
         ],
+        "sideNavStatus": "visible",
         "title": "Management",
       },
       Object {
@@ -577,10 +643,12 @@ Array [
         "href": "https://cloud.elastic.co/deployments/123456789/security/users",
         "id": "cloudLinkUserAndRoles",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "project_settings_project_nav",
           "cloudLinkUserAndRoles",
         ],
+        "sideNavStatus": "visible",
         "title": "Mock Users & Roles",
       },
       Object {
@@ -589,10 +657,12 @@ Array [
         "href": "https://cloud.elastic.co/account/billing",
         "id": "cloudLinkBilling",
         "isActive": false,
+        "isGroup": false,
         "path": Array [
           "project_settings_project_nav",
           "cloudLinkBilling",
         ],
+        "sideNavStatus": "visible",
         "title": "Mock Billing & Subscriptions",
       },
     ],
@@ -601,9 +671,11 @@ Array [
     "icon": "gear",
     "id": "project_settings_project_nav",
     "isActive": false,
+    "isGroup": true,
     "path": Array [
       "project_settings_project_nav",
     ],
+    "sideNavStatus": "visible",
     "title": "Project settings",
     "type": "navGroup",
   },
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/index.ts b/packages/shared-ux/chrome/navigation/src/ui/components/index.ts
index 2174b35603525..29de9b8d21dad 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/components/index.ts
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/index.ts
@@ -8,3 +8,4 @@
 
 export { Navigation } from './navigation';
 export type { Props as RecentlyAccessedProps } from './recently_accessed';
+export type { PanelContent, PanelComponentProps } from './panel';
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/navigation.test.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/navigation.test.tsx
index a6a40347068e3..bcf8650373b80 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/components/navigation.test.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/navigation.test.tsx
@@ -74,60 +74,114 @@ describe('<Navigation />', () => {
         onProjectNavigationChange.mock.calls[onProjectNavigationChange.mock.calls.length - 1];
       const [navTree] = lastCall;
 
-      expect(navTree.navigationTree).toEqual([
-        {
-          children: [
-            {
-              href: 'https://foo',
-              id: 'item1',
-              isActive: false,
-              path: ['group1', 'item1'],
-              title: 'Item 1',
-            },
-            {
-              href: 'https://foo',
-              id: 'item2',
-              isActive: false,
-              path: ['group1', 'item2'],
-              title: 'Item 2',
-            },
-            {
-              children: [
-                {
-                  href: 'https://foo',
-                  id: 'item1',
-                  isActive: false,
-                  path: ['group1', 'group1A', 'item1'],
-                  title: 'Group 1A Item 1',
-                },
-                {
-                  children: [
-                    {
-                      href: 'https://foo',
-                      id: 'item1',
-                      isActive: false,
-                      path: ['group1', 'group1A', 'group1A_1', 'item1'],
-                      title: 'Group 1A_1 Item 1',
-                    },
-                  ],
-                  id: 'group1A_1',
-                  isActive: true,
-                  path: ['group1', 'group1A', 'group1A_1'],
-                  title: 'Group1A_1',
-                },
-              ],
-              id: 'group1A',
-              isActive: true,
-              path: ['group1', 'group1A'],
-              title: 'Group1A',
-            },
-          ],
-          id: 'group1',
-          isActive: true,
-          path: ['group1'],
-          title: '',
-        },
-      ]);
+      expect(navTree.navigationTree).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "children": Array [
+              Object {
+                "children": undefined,
+                "deepLink": undefined,
+                "href": "https://foo",
+                "id": "item1",
+                "isActive": false,
+                "isGroup": false,
+                "path": Array [
+                  "group1",
+                  "item1",
+                ],
+                "sideNavStatus": "visible",
+                "title": "Item 1",
+              },
+              Object {
+                "children": undefined,
+                "deepLink": undefined,
+                "href": "https://foo",
+                "id": "item2",
+                "isActive": false,
+                "isGroup": false,
+                "path": Array [
+                  "group1",
+                  "item2",
+                ],
+                "sideNavStatus": "visible",
+                "title": "Item 2",
+              },
+              Object {
+                "children": Array [
+                  Object {
+                    "children": undefined,
+                    "deepLink": undefined,
+                    "href": "https://foo",
+                    "id": "item1",
+                    "isActive": false,
+                    "isGroup": false,
+                    "path": Array [
+                      "group1",
+                      "group1A",
+                      "item1",
+                    ],
+                    "sideNavStatus": "visible",
+                    "title": "Group 1A Item 1",
+                  },
+                  Object {
+                    "children": Array [
+                      Object {
+                        "children": undefined,
+                        "deepLink": undefined,
+                        "href": "https://foo",
+                        "id": "item1",
+                        "isActive": false,
+                        "isGroup": false,
+                        "path": Array [
+                          "group1",
+                          "group1A",
+                          "group1A_1",
+                          "item1",
+                        ],
+                        "sideNavStatus": "visible",
+                        "title": "Group 1A_1 Item 1",
+                      },
+                    ],
+                    "deepLink": undefined,
+                    "href": undefined,
+                    "id": "group1A_1",
+                    "isActive": true,
+                    "isGroup": true,
+                    "path": Array [
+                      "group1",
+                      "group1A",
+                      "group1A_1",
+                    ],
+                    "sideNavStatus": "visible",
+                    "title": "Group1A_1",
+                  },
+                ],
+                "deepLink": undefined,
+                "href": undefined,
+                "id": "group1A",
+                "isActive": true,
+                "isGroup": true,
+                "path": Array [
+                  "group1",
+                  "group1A",
+                ],
+                "sideNavStatus": "visible",
+                "title": "Group1A",
+              },
+            ],
+            "deepLink": undefined,
+            "href": undefined,
+            "id": "group1",
+            "isActive": true,
+            "isGroup": true,
+            "path": Array [
+              "group1",
+            ],
+            "sideNavStatus": "visible",
+            "title": "",
+          },
+        ]
+      `);
     });
 
     test('should read the title from props, children or deeplink', async () => {
@@ -172,62 +226,111 @@ describe('<Navigation />', () => {
         onProjectNavigationChange.mock.calls[onProjectNavigationChange.mock.calls.length - 1];
       const [navTree] = lastCall;
 
-      expect(navTree.navigationTree).toEqual([
-        {
-          id: 'root',
-          path: ['root'],
-          title: '',
-          isActive: false,
-          children: [
-            {
-              id: 'group1',
-              path: ['root', 'group1'],
-              title: '',
-              isActive: false,
-              children: [
-                {
-                  id: 'item1',
-                  path: ['root', 'group1', 'item1'],
-                  title: 'Title from deeplink',
-                  isActive: false,
-                  deepLink: {
-                    id: 'item1',
-                    title: 'Title from deeplink',
-                    baseUrl: '',
-                    url: '',
-                    href: '',
+      expect(navTree.navigationTree).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "children": Array [
+              Object {
+                "children": Array [
+                  Object {
+                    "children": undefined,
+                    "deepLink": Object {
+                      "baseUrl": "",
+                      "href": "",
+                      "id": "item1",
+                      "title": "Title from deeplink",
+                      "url": "",
+                    },
+                    "href": undefined,
+                    "id": "item1",
+                    "isActive": false,
+                    "isGroup": false,
+                    "path": Array [
+                      "root",
+                      "group1",
+                      "item1",
+                    ],
+                    "sideNavStatus": "visible",
+                    "title": "Title from deeplink",
                   },
-                },
-                {
-                  id: 'item2',
-                  title: 'Overwrite deeplink title',
-                  path: ['root', 'group1', 'item2'],
-                  isActive: false,
-                  deepLink: {
-                    id: 'item1',
-                    title: 'Title from deeplink',
-                    baseUrl: '',
-                    url: '',
-                    href: '',
+                  Object {
+                    "children": undefined,
+                    "deepLink": Object {
+                      "baseUrl": "",
+                      "href": "",
+                      "id": "item1",
+                      "title": "Title from deeplink",
+                      "url": "",
+                    },
+                    "href": undefined,
+                    "id": "item2",
+                    "isActive": false,
+                    "isGroup": false,
+                    "path": Array [
+                      "root",
+                      "group1",
+                      "item2",
+                    ],
+                    "sideNavStatus": "visible",
+                    "title": "Overwrite deeplink title",
                   },
-                },
-                {
-                  id: 'item3',
-                  title: 'Title in props',
-                  isActive: false,
-                  path: ['root', 'group1', 'item3'],
-                },
-                {
-                  id: 'item4',
-                  path: ['root', 'group1', 'item4'],
-                  title: 'Title in children',
-                  isActive: false,
-                },
-              ],
-            },
-          ],
-        },
-      ]);
+                  Object {
+                    "children": undefined,
+                    "deepLink": undefined,
+                    "href": undefined,
+                    "id": "item3",
+                    "isActive": false,
+                    "isGroup": false,
+                    "path": Array [
+                      "root",
+                      "group1",
+                      "item3",
+                    ],
+                    "sideNavStatus": "visible",
+                    "title": "Title in props",
+                  },
+                  Object {
+                    "children": undefined,
+                    "deepLink": undefined,
+                    "href": undefined,
+                    "id": "item4",
+                    "isActive": false,
+                    "isGroup": false,
+                    "path": Array [
+                      "root",
+                      "group1",
+                      "item4",
+                    ],
+                    "sideNavStatus": "visible",
+                    "title": "Title in children",
+                  },
+                ],
+                "deepLink": undefined,
+                "href": undefined,
+                "id": "group1",
+                "isActive": false,
+                "isGroup": true,
+                "path": Array [
+                  "root",
+                  "group1",
+                ],
+                "sideNavStatus": "visible",
+                "title": "",
+              },
+            ],
+            "deepLink": undefined,
+            "href": undefined,
+            "id": "root",
+            "isActive": false,
+            "isGroup": true,
+            "path": Array [
+              "root",
+            ],
+            "sideNavStatus": "visible",
+            "title": "",
+          },
+        ]
+      `);
     });
 
     test('should filter out unknown deeplinks', async () => {
@@ -274,37 +377,60 @@ describe('<Navigation />', () => {
         onProjectNavigationChange.mock.calls[onProjectNavigationChange.mock.calls.length - 1];
       const [navTree] = lastCall;
 
-      expect(navTree.navigationTree).toEqual([
-        {
-          id: 'root',
-          path: ['root'],
-          title: '',
-          isActive: true,
-          children: [
-            {
-              id: 'group1',
-              path: ['root', 'group1'],
-              title: '',
-              isActive: true,
-              children: [
-                {
-                  id: 'item1',
-                  path: ['root', 'group1', 'item1'],
-                  title: 'Title from deeplink',
-                  isActive: false,
-                  deepLink: {
-                    id: 'item1',
-                    title: 'Title from deeplink',
-                    baseUrl: '',
-                    url: '',
-                    href: '',
+      expect(navTree.navigationTree).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "children": Array [
+              Object {
+                "children": Array [
+                  Object {
+                    "children": undefined,
+                    "deepLink": Object {
+                      "baseUrl": "",
+                      "href": "",
+                      "id": "item1",
+                      "title": "Title from deeplink",
+                      "url": "",
+                    },
+                    "href": undefined,
+                    "id": "item1",
+                    "isActive": false,
+                    "isGroup": false,
+                    "path": Array [
+                      "root",
+                      "group1",
+                      "item1",
+                    ],
+                    "sideNavStatus": "visible",
+                    "title": "Title from deeplink",
                   },
-                },
-              ],
-            },
-          ],
-        },
-      ]);
+                ],
+                "deepLink": undefined,
+                "href": undefined,
+                "id": "group1",
+                "isActive": true,
+                "isGroup": true,
+                "path": Array [
+                  "root",
+                  "group1",
+                ],
+                "sideNavStatus": "visible",
+                "title": "",
+              },
+            ],
+            "deepLink": undefined,
+            "href": undefined,
+            "id": "root",
+            "isActive": true,
+            "isGroup": true,
+            "path": Array [
+              "root",
+            ],
+            "sideNavStatus": "visible",
+            "title": "",
+          },
+        ]
+      `);
     });
 
     test('should not render the group if it does not have children AND no href or deeplink', async () => {
@@ -350,43 +476,74 @@ describe('<Navigation />', () => {
         onProjectNavigationChange.mock.calls[onProjectNavigationChange.mock.calls.length - 1];
       const [navTree] = lastCall;
 
-      expect(navTree.navigationTree).toEqual([
-        {
-          children: [
-            {
-              id: 'group1',
-              isActive: true,
-              path: ['root', 'group1'],
-              title: '',
-            },
-            {
-              children: [
-                {
-                  deepLink: {
-                    baseUrl: '',
-                    href: '',
-                    id: 'item1',
-                    title: 'Title from deeplink',
-                    url: '',
+      expect(navTree.navigationTree).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "children": Array [
+              Object {
+                "children": undefined,
+                "deepLink": undefined,
+                "href": undefined,
+                "id": "group1",
+                "isActive": true,
+                "isGroup": true,
+                "path": Array [
+                  "root",
+                  "group1",
+                ],
+                "sideNavStatus": "visible",
+                "title": "",
+              },
+              Object {
+                "children": Array [
+                  Object {
+                    "children": undefined,
+                    "deepLink": Object {
+                      "baseUrl": "",
+                      "href": "",
+                      "id": "item1",
+                      "title": "Title from deeplink",
+                      "url": "",
+                    },
+                    "href": undefined,
+                    "id": "item1",
+                    "isActive": false,
+                    "isGroup": false,
+                    "path": Array [
+                      "root",
+                      "group2",
+                      "item1",
+                    ],
+                    "sideNavStatus": "visible",
+                    "title": "Title from deeplink",
                   },
-                  id: 'item1',
-                  isActive: false,
-                  path: ['root', 'group2', 'item1'],
-                  title: 'Title from deeplink',
-                },
-              ],
-              id: 'group2',
-              isActive: true,
-              path: ['root', 'group2'],
-              title: '',
-            },
-          ],
-          id: 'root',
-          isActive: true,
-          path: ['root'],
-          title: '',
-        },
-      ]);
+                ],
+                "deepLink": undefined,
+                "href": undefined,
+                "id": "group2",
+                "isActive": true,
+                "isGroup": true,
+                "path": Array [
+                  "root",
+                  "group2",
+                ],
+                "sideNavStatus": "visible",
+                "title": "",
+              },
+            ],
+            "deepLink": undefined,
+            "href": undefined,
+            "id": "root",
+            "isActive": true,
+            "isGroup": true,
+            "path": Array [
+              "root",
+            ],
+            "sideNavStatus": "visible",
+            "title": "",
+          },
+        ]
+      `);
     });
 
     test('should render group preset (analytics, ml...)', async () => {
@@ -467,23 +624,38 @@ describe('<Navigation />', () => {
         onProjectNavigationChange.mock.calls[onProjectNavigationChange.mock.calls.length - 1];
       const [navTreeGenerated] = lastCall;
 
-      expect(navTreeGenerated.navigationTree).toEqual([
-        {
-          id: 'group1',
-          path: ['group1'],
-          title: '',
-          isActive: false,
-          children: [
-            {
-              id: 'item1',
-              title: 'Item 1',
-              isActive: false,
-              href: 'https://example.com',
-              path: ['group1', 'item1'],
-            },
-          ],
-        },
-      ]);
+      expect(navTreeGenerated.navigationTree).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "children": Array [
+              Object {
+                "children": undefined,
+                "deepLink": undefined,
+                "href": "https://example.com",
+                "id": "item1",
+                "isActive": false,
+                "isGroup": false,
+                "path": Array [
+                  "group1",
+                  "item1",
+                ],
+                "sideNavStatus": "visible",
+                "title": "Item 1",
+              },
+            ],
+            "deepLink": undefined,
+            "href": undefined,
+            "id": "group1",
+            "isActive": false,
+            "isGroup": true,
+            "path": Array [
+              "group1",
+            ],
+            "sideNavStatus": "visible",
+            "title": "",
+          },
+        ]
+      `);
     });
 
     test('should throw if href is not an absolute links', async () => {
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/navigation.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/navigation.tsx
index 4530a0c8b6b09..83dc748047a93 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/components/navigation.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/navigation.tsx
@@ -27,6 +27,7 @@ import { NavigationGroup } from './navigation_group';
 import { NavigationItem } from './navigation_item';
 import { NavigationUI } from './navigation_ui';
 import { RecentlyAccessed } from './recently_accessed';
+import { PanelProvider, type ContentProvider } from './panel';
 
 interface Context {
   register: RegisterFunction;
@@ -47,6 +48,12 @@ const NavigationContext = createContext<Context>({
 
 interface Props {
   children: ReactNode;
+  /**
+   * Optional content provider for the navigation panels. Use it to render custom component
+   * inside the panel when the user clicks on a navigation item.
+   * If not provided the default content will be rendered.
+   */
+  panelContentProvider?: ContentProvider;
   /**
    * Flag to indicate if the Navigation should not be styled with EUI components.
    * If set to true, the children will be rendered as is.
@@ -55,7 +62,12 @@ interface Props {
   dataTestSubj?: string;
 }
 
-export function Navigation({ children, unstyled = false, dataTestSubj }: Props) {
+export function Navigation({
+  children,
+  panelContentProvider,
+  unstyled = false,
+  dataTestSubj,
+}: Props) {
   const { onProjectNavigationChange, activeNodes$ } = useNavigationServices();
 
   // We keep a reference of the order of the children that register themselves when mounting.
@@ -134,11 +146,17 @@ export function Navigation({ children, unstyled = false, dataTestSubj }: Props)
   }, [debouncedNavigationItems, onProjectNavigationChange]);
 
   return (
-    <NavigationContext.Provider value={contextValue}>
-      <NavigationUI footerChildren={footerChildren} unstyled={unstyled} dataTestSubj={dataTestSubj}>
-        {children}
-      </NavigationUI>
-    </NavigationContext.Provider>
+    <PanelProvider activeNodes={activeNodes} contentProvider={panelContentProvider}>
+      <NavigationContext.Provider value={contextValue}>
+        <NavigationUI
+          footerChildren={footerChildren}
+          unstyled={unstyled}
+          dataTestSubj={dataTestSubj}
+        >
+          {children}
+        </NavigationUI>
+      </NavigationContext.Provider>
+    </PanelProvider>
   );
 }
 
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_bucket.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_bucket.tsx
index f28bf7ce6151a..907d155cbd061 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_bucket.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_bucket.tsx
@@ -7,8 +7,9 @@
  */
 
 import React, { useCallback } from 'react';
-
 import type { AppDeepLinkId, NodeDefinition } from '@kbn/core-chrome-browser';
+
+import { getNavigationNodeId } from '../../utils';
 import { getPresets } from '../nav_tree_presets';
 import { Navigation } from './navigation';
 import type { NavigationGroupPreset } from '../types';
@@ -41,13 +42,7 @@ export function NavigationBucket<
   const renderItems = useCallback(
     (items: Array<NodeDefinition<LinkId, Id, ChildrenId>>, isRoot = false) => {
       return items.map((item) => {
-        const id = item.id ?? item.link;
-
-        if (!id) {
-          throw new Error(
-            `At least one of id or link must be defined for navigation item ${item.title}`
-          );
-        }
+        const id = getNavigationNodeId(item);
 
         return (
           <React.Fragment key={id}>
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_group.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_group.tsx
index 070f156943b27..93e451aa7f16f 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_group.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_group.tsx
@@ -7,11 +7,11 @@
  */
 
 import React, { createContext, useCallback, useMemo, useContext } from 'react';
-import type { AppDeepLinkId } from '@kbn/core-chrome-browser';
+import type { AppDeepLinkId, ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
 
 import { useNavigation as useNavigationServices } from '../../services';
 import { useInitNavNode } from '../hooks';
-import type { NodeProps, RegisterFunction } from '../types';
+import type { NodeProps, NodePropsEnhanced, RegisterFunction } from '../types';
 import { NavigationSectionUI } from './navigation_section_ui';
 import { useNavigation } from './navigation';
 import { NavigationBucket, type Props as NavigationBucketProps } from './navigation_bucket';
@@ -51,21 +51,37 @@ function NavigationGroupInternalComp<
 
   const { children, node } = useMemo(() => {
     const { children: _children, defaultIsCollapsed, ...rest } = props;
+    const nodeEnhanced: Omit<NodePropsEnhanced<LinkId, Id, ChildrenId>, 'children'> = {
+      ...rest,
+      isActive: defaultIsCollapsed !== undefined ? defaultIsCollapsed === false : undefined,
+      isGroup: true,
+    };
     return {
       children: _children,
-      node: {
-        ...rest,
-        isActive: defaultIsCollapsed !== undefined ? defaultIsCollapsed === false : undefined,
-      },
+      node: nodeEnhanced,
     };
   }, [props]);
 
   const { navNode, registerChildNode, path, childrenNodes } = useInitNavNode(node, { cloudLinks });
 
+  // We add to the nav node the children that have mounted and registered themselves.
+  // Those children render in the UI inside the NavigationSectionUI -> EuiCollapsibleNavItem -> items
+  const navNodeWithChildren = useMemo(() => {
+    if (!navNode) return null;
+
+    const hasChildren = Object.keys(childrenNodes).length > 0;
+    const withChildren: ChromeProjectNavigationNode = {
+      ...navNode,
+      children: hasChildren ? Object.values(childrenNodes) : undefined,
+    };
+
+    return withChildren;
+  }, [navNode, childrenNodes]);
+
   const unstyled = props.unstyled ?? navigationContext.unstyled;
 
   const renderContent = useCallback(() => {
-    if (!path || !navNode) {
+    if (!path || !navNodeWithChildren) {
       return null;
     }
 
@@ -74,22 +90,20 @@ function NavigationGroupInternalComp<
       return children;
     }
 
-    // Each "top level" group is rendered using the EuiCollapsibleNavGroup component
-    // inside the NavigationSectionUI. That's how we get the "collapsible" behavior.
-    const isTopLevel = path && path.length === 1;
+    // We will only render the <NavigationSectionUI /> component for root groups. The nested group
+    // are handled by the EuiCollapsibleNavItem component through its "items" prop.
+    const isRootLevel = path && path.length === 1;
 
     return (
       <>
-        {isTopLevel && (
-          <NavigationSectionUI navNode={navNode} items={Object.values(childrenNodes)} />
-        )}
-        {/* We render the children so they mount and can register themselves but
-        visually they don't appear here in the DOM. They are rendered inside the
-        <EuiCollapsibleNavItem />  "items" prop (see <NavigationSectionUI />) */}
+        {isRootLevel && <NavigationSectionUI navNode={navNodeWithChildren} />}
+        {/* We render the children so they mount and can **register** themselves but
+          visually they don't appear here in the DOM. They are rendered inside the
+          <EuiCollapsibleNavItem />  "items" prop (see <NavigationSectionUI />) */}
         {children}
       </>
     );
-  }, [navNode, path, childrenNodes, children, unstyled]);
+  }, [navNodeWithChildren, path, children, unstyled]);
 
   const contextValue = useMemo(() => {
     return {
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_item.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_item.tsx
index a48e0b771ece5..8c18f350bb0bf 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_item.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_item.tsx
@@ -7,12 +7,14 @@
  */
 
 import React, { Fragment, useEffect, useMemo } from 'react';
-
 import type { AppDeepLinkId, ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+import { EuiCollapsibleNavItem } from '@elastic/eui';
+
 import { useNavigation as useNavigationServices } from '../../services';
 import { useInitNavNode } from '../hooks';
-import type { NodeProps } from '../types';
+import type { NodeProps, NodePropsEnhanced } from '../types';
 import { useNavigation } from './navigation';
+import { getNavigationNodeHref } from '../../utils';
 
 export interface Props<
   LinkId extends AppDeepLinkId = AppDeepLinkId,
@@ -27,37 +29,75 @@ function NavigationItemComp<
   Id extends string = string,
   ChildrenId extends string = Id
 >(props: Props<LinkId, Id, ChildrenId>) {
-  const { cloudLinks } = useNavigationServices();
+  const { cloudLinks, navigateToUrl } = useNavigationServices();
   const navigationContext = useNavigation();
   const navNodeRef = React.useRef<ChromeProjectNavigationNode | null>(null);
 
   const { children, node } = useMemo(() => {
     const { children: _children, ...rest } = props;
+    const nodeEnhanced: Omit<NodePropsEnhanced<LinkId, Id, ChildrenId>, 'children'> = {
+      ...rest,
+      isGroup: false,
+    };
+    if (typeof _children === 'string') {
+      nodeEnhanced.title = nodeEnhanced.title ?? _children;
+    }
     return {
       children: _children,
-      node: rest,
+      node: nodeEnhanced,
     };
   }, [props]);
   const unstyled = props.unstyled ?? navigationContext.unstyled;
 
-  const { navNode } = useInitNavNode({ ...node, children }, { cloudLinks });
+  const { navNode } = useInitNavNode(node, { cloudLinks });
 
   useEffect(() => {
     navNodeRef.current = navNode;
   }, [navNode]);
 
-  if (!navNode || !unstyled) {
+  if (!navNode) {
     return null;
   }
 
-  if (children) {
-    if (typeof children === 'function') {
-      return children(navNode);
+  if (unstyled) {
+    if (children) {
+      if (typeof children === 'function') {
+        return children(navNode);
+      }
+      return <>{children}</>;
     }
-    return <>{children}</>;
+
+    return <Fragment>{navNode.title}</Fragment>;
+  }
+
+  const isRootLevel = navNode.path.length === 1;
+
+  if (isRootLevel) {
+    const href = getNavigationNodeHref(navNode);
+    return (
+      <EuiCollapsibleNavItem
+        id={navNode.id}
+        title={navNode.title}
+        icon={navNode.icon}
+        iconProps={{ size: 'm' }}
+        data-test-subj={`nav-item-${navNode.id}`}
+        linkProps={{
+          href,
+          onClick: (e: React.MouseEvent) => {
+            e.preventDefault();
+            e.stopPropagation();
+            if (href) {
+              navigateToUrl(href);
+            }
+          },
+        }}
+      />
+    );
   }
 
-  return <Fragment>{navNode.title}</Fragment>;
+  // We don't render anything in the UI for non root item as those register themselves on the parent (Group)
+  // updating its "childrenNodes" state which are then converted to "items" for the EuiCollapsibleNavItem component.
+  return null;
 }
 
 export const NavigationItem = React.memo(NavigationItemComp) as typeof NavigationItemComp;
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_item_open_panel.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_item_open_panel.tsx
new file mode 100644
index 0000000000000..d38c3aa336be7
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_item_open_panel.tsx
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { useCallback, type FC } from 'react';
+import { i18n } from '@kbn/i18n';
+import classNames from 'classnames';
+import { css } from '@emotion/css';
+import {
+  EuiButtonIcon,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiListGroup,
+  EuiListGroupItem,
+  type EuiThemeComputed,
+  useEuiTheme,
+  transparentize,
+} from '@elastic/eui';
+import type { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+import type { NavigateToUrlFn } from '../../../types/internal';
+import { usePanel } from './panel';
+import { nodePathToString } from '../../utils';
+
+const getStyles = (euiTheme: EuiThemeComputed<{}>) => css`
+  * {
+    // EuiListGroupItem changes the links font-weight, we need to override it
+    font-weight: ${euiTheme.font.weight.regular};
+  }
+  &.sideNavItem:hover {
+    background-color: transparent;
+  }
+  &.sideNavItem--isActive:hover,
+  &.sideNavItem--isActive {
+    background-color: ${transparentize(euiTheme.colors.lightShade, 0.5)};
+    & * {
+      font-weight: ${euiTheme.font.weight.medium};
+    }
+  }
+`;
+
+interface Props {
+  item: ChromeProjectNavigationNode;
+  navigateToUrl: NavigateToUrlFn;
+}
+
+export const NavigationItemOpenPanel: FC<Props> = ({ item, navigateToUrl }: Props) => {
+  const { euiTheme } = useEuiTheme();
+  const { open: openPanel, close: closePanel, selectedNode } = usePanel();
+  const { title, deepLink, isActive, children } = item;
+  const id = nodePathToString(item);
+  const href = deepLink?.url ?? item.href;
+
+  const itemClassNames = classNames(
+    'sideNavItem',
+    { 'sideNavItem--isActive': isActive },
+    getStyles(euiTheme)
+  );
+
+  const onLinkClick = useCallback(
+    (e: React.MouseEvent) => {
+      if (!href) {
+        return;
+      }
+      e.preventDefault();
+      navigateToUrl(href);
+      closePanel();
+    },
+    [closePanel, href, navigateToUrl]
+  );
+
+  const onIconClick = useCallback(() => {
+    openPanel(item);
+  }, [openPanel, item]);
+
+  return (
+    <EuiFlexGroup alignItems="center" gutterSize="xs">
+      <EuiFlexItem>
+        <EuiListGroup gutterSize="none">
+          <EuiListGroupItem
+            label={title}
+            href={href}
+            wrapText
+            onClick={onLinkClick}
+            className={itemClassNames}
+            color="text"
+            size="s"
+            data-test-subj={`sideNavItemLink-${id}`}
+          />
+        </EuiListGroup>
+      </EuiFlexItem>
+      {!!children && children.length > 0 && (
+        <EuiFlexItem grow={0}>
+          <EuiButtonIcon
+            display={nodePathToString(selectedNode) === id ? 'base' : 'empty'}
+            size="s"
+            color="text"
+            onClick={onIconClick}
+            iconType="spaces"
+            iconSize="m"
+            aria-label={i18n.translate('sharedUXPackages.chrome.sideNavigation.togglePanel', {
+              defaultMessage: 'Toggle panel navigation',
+            })}
+            data-test-subj={`solutionSideNavItemButton-${id}`}
+          />
+        </EuiFlexItem>
+      )}
+    </EuiFlexGroup>
+  );
+};
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_section_ui.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_section_ui.tsx
index 2d31154ddf2e3..11f7dfc898f90 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_section_ui.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_section_ui.tsx
@@ -6,38 +6,117 @@
  * Side Public License, v 1.
  */
 
-import React, { FC, useEffect, useState } from 'react';
+import React, { FC } from 'react';
 
 import {
+  EuiAccordionProps,
   EuiCollapsibleNavItem,
   EuiCollapsibleNavItemProps,
   EuiCollapsibleNavSubItemProps,
   EuiTitle,
 } from '@elastic/eui';
-import { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+import type { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
 import classnames from 'classnames';
-import type { BasePathService, NavigateToUrlFn } from '../../../types/internal';
+
+import type { NavigateToUrlFn } from '../../../types/internal';
 import { useNavigation as useServices } from '../../services';
-import { isAbsoluteLink } from '../../utils';
-
-const navigationNodeToEuiItem = (
-  item: ChromeProjectNavigationNode,
-  { navigateToUrl, basePath }: { navigateToUrl: NavigateToUrlFn; basePath: BasePathService }
-): EuiCollapsibleNavSubItemProps => {
-  const href = item.deepLink?.url ?? item.href;
-  const id = item.path ? item.path.join('.') : item.id;
+import { nodePathToString, isAbsoluteLink, getNavigationNodeHref } from '../../utils';
+import { PanelContext, usePanel } from './panel';
+import { NavigationItemOpenPanel } from './navigation_item_open_panel';
+
+const nodeHasLink = (navNode: ChromeProjectNavigationNode) =>
+  Boolean(navNode.deepLink) || Boolean(navNode.href);
+
+const nodeHasChildren = (navNode: ChromeProjectNavigationNode) => Boolean(navNode.children?.length);
+
+/**
+ * Predicate to determine if a node should be visible in the main side nav.
+ * If it is not visible it will be filtered out and not rendered.
+ */
+const itemIsVisible = (item: ChromeProjectNavigationNode) => {
+  if (item.sideNavStatus === 'hidden') return false;
+
+  const isGroupTitle = Boolean(item.isGroupTitle);
+  if (isGroupTitle) {
+    return true;
+  }
+
+  if (nodeHasLink(item)) {
+    return true;
+  }
+
+  if (nodeHasChildren(item)) {
+    return item.renderAs === 'item' ? true : item.children!.some(itemIsVisible);
+  }
+
+  return false;
+};
+
+const filterChildren = (
+  children?: ChromeProjectNavigationNode[]
+): ChromeProjectNavigationNode[] | undefined => {
+  if (!children) return undefined;
+  return children.filter(itemIsVisible);
+};
+
+const serializeNavNode = (navNode: ChromeProjectNavigationNode) => {
+  const serialized = {
+    ...navNode,
+    id: nodePathToString(navNode),
+    children: filterChildren(navNode.children),
+    href: getNavigationNodeHref(navNode),
+  };
+
+  return {
+    navNode: serialized,
+    hasChildren: nodeHasChildren(serialized),
+    hasLink: nodeHasLink(serialized),
+    isItem: serialized.renderAs === 'item' || serialized.children === undefined,
+  };
+};
+
+const isEuiCollapsibleNavItemProps = (
+  props: EuiCollapsibleNavItemProps | EuiCollapsibleNavSubItemProps
+): props is EuiCollapsibleNavItemProps => {
+  return (
+    props.title !== undefined && (props as EuiCollapsibleNavSubItemProps).renderItem === undefined
+  );
+};
+
+// Generate the EuiCollapsible props for both the root component (EuiCollapsibleNavItem) and its
+// "items" props. Both are compatible with the exception of "renderItem" which is only used for
+// sub items.
+const nodeToEuiCollapsibleNavProps = (
+  _navNode: ChromeProjectNavigationNode,
+  {
+    navigateToUrl,
+    openPanel,
+    closePanel,
+    isSideNavCollapsed,
+    treeDepth,
+  }: {
+    navigateToUrl: NavigateToUrlFn;
+    openPanel: PanelContext['open'];
+    closePanel: PanelContext['close'];
+    isSideNavCollapsed: boolean;
+    treeDepth: number;
+  }
+): { props: EuiCollapsibleNavItemProps | EuiCollapsibleNavSubItemProps; isVisible: boolean } => {
+  const { navNode, isItem, hasChildren, hasLink } = serializeNavNode(_navNode);
+
+  const { id, title, href, icon, renderAs, isActive, deepLink, isGroupTitle } = navNode;
   const isExternal = Boolean(href) && isAbsoluteLink(href!);
-  const isSelected = item.children && item.children.length > 0 ? false : item.isActive;
+  const isSelected = hasChildren ? false : isActive;
   const dataTestSubj = classnames(`nav-item`, `nav-item-${id}`, {
-    [`nav-item-deepLinkId-${item.deepLink?.id}`]: !!item.deepLink,
-    [`nav-item-id-${item.id}`]: item.id,
+    [`nav-item-deepLinkId-${deepLink?.id}`]: !!deepLink,
+    [`nav-item-id-${id}`]: id,
     [`nav-item-isActive`]: isSelected,
   });
 
   // Note: this can be replaced with an `isGroup` API or whatever you prefer
   // Could also probably be pulled out to a separate component vs inlined
-  if (item.isGroupTitle) {
-    return {
+  if (isGroupTitle) {
+    const props: EuiCollapsibleNavSubItemProps = {
       renderItem: () => (
         <EuiTitle
           size="xxxs"
@@ -49,128 +128,109 @@ const navigationNodeToEuiItem = (
           })}
         >
           <div id={id} data-test-subj={dataTestSubj}>
-            {item.title}
+            {title}
           </div>
         </EuiTitle>
       ),
     };
+    return { props, isVisible: true };
   }
 
-  return {
-    id,
-    title: item.title,
-    isSelected,
-    accordionProps: {
-      ...item.accordionProps,
-      initialIsOpen: true, // FIXME open state is controlled on component mount
-    },
-    linkProps: { external: isExternal },
-    onClick:
-      href !== undefined
-        ? (event: React.MouseEvent) => {
-            event.preventDefault();
+  if (renderAs === 'panelOpener') {
+    const props: EuiCollapsibleNavSubItemProps = {
+      renderItem: () => <NavigationItemOpenPanel item={navNode} navigateToUrl={navigateToUrl} />,
+    };
+    return { props, isVisible: true };
+  }
+
+  const onClick = (e: React.MouseEvent) => {
+    if (href !== undefined) {
+      e.preventDefault();
+      navigateToUrl(href);
+      closePanel();
+      return;
+    }
+  };
+
+  const items: EuiCollapsibleNavItemProps['items'] = isItem
+    ? undefined
+    : navNode.children
+        ?.map((child) =>
+          nodeToEuiCollapsibleNavProps(child, {
+            navigateToUrl,
+            openPanel,
+            closePanel,
+            isSideNavCollapsed,
+            treeDepth: treeDepth + 1,
+          })
+        )
+        .filter(({ isVisible }) => isVisible)
+        .map((res) => res.props);
+
+  const linkProps: EuiCollapsibleNavItemProps['linkProps'] | undefined = hasLink
+    ? {
+        href,
+        external: isExternal,
+        onClick: (e: React.MouseEvent) => {
+          // TODO: here we might want to toggle the accordion (if we "renderAs: 'accordion'")
+          // Will be done in following PR
+          e.preventDefault();
+          e.stopPropagation();
+          if (href) {
             navigateToUrl(href);
           }
-        : undefined,
+        },
+      }
+    : undefined;
+
+  const accordionProps: Partial<EuiAccordionProps> | undefined = isItem
+    ? undefined
+    : {
+        initialIsOpen: treeDepth === 0 ? isActive : true, // FIXME open state is controlled on component mount
+        ...navNode.accordionProps,
+      };
+
+  const props: EuiCollapsibleNavItemProps = {
+    id,
+    title,
+    isSelected,
+    accordionProps,
+    linkProps,
+    onClick,
     href,
-    items: item.children?.map((_item) =>
-      navigationNodeToEuiItem(_item, { navigateToUrl, basePath })
-    ),
+    items,
     ['data-test-subj']: dataTestSubj,
-    icon: item.icon,
-    iconProps: { size: 's' },
+    icon,
+    iconProps: { size: treeDepth === 0 ? 'm' : 's' },
   };
+
+  const hasVisibleChildren = (items?.length ?? 0) > 0;
+  return { props, isVisible: isItem || hasVisibleChildren };
 };
 
 interface Props {
   navNode: ChromeProjectNavigationNode;
-  items?: ChromeProjectNavigationNode[];
 }
 
-export const NavigationSectionUI: FC<Props> = ({ navNode, items = [] }) => {
-  const { id, title, icon, isActive } = navNode;
-  const { navigateToUrl, basePath } = useServices();
-  const [isCollapsed, setIsCollapsed] = useState(!isActive);
-  // We want to auto expand the group automatically if the node is active (URL match)
-  // but once the user manually expand a group we don't want to close it afterward automatically.
-  const [doCollapseFromActiveState, setDoCollapseFromActiveState] = useState(true);
-
-  // If the item has no link and no cildren, we don't want to render it
-  const itemHasLinkOrChildren = (item: ChromeProjectNavigationNode) => {
-    const isGroupTitle = Boolean(item.isGroupTitle);
-    const hasLink = Boolean(item.deepLink) || Boolean(item.href);
-    if (isGroupTitle) {
-      return true;
-    }
-    if (hasLink) {
-      return true;
-    }
-    const hasChildren = Boolean(item.children?.length);
-    if (hasChildren) {
-      return item.children!.some(itemHasLinkOrChildren);
-    }
-    return false;
-  };
+export const NavigationSectionUI: FC<Props> = ({ navNode }) => {
+  const { navigateToUrl, isSideNavCollapsed } = useServices();
+  const { open: openPanel, close: closePanel } = usePanel();
 
-  const filteredItems = items.filter(itemHasLinkOrChildren).map((item) => {
-    if (item.children) {
-      return {
-        ...item,
-        children: item.children.filter(itemHasLinkOrChildren),
-      };
-    }
-    return item;
+  const { props, isVisible } = nodeToEuiCollapsibleNavProps(navNode, {
+    navigateToUrl,
+    openPanel,
+    closePanel,
+    isSideNavCollapsed,
+    treeDepth: 0,
   });
 
-  const groupHasLink = Boolean(navNode.deepLink) || Boolean(navNode.href);
-  const groupHasChildren = filteredItems.some(itemHasLinkOrChildren);
-  // Group with a link and no children will be rendered as a link and not an EUI accordion
-  const groupIsLink = groupHasLink && !groupHasChildren;
-  const groupHref = navNode.deepLink?.url ?? navNode.href!;
-
-  useEffect(() => {
-    if (doCollapseFromActiveState) {
-      setIsCollapsed(!isActive);
-    }
-  }, [isActive, doCollapseFromActiveState]);
+  if (!isEuiCollapsibleNavItemProps(props)) {
+    throw new Error(`Invalid EuiCollapsibleNavItem props for node ${props.id}`);
+  }
 
-  if (!groupHasLink && !groupHasChildren) {
+  if (!isVisible) {
     return null;
   }
 
-  const propsForGroupAsLink: Partial<EuiCollapsibleNavItemProps> = groupIsLink
-    ? {
-        linkProps: {
-          href: groupHref,
-          onClick: (e: React.MouseEvent) => {
-            e.preventDefault();
-            e.stopPropagation();
-            navigateToUrl(groupHref);
-          },
-        },
-      }
-    : {};
-
-  return (
-    <EuiCollapsibleNavItem
-      id={id}
-      title={title}
-      icon={icon}
-      iconProps={{ size: 'm' }}
-      accordionProps={{
-        initialIsOpen: isActive,
-        forceState: isCollapsed ? 'closed' : 'open',
-        onToggle: (isOpen) => {
-          setIsCollapsed(!isOpen);
-          setDoCollapseFromActiveState(false);
-        },
-        ...navNode.accordionProps,
-      }}
-      data-test-subj={`nav-bucket-${id}`}
-      {...propsForGroupAsLink}
-      items={filteredItems.map((item) =>
-        navigationNodeToEuiItem(item, { navigateToUrl, basePath })
-      )}
-    />
-  );
+  return <EuiCollapsibleNavItem {...props} />;
 };
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_ui.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_ui.tsx
index 039823daa9a17..60424c1f4d03d 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/components/navigation_ui.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/navigation_ui.tsx
@@ -9,6 +9,8 @@
 import { EuiCollapsibleNavBeta } from '@elastic/eui';
 import React, { FC } from 'react';
 
+import { NavigationPanel } from './panel';
+
 interface Props {
   unstyled?: boolean;
   footerChildren?: React.ReactNode;
@@ -22,12 +24,16 @@ export const NavigationUI: FC<Props> = ({ children, unstyled, footerChildren, da
         <>{children}</>
       ) : (
         <>
+          {/* Main navigation content */}
           <EuiCollapsibleNavBeta.Body data-test-subj={dataTestSubj}>
             {children}
           </EuiCollapsibleNavBeta.Body>
           {footerChildren && (
             <EuiCollapsibleNavBeta.Footer>{footerChildren}</EuiCollapsibleNavBeta.Footer>
           )}
+
+          {/* Right side panel navigation */}
+          <NavigationPanel />
         </>
       )}
     </>
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/context.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/panel/context.tsx
new file mode 100644
index 0000000000000..f9720a38a6655
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/context.tsx
@@ -0,0 +1,97 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { type FC, useCallback, useContext, useMemo, useState, ReactNode } from 'react';
+import type { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+
+import { nodePathToString } from '../../../utils';
+import { DefaultContent } from './default_content';
+import { ContentProvider, PanelNavNode } from './types';
+
+export interface PanelContext {
+  isOpen: boolean;
+  toggle: () => void;
+  open: (navNode: PanelNavNode) => void;
+  close: () => void;
+  /** The selected node is the node in the main panel that opens the Panel */
+  selectedNode: PanelNavNode | null;
+  /** Handler to retrieve the component to render in the panel */
+  getContent: () => React.ReactNode;
+}
+
+const Context = React.createContext<PanelContext | null>(null);
+
+interface Props {
+  contentProvider?: ContentProvider;
+  activeNodes: ChromeProjectNavigationNode[][];
+}
+
+export const PanelProvider: FC<Props> = ({ children, contentProvider, activeNodes }) => {
+  const [isOpen, setIsOpen] = useState(false);
+  const [selectedNode, setActiveNode] = useState<PanelNavNode | null>(null);
+
+  const toggle = useCallback(() => {
+    setIsOpen((prev) => !prev);
+  }, []);
+
+  const open = useCallback((navNode: PanelNavNode) => {
+    setActiveNode(navNode);
+    setIsOpen(true);
+  }, []);
+
+  const close = useCallback(() => {
+    setActiveNode(null);
+    setIsOpen(false);
+  }, []);
+
+  const getContent = useCallback(() => {
+    if (!selectedNode) {
+      return null;
+    }
+
+    const provided = contentProvider?.(nodePathToString(selectedNode));
+
+    if (!provided) {
+      return <DefaultContent selectedNode={selectedNode} />;
+    }
+
+    if (provided.content) {
+      const Component = provided.content;
+      return <Component closePanel={close} selectedNode={selectedNode} activeNodes={activeNodes} />;
+    }
+
+    const title: string | ReactNode = provided.title ?? selectedNode.title;
+    return <DefaultContent selectedNode={{ ...selectedNode, title }} />;
+  }, [selectedNode, contentProvider, close, activeNodes]);
+
+  const ctx: PanelContext = useMemo(
+    () => ({
+      isOpen,
+      toggle,
+      open,
+      close,
+      selectedNode,
+      getContent,
+    }),
+    [isOpen, toggle, open, close, selectedNode, getContent]
+  );
+
+  return <Context.Provider value={ctx}>{children}</Context.Provider>;
+};
+
+export function usePanel() {
+  const context = useContext(Context);
+
+  if (!context) {
+    throw new Error(
+      'Panel Context is missing. Ensure your component or React root is wrapped with PanelProvider.'
+    );
+  }
+
+  return context;
+}
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/default_content.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/panel/default_content.tsx
new file mode 100644
index 0000000000000..fd1c56884f17a
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/default_content.tsx
@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
+import { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+import React, { Fragment, type FC } from 'react';
+
+import { isGroupNode, isItemNode } from '../../../utils';
+import { PanelGroup } from './panel_group';
+import { PanelNavItem } from './panel_nav_item';
+import type { PanelNavNode } from './types';
+
+/**
+ * All the children of a panel must be wrapped into groups. This is because a group in DOM is represented by <ul> tags
+ * inside the <EuiListGroup/> which then renders the items in <li> insid the <EuiListGroupItem /> component.
+ * Having <li> without <ul> is okayish but semantically it is not correct.
+ * This function checks if we only have items and automatically wraps them into a group. If there is a mix
+ * of items and groups it throws an error.
+ *
+ * @param node The current active node
+ * @returns The children serialized
+ */
+function serializeChildren(node: PanelNavNode): ChromeProjectNavigationNode[] | undefined {
+  if (!node.children) return undefined;
+
+  const allChildrenAreItems = node.children.every((_node) => {
+    if (isItemNode(_node)) return true;
+    return _node.renderAs === 'item';
+  });
+
+  if (allChildrenAreItems) {
+    // Automatically wrap all the children into top level "root" group.
+    return [
+      {
+        id: 'root',
+        title: '',
+        path: [...node.path, 'root'],
+        children: [...node.children],
+      },
+    ];
+  }
+
+  const allChildrenAreGroups = node.children.every((_node) => {
+    if (_node.renderAs === 'item') return false;
+    return isGroupNode(_node);
+  });
+
+  if (!allChildrenAreGroups) {
+    throw new Error(
+      `[Chrome navigation] Error in node [${node.id}]. Children must either all be "groups" or all "items" but not a mix of both.`
+    );
+  }
+
+  return node.children;
+}
+
+interface Props {
+  /** The selected node is the node in the main panel that opens the Panel */
+  selectedNode: PanelNavNode;
+}
+
+export const DefaultContent: FC<Props> = ({ selectedNode }) => {
+  const filteredChildren = selectedNode.children?.filter(
+    (child) => child.sideNavStatus !== 'hidden'
+  );
+  const serializedChildren = serializeChildren({ ...selectedNode, children: filteredChildren });
+  const totalChildren = serializedChildren?.length ?? 0;
+  const firstChildIsGroup = !!serializedChildren?.[0]?.children;
+  const firstGroupTitle = firstChildIsGroup && serializedChildren?.[0]?.title;
+  const firstGroupHasTitle = !!firstGroupTitle;
+
+  return (
+    <EuiFlexGroup direction="column" gutterSize="m" alignItems="flexStart">
+      <EuiFlexItem>
+        {typeof selectedNode.title === 'string' ? (
+          <EuiTitle size="xxs">
+            <h2>{selectedNode.title}</h2>
+          </EuiTitle>
+        ) : (
+          selectedNode.title
+        )}
+      </EuiFlexItem>
+
+      <EuiFlexItem style={{ width: '100%' }}>
+        <>
+          {firstGroupHasTitle && <EuiSpacer size="l" />}
+
+          {serializedChildren && (
+            <>
+              {serializedChildren.map((child, i) => {
+                const hasHorizontalRuleBefore =
+                  i === 0 ? false : !!serializedChildren?.[i - 1]?.appendHorizontalRule;
+                const isGroup = !!child.children;
+                return isGroup ? (
+                  <Fragment key={child.id}>
+                    <PanelGroup
+                      navNode={child}
+                      isFirstInList={i === 0}
+                      hasHorizontalRuleBefore={hasHorizontalRuleBefore}
+                    />
+                    {i < totalChildren - 1 && (
+                      <EuiSpacer size={child.appendHorizontalRule ? 'm' : 'l'} />
+                    )}
+                  </Fragment>
+                ) : (
+                  <PanelNavItem key={child.id} item={child} />
+                );
+              })}
+            </>
+          )}
+        </>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/index.ts b/packages/shared-ux/chrome/navigation/src/ui/components/panel/index.ts
new file mode 100644
index 0000000000000..23885330ee5f8
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { NavigationPanel } from './navigation_panel';
+
+export { PanelProvider, usePanel } from './context';
+export type { PanelContext } from './context';
+export type { ContentProvider, PanelContent, PanelComponentProps } from './types';
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/label_badge.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/panel/label_badge.tsx
new file mode 100644
index 0000000000000..488b9a377cfcd
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/label_badge.tsx
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { css } from '@emotion/react';
+import { EuiBetaBadge, useEuiTheme } from '@elastic/eui';
+
+export const BETA_LABEL = i18n.translate('sharedUXPackages.chrome.sideNavigation.betaBadge.label', {
+  defaultMessage: 'Beta',
+});
+
+export const LabelBadge = ({
+  text = BETA_LABEL,
+  className,
+}: {
+  /** Optional text for the badge. @default 'Beta' */
+  text?: string;
+  className?: string;
+}) => {
+  const { euiTheme } = useEuiTheme();
+
+  return (
+    <EuiBetaBadge
+      label={text}
+      size="s"
+      css={css`
+        margin-left: ${euiTheme.size.s};
+        color: ${euiTheme.colors.text};
+        vertical-align: middle;
+        margin-bottom: ${euiTheme.size.xxs};
+      `}
+      className={className}
+    />
+  );
+};
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/navigation_panel.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/panel/navigation_panel.tsx
new file mode 100644
index 0000000000000..8cefab48569d3
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/navigation_panel.tsx
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import {
+  EuiFocusTrap,
+  EuiOutsideClickDetector,
+  EuiPanel,
+  EuiWindowEvent,
+  keys,
+  useEuiTheme,
+} from '@elastic/eui';
+import React, { useCallback, type FC } from 'react';
+import classNames from 'classnames';
+
+import { usePanel } from './context';
+import { getNavPanelStyles, getPanelWrapperStyles } from './styles';
+
+export const NavigationPanel: FC = () => {
+  const { euiTheme } = useEuiTheme();
+  const { isOpen, close, getContent } = usePanel();
+
+  // ESC key closes PanelNav
+  const onKeyDown = useCallback(
+    (ev: KeyboardEvent) => {
+      if (ev.key === keys.ESCAPE) {
+        close();
+      }
+    },
+    [close]
+  );
+
+  const onOutsideClick = useCallback(() => {
+    close();
+  }, [close]);
+
+  const panelWrapperClasses = getPanelWrapperStyles();
+  const sideNavPanelStyles = getNavPanelStyles(euiTheme);
+  const panelClasses = classNames('sideNavPanel', 'eui-yScroll', sideNavPanelStyles);
+
+  if (!isOpen) {
+    return null;
+  }
+
+  return (
+    <>
+      <EuiWindowEvent event="keydown" handler={onKeyDown} />
+      <div className={panelWrapperClasses}>
+        <EuiFocusTrap autoFocus css={{ height: '100%' }}>
+          <EuiOutsideClickDetector onOutsideClick={onOutsideClick}>
+            <EuiPanel
+              className={panelClasses}
+              hasShadow
+              borderRadius="none"
+              paddingSize="m"
+              data-test-subj="sideNavPanel"
+            >
+              {getContent()}
+            </EuiPanel>
+          </EuiOutsideClickDetector>
+        </EuiFocusTrap>
+      </div>
+    </>
+  );
+};
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_group.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_group.tsx
new file mode 100644
index 0000000000000..711adf401e7b1
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_group.tsx
@@ -0,0 +1,126 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import React, { FC, Fragment, useCallback } from 'react';
+import {
+  EuiListGroup,
+  EuiTitle,
+  useEuiTheme,
+  euiFontSize,
+  type EuiThemeComputed,
+  type UseEuiTheme,
+  EuiSpacer,
+  EuiAccordion,
+  EuiHorizontalRule,
+} from '@elastic/eui';
+import { css } from '@emotion/css';
+
+import { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+import { PanelNavItem } from './panel_nav_item';
+
+const accordionButtonClassName = 'sideNavPanelAccordion__button';
+
+const getClassnames = (euiTheme: EuiThemeComputed<{}>) => ({
+  title: css`
+    text-transform: uppercase;
+    color: ${euiTheme.colors.darkShade};
+    padding-left: ${euiTheme.size.s};
+    padding-bottom: ${euiTheme.size.s};
+    ${euiFontSize({ euiTheme } as UseEuiTheme<{}>, 'xxs')}
+    font-weight: ${euiTheme.font.weight.medium};
+  `,
+  accordion: css`
+    margin-bottom: ${euiTheme.size.s};
+    .${accordionButtonClassName} {
+      font-weight: ${euiTheme.font.weight.bold};
+      ${euiFontSize({ euiTheme } as UseEuiTheme<{}>, 'xs')}
+    }
+  `,
+});
+
+interface Props {
+  navNode: ChromeProjectNavigationNode;
+  /** Flag to indicate if the group is the first in the list of groups when looping */
+  isFirstInList?: boolean;
+  /** Flag to indicate if an horizontal rule preceeds this group */
+  hasHorizontalRuleBefore?: boolean;
+}
+
+export const PanelGroup: FC<Props> = ({ navNode, isFirstInList, hasHorizontalRuleBefore }) => {
+  const { euiTheme } = useEuiTheme();
+  const { id, title, appendHorizontalRule } = navNode;
+  const filteredChildren = navNode.children?.filter((child) => child.sideNavStatus !== 'hidden');
+  const totalChildren = filteredChildren?.length ?? 0;
+  const classNames = getClassnames(euiTheme);
+  const hasTitle = !!title && title !== '';
+  const removePaddingTop = !hasTitle && !isFirstInList;
+  const someChildIsGroup = filteredChildren?.some((child) => !!child.children);
+  const firstChildIsGroup = !!filteredChildren?.[0]?.children;
+
+  const renderChildren = useCallback(() => {
+    if (!filteredChildren) return null;
+
+    return filteredChildren.map((item, i) => {
+      const isItem = item.renderAs === 'item' || !item.children;
+      return isItem ? (
+        <PanelNavItem key={item.id} item={item} />
+      ) : (
+        <Fragment key={item.id}>
+          <PanelGroup navNode={item} />
+          {i < totalChildren - 1 && <EuiSpacer />}
+        </Fragment>
+      );
+    });
+  }, [filteredChildren, totalChildren]);
+
+  if (!filteredChildren?.length) {
+    return null;
+  }
+
+  if (navNode.renderAs === 'accordion') {
+    return (
+      <>
+        <EuiAccordion
+          id={id}
+          buttonContent={title}
+          className={classNames.accordion}
+          buttonClassName={accordionButtonClassName}
+        >
+          <>
+            <EuiSpacer size={firstChildIsGroup ? 'l' : 's'} />
+            {renderChildren()}
+          </>
+        </EuiAccordion>
+        {appendHorizontalRule && <EuiHorizontalRule margin="xs" />}
+      </>
+    );
+  }
+
+  return (
+    <>
+      {hasTitle && (
+        <EuiTitle size="xxxs" className={classNames.title}>
+          <h2>{navNode.title}</h2>
+        </EuiTitle>
+      )}
+      <EuiListGroup
+        css={{
+          paddingLeft: 0,
+          paddingRight: 0,
+          paddingTop: removePaddingTop ? 0 : undefined,
+          marginTop:
+            hasHorizontalRuleBefore && !hasTitle ? `calc(${euiTheme.size.s} * -1)` : undefined,
+          // Remove the gap between groups if some items are groups
+          gap: someChildIsGroup ? 0 : undefined,
+        }}
+      >
+        {renderChildren()}
+      </EuiListGroup>
+      {appendHorizontalRule && <EuiHorizontalRule margin="xs" />}
+    </>
+  );
+};
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_nav_item.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_nav_item.tsx
new file mode 100644
index 0000000000000..651408697169a
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_nav_item.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { FC, useCallback } from 'react';
+import type { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+import { EuiListGroupItem } from '@elastic/eui';
+
+import { useNavigation as useServices } from '../../../services';
+import { NavItemLabel } from './panel_nav_item_label';
+import { usePanel } from './context';
+
+interface Props {
+  item: ChromeProjectNavigationNode;
+}
+
+export const PanelNavItem: FC<Props> = ({ item }) => {
+  const { navigateToUrl } = useServices();
+  const { close: closePanel } = usePanel();
+  const { id, icon, deepLink, openInNewTab } = item;
+  const href = deepLink?.url ?? item.href;
+
+  const onClick = useCallback<React.MouseEventHandler>(
+    (e) => {
+      if (!!href) {
+        e.preventDefault();
+        navigateToUrl(href);
+        closePanel();
+      }
+    },
+    [closePanel, href, navigateToUrl]
+  );
+
+  return (
+    <EuiListGroupItem
+      key={id}
+      label={<NavItemLabel item={item} />}
+      wrapText
+      className="sideNavPanelLink"
+      size="s"
+      data-test-subj={`nav-item-id-${item.id}`}
+      href={href}
+      iconType={icon}
+      onClick={onClick}
+      target={openInNewTab ? '_blank' : undefined}
+    />
+  );
+};
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_nav_item_label.tsx b/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_nav_item_label.tsx
new file mode 100644
index 0000000000000..591150d1e3596
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/panel_nav_item_label.tsx
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { EuiIcon } from '@elastic/eui';
+import type { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+
+import { LabelBadge } from './label_badge';
+
+export const NavItemLabel: React.FC<{
+  item: ChromeProjectNavigationNode;
+}> = ({ item: { title, openInNewTab, withBadge, badgeOptions } }) => {
+  return (
+    <>
+      {title} {openInNewTab && <EuiIcon type="popout" size="s" />}
+      {withBadge && <LabelBadge text={badgeOptions?.text} />}
+    </>
+  );
+};
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/styles.ts b/packages/shared-ux/chrome/navigation/src/ui/components/panel/styles.ts
new file mode 100644
index 0000000000000..3dabf39350cae
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/styles.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { transparentize, type EuiThemeComputed } from '@elastic/eui';
+import { css } from '@emotion/css';
+
+const PANEL_WIDTH = '270px';
+
+export const getPanelWrapperStyles = () => css`
+  clip-path: polygon(
+    0 0,
+    150% 0,
+    150% 100%,
+    0 100%
+  ); /* Clip the left side to avoid leaking the shadow on that side */
+  height: 100%;
+  left: calc(100% + 1px); /* Add 1 px so we see the right border */
+  position: absolute;
+  top: 0;
+`;
+
+export const getNavPanelStyles = (euiTheme: EuiThemeComputed<{}>) => css`
+  background-color: ${euiTheme.colors.body};
+  height: 100%;
+  width: ${PANEL_WIDTH};
+
+  .sideNavPanelLink {
+    &:focus-within {
+      background-color: transparent;
+      a {
+        text-decoration: auto;
+      }
+    }
+    &:hover {
+      background-color: ${transparentize(euiTheme.colors.primary, 0.1)};
+      a {
+        text-decoration: underline;
+      }
+    }
+  }
+`;
diff --git a/packages/shared-ux/chrome/navigation/src/ui/components/panel/types.ts b/packages/shared-ux/chrome/navigation/src/ui/components/panel/types.ts
new file mode 100644
index 0000000000000..25b2e00c83a81
--- /dev/null
+++ b/packages/shared-ux/chrome/navigation/src/ui/components/panel/types.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { ReactNode, ComponentType } from 'react';
+import type { ChromeProjectNavigationNode } from '@kbn/core-chrome-browser';
+
+export interface PanelComponentProps {
+  /** Handler to close the panel */
+  closePanel: () => void;
+  /** The node in the main panel that opens the secondary panel */
+  selectedNode: PanelNavNode;
+  /** Jagged array of active nodes that match the current URL location  */
+  activeNodes: ChromeProjectNavigationNode[][];
+}
+
+export interface PanelContent {
+  title?: ReactNode | string;
+  content?: ComponentType<PanelComponentProps>;
+}
+
+export type ContentProvider = (nodeId: string) => PanelContent | void;
+
+export type PanelNavNode = Pick<
+  ChromeProjectNavigationNode,
+  'id' | 'children' | 'path' | 'sideNavStatus'
+> & {
+  title: string | ReactNode;
+};
diff --git a/packages/shared-ux/chrome/navigation/src/ui/default_navigation.test.tsx b/packages/shared-ux/chrome/navigation/src/ui/default_navigation.test.tsx
index 9a6c9d5598a75..61b2c850851e1 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/default_navigation.test.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/default_navigation.test.tsx
@@ -108,10 +108,12 @@ describe('<DefaultNavigation />', () => {
                 "href": "http://foo",
                 "id": "item1",
                 "isActive": false,
+                "isGroup": false,
                 "path": Array [
                   "group1",
                   "item1",
                 ],
+                "sideNavStatus": "visible",
                 "title": "Item 1",
               },
               Object {
@@ -120,10 +122,12 @@ describe('<DefaultNavigation />', () => {
                 "href": "http://foo",
                 "id": "item2",
                 "isActive": false,
+                "isGroup": false,
                 "path": Array [
                   "group1",
                   "item2",
                 ],
+                "sideNavStatus": "visible",
                 "title": "Item 2",
               },
               Object {
@@ -134,11 +138,13 @@ describe('<DefaultNavigation />', () => {
                     "href": "http://foo",
                     "id": "item1",
                     "isActive": false,
+                    "isGroup": false,
                     "path": Array [
                       "group1",
                       "group1A",
                       "item1",
                     ],
+                    "sideNavStatus": "visible",
                     "title": "Group 1A Item 1",
                   },
                   Object {
@@ -149,12 +155,14 @@ describe('<DefaultNavigation />', () => {
                         "href": "http://foo",
                         "id": "item1",
                         "isActive": false,
+                        "isGroup": false,
                         "path": Array [
                           "group1",
                           "group1A",
                           "group1A_1",
                           "item1",
                         ],
+                        "sideNavStatus": "visible",
                         "title": "Group 1A_1 Item 1",
                       },
                     ],
@@ -162,11 +170,13 @@ describe('<DefaultNavigation />', () => {
                     "href": undefined,
                     "id": "group1A_1",
                     "isActive": false,
+                    "isGroup": true,
                     "path": Array [
                       "group1",
                       "group1A",
                       "group1A_1",
                     ],
+                    "sideNavStatus": "visible",
                     "title": "Group1A_1",
                   },
                 ],
@@ -174,10 +184,12 @@ describe('<DefaultNavigation />', () => {
                 "href": undefined,
                 "id": "group1A",
                 "isActive": false,
+                "isGroup": true,
                 "path": Array [
                   "group1",
                   "group1A",
                 ],
+                "sideNavStatus": "visible",
                 "title": "Group1A",
               },
             ],
@@ -185,9 +197,11 @@ describe('<DefaultNavigation />', () => {
             "href": undefined,
             "id": "group1",
             "isActive": false,
+            "isGroup": true,
             "path": Array [
               "group1",
             ],
+            "sideNavStatus": "visible",
             "title": "",
             "type": "navGroup",
           },
@@ -274,11 +288,13 @@ describe('<DefaultNavigation />', () => {
                     "href": undefined,
                     "id": "item1",
                     "isActive": false,
+                    "isGroup": false,
                     "path": Array [
                       "root",
                       "group1",
                       "item1",
                     ],
+                    "sideNavStatus": "visible",
                     "title": "Title from deeplink",
                   },
                   Object {
@@ -293,11 +309,13 @@ describe('<DefaultNavigation />', () => {
                     "href": undefined,
                     "id": "item2",
                     "isActive": false,
+                    "isGroup": false,
                     "path": Array [
                       "root",
                       "group1",
                       "item2",
                     ],
+                    "sideNavStatus": "visible",
                     "title": "Overwrite deeplink title",
                   },
                 ],
@@ -305,10 +323,12 @@ describe('<DefaultNavigation />', () => {
                 "href": undefined,
                 "id": "group1",
                 "isActive": false,
+                "isGroup": true,
                 "path": Array [
                   "root",
                   "group1",
                 ],
+                "sideNavStatus": "visible",
                 "title": "",
               },
             ],
@@ -316,9 +336,11 @@ describe('<DefaultNavigation />', () => {
             "href": undefined,
             "id": "root",
             "isActive": false,
+            "isGroup": true,
             "path": Array [
               "root",
             ],
+            "sideNavStatus": "visible",
             "title": "",
             "type": "navGroup",
           },
@@ -375,11 +397,13 @@ describe('<DefaultNavigation />', () => {
                     "href": "https://example.com",
                     "id": "item1",
                     "isActive": false,
+                    "isGroup": false,
                     "path": Array [
                       "root",
                       "group1",
                       "item1",
                     ],
+                    "sideNavStatus": "visible",
                     "title": "Absolute link",
                   },
                 ],
@@ -387,10 +411,12 @@ describe('<DefaultNavigation />', () => {
                 "href": undefined,
                 "id": "group1",
                 "isActive": false,
+                "isGroup": true,
                 "path": Array [
                   "root",
                   "group1",
                 ],
+                "sideNavStatus": "visible",
                 "title": "",
               },
             ],
@@ -398,9 +424,11 @@ describe('<DefaultNavigation />', () => {
             "href": undefined,
             "id": "root",
             "isActive": false,
+            "isGroup": true,
             "path": Array [
               "root",
             ],
+            "sideNavStatus": "visible",
             "title": "",
             "type": "navGroup",
           },
diff --git a/packages/shared-ux/chrome/navigation/src/ui/default_navigation.tsx b/packages/shared-ux/chrome/navigation/src/ui/default_navigation.tsx
index 2457fa44a5096..f423ba98d04a7 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/default_navigation.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/default_navigation.tsx
@@ -6,34 +6,53 @@
  * Side Public License, v 1.
  */
 
-import React, { FC, useCallback } from 'react';
+import React, { FC, useCallback, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 import type { AppDeepLinkId, NodeDefinition } from '@kbn/core-chrome-browser';
 
+import { getNavigationNodeId } from '../utils';
 import { Navigation } from './components';
 import type {
   GroupDefinition,
-  NavigationGroupPreset,
+  PresetDefinition,
   NavigationTreeDefinition,
   ProjectNavigationDefinition,
   ProjectNavigationTreeDefinition,
   RootNavigationItemDefinition,
+  RecentlyAccessedDefinition,
 } from './types';
 import { RecentlyAccessed } from './components/recently_accessed';
 import { NavigationFooter } from './components/navigation_footer';
 import { getPresets } from './nav_tree_presets';
+import type { ContentProvider } from './components/panel';
 
-type NodeDefinitionWithPreset = NodeDefinition<AppDeepLinkId, string> & {
-  preset?: NavigationGroupPreset;
+const isPresetDefinition = (
+  item: RootNavigationItemDefinition | NodeDefinition
+): item is PresetDefinition => {
+  return (item as PresetDefinition).preset !== undefined;
 };
 
-const isRootNavigationItemDefinition = (
-  item: RootNavigationItemDefinition | NodeDefinitionWithPreset
-): item is RootNavigationItemDefinition => {
-  // Only RootNavigationItemDefinition has a "type" property
-  return (item as RootNavigationItemDefinition).type !== undefined;
+const isGroupDefinition = (
+  item: RootNavigationItemDefinition | NodeDefinition
+): item is GroupDefinition => {
+  return (
+    (item as GroupDefinition).type === 'navGroup' || (item as NodeDefinition).children !== undefined
+  );
+};
+
+const isRecentlyAccessedDefinition = (
+  item: RootNavigationItemDefinition | NodeDefinition
+): item is RecentlyAccessedDefinition => {
+  return (item as RootNavigationItemDefinition).type === 'recentlyAccessed';
 };
 
+/**
+ * Handler to build a full navigation tree definition from a project definition
+ * It adds all the defaults and presets (recently accessed, footer content...)
+ *
+ * @param projectDefinition The project definition
+ * @returns The full navigation tree definition
+ */
 const getDefaultNavigationTree = (
   projectDefinition: ProjectNavigationTreeDefinition
 ): NavigationTreeDefinition => {
@@ -42,7 +61,13 @@ const getDefaultNavigationTree = (
       {
         type: 'recentlyAccessed',
       },
-      ...projectDefinition.map((def) => ({ ...def, type: 'navGroup' as const })),
+      ...projectDefinition.map((def) => {
+        if ((def as GroupDefinition).children) {
+          return { children: [], ...def, type: 'navGroup' as const };
+        } else {
+          return { ...def, type: 'navItem' as const };
+        }
+      }),
       {
         type: 'navGroup',
         ...getPresets('analytics'),
@@ -54,7 +79,7 @@ const getDefaultNavigationTree = (
     ],
     footer: [
       {
-        type: 'navGroup',
+        type: 'navItem',
         id: 'devTools',
         title: i18n.translate('sharedUXPackages.chrome.sideNavigation.devTools', {
           defaultMessage: 'Developer tools',
@@ -91,62 +116,104 @@ const getDefaultNavigationTree = (
   };
 };
 
-let idCounter = 0;
+/**
+ * Serialize a navigation node. Currently this handler only adds an autogenerated id if it's missing
+ *
+ * @param item The navigation node
+ * @returns The navigation node serialized
+ */
+function serializeNode<
+  T extends {
+    id?: string;
+    link?: LinkId;
+    children?: Array<{ id?: string; link?: LinkId }>;
+  },
+  LinkId extends AppDeepLinkId = AppDeepLinkId
+>(item: T, depth: number, index: number): T & { id: string } {
+  const id = getNavigationNodeId(item, () => `node-${depth}-${index}`);
+  const children = item.children?.map((_item, i) => serializeNode(_item, depth + 1, i));
+
+  return {
+    ...item,
+    id,
+    children,
+  };
+}
+
+const serializeNavigationTree = (navTree: NavigationTreeDefinition): NavigationTreeDefinition => {
+  const serialized: NavigationTreeDefinition = { ...navTree };
+
+  const serialize = (item: RootNavigationItemDefinition, index: number) => {
+    if (item.type === 'recentlyAccessed') return item;
+    return serializeNode(item, 0, index);
+  };
+
+  if (navTree.body) {
+    serialized.body = navTree.body.map(serialize);
+  }
+
+  if (navTree.footer) {
+    serialized.footer = navTree.footer.map(serialize);
+  }
+
+  return serialized;
+};
+
+interface Props {
+  dataTestSubj?: string;
+  panelContentProvider?: ContentProvider;
+}
 
-export const DefaultNavigation: FC<ProjectNavigationDefinition & { dataTestSubj?: string }> = ({
+export const DefaultNavigation: FC<ProjectNavigationDefinition & Props> = ({
   projectNavigationTree,
   navigationTree,
   dataTestSubj,
+  panelContentProvider,
 }) => {
   if (!navigationTree && !projectNavigationTree) {
     throw new Error('One of navigationTree or projectNavigationTree must be defined');
   }
 
-  const navigationDefinition = !navigationTree
-    ? getDefaultNavigationTree(projectNavigationTree!)
-    : navigationTree!;
-
-  const renderItems = useCallback(
-    (
-      items: RootNavigationItemDefinition[] | NodeDefinitionWithPreset[] = [],
-      path: string[] = []
-    ) => {
-      return items.map((item) => {
-        const isRootNavigationItem = isRootNavigationItemDefinition(item);
-        if (isRootNavigationItem && item.type === 'recentlyAccessed') {
-          return <RecentlyAccessed {...item} key={`recentlyAccessed-${idCounter++}`} />;
-        }
+  const navigationDefinition = useMemo(() => {
+    const definition = !navigationTree
+      ? getDefaultNavigationTree(projectNavigationTree!)
+      : navigationTree;
+
+    return serializeNavigationTree(definition);
+  }, [navigationTree, projectNavigationTree]);
 
-        if (item.preset) {
-          return <Navigation.Group preset={item.preset} key={item.preset} />;
+  const renderNodes = useCallback(
+    (nodes: Array<RootNavigationItemDefinition | NodeDefinition> = []) => {
+      return nodes.map((navNode, i) => {
+        if (isPresetDefinition(navNode)) {
+          return <Navigation.Group preset={navNode.preset} key={`${navNode.preset}-${i}`} />;
         }
 
-        const id = item.id ?? item.link;
+        if (isRecentlyAccessedDefinition(navNode)) {
+          return <RecentlyAccessed {...navNode} key={`recentlyAccessed-${i}`} />;
+        }
 
-        if (!id) {
-          throw new Error(
-            `At least one of id or link must be defined for navigation item ${item.title}`
+        if (isGroupDefinition(navNode)) {
+          return (
+            <Navigation.Group {...navNode} key={navNode.id}>
+              {/* Recursively build the tree */}
+              {renderNodes(navNode.children)}
+            </Navigation.Group>
           );
         }
 
-        return item.children || (item as GroupDefinition).type === 'navGroup' ? (
-          <Navigation.Group {...item} key={id}>
-            {renderItems(item.children, [...path, id])}
-          </Navigation.Group>
-        ) : (
-          <Navigation.Item {...item} key={id} />
-        );
+        return <Navigation.Item {...navNode} key={navNode.id} />;
       });
     },
     []
   );
 
   return (
-    <Navigation dataTestSubj={dataTestSubj}>
+    <Navigation dataTestSubj={dataTestSubj} panelContentProvider={panelContentProvider}>
       <>
-        {renderItems(navigationDefinition.body)}
+        {renderNodes(navigationDefinition.body)}
         {navigationDefinition.footer && (
-          <NavigationFooter>{renderItems(navigationDefinition.footer)}</NavigationFooter>
+          <NavigationFooter>{renderNodes(navigationDefinition.footer)}</NavigationFooter>
         )}
       </>
     </Navigation>
diff --git a/packages/shared-ux/chrome/navigation/src/ui/hooks/use_init_navnode.ts b/packages/shared-ux/chrome/navigation/src/ui/hooks/use_init_navnode.ts
index cedfd9c1b91e9..ab0c5ae860f3c 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/hooks/use_init_navnode.ts
+++ b/packages/shared-ux/chrome/navigation/src/ui/hooks/use_init_navnode.ts
@@ -6,36 +6,23 @@
  * Side Public License, v 1.
  */
 
-import {
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import useObservable from 'react-use/lib/useObservable';
+import type {
   AppDeepLinkId,
   ChromeNavLink,
   ChromeProjectNavigationNode,
   CloudLinkId,
+  SideNavNodeStatus,
 } from '@kbn/core-chrome-browser';
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import useObservable from 'react-use/lib/useObservable';
 import { CloudLinks } from '../../cloud_links';
 
 import { useNavigation as useNavigationServices } from '../../services';
-import { isAbsoluteLink } from '../../utils';
+import { getNavigationNodeId, isAbsoluteLink } from '../../utils';
 import { useNavigation } from '../components/navigation';
-import { NodeProps, NodePropsEnhanced, RegisterFunction, UnRegisterFunction } from '../types';
+import { NodePropsEnhanced, RegisterFunction, UnRegisterFunction } from '../types';
 import { useRegisterTreeNode } from './use_register_tree_node';
 
-function getIdFromNavigationNode<
-  LinkId extends AppDeepLinkId = AppDeepLinkId,
-  Id extends string = string,
-  ChildrenId extends string = Id
->({ id: _id, link, title }: NodeProps<LinkId, Id, ChildrenId>): string {
-  const id = _id ?? link;
-
-  if (!id) {
-    throw new Error(`Id or link prop missing for navigation item [${title}]`);
-  }
-
-  return id;
-}
-
 /**
  * We don't have currently a way to know if a user has access to a Cloud section.
  * TODO: This function will have to be revisited once we have an API from Cloud to know the user
@@ -45,36 +32,36 @@ function hasUserAccessToCloudLink(): boolean {
   return true;
 }
 
-function isNodeVisible(
+function getNodeStatus(
   {
     link,
     deepLink,
     cloudLink,
+    sideNavStatus,
   }: {
     link?: string;
     deepLink?: ChromeNavLink;
     cloudLink?: CloudLinkId;
+    sideNavStatus?: SideNavNodeStatus;
   },
   { cloudLinks }: { cloudLinks: CloudLinks }
-) {
+): SideNavNodeStatus | 'remove' {
   if (link && !deepLink) {
     // If a link is provided, but no deepLink is found, don't render anything
-    return false;
+    return 'remove';
   }
 
   if (cloudLink) {
     if (!cloudLinks[cloudLink]) {
       // Invalid cloudLinkId or link url has not been set in kibana.yml
-      return false;
+      return 'remove';
     }
-    return hasUserAccessToCloudLink();
+    if (!hasUserAccessToCloudLink()) return 'remove';
   }
 
-  if (deepLink) {
-    return !deepLink.hidden;
-  }
+  if (deepLink && deepLink.hidden) return 'remove';
 
-  return true;
+  return sideNavStatus ?? 'visible';
 }
 
 function getTitleForNode<
@@ -109,12 +96,34 @@ function validateNodeProps<
   LinkId extends AppDeepLinkId = AppDeepLinkId,
   Id extends string = string,
   ChildrenId extends string = Id
->({ link, href, cloudLink }: NodePropsEnhanced<LinkId, Id, ChildrenId>) {
+>({
+  id,
+  link,
+  href,
+  cloudLink,
+  renderAs,
+  appendHorizontalRule,
+  isGroup,
+}: Omit<NodePropsEnhanced<LinkId, Id, ChildrenId>, 'children'>) {
   if (link && cloudLink) {
-    throw new Error(`Only one of "link" or "cloudLink" can be provided.`);
+    throw new Error(
+      `[Chrome navigation] Error in node [${id}]. Only one of "link" or "cloudLink" can be provided.`
+    );
   }
   if (href && cloudLink) {
-    throw new Error(`Only one of "href" or "cloudLink" can be provided.`);
+    throw new Error(
+      `[Chrome navigation] Error in node [${id}]. Only one of "href" or "cloudLink" can be provided.`
+    );
+  }
+  if (renderAs === 'panelOpener' && !link) {
+    throw new Error(
+      `[Chrome navigation] Error in node [${id}]. If renderAs is set to "panelOpener", a "link" must also be provided.`
+    );
+  }
+  if (appendHorizontalRule && !isGroup) {
+    throw new Error(
+      `[Chrome navigation] Error in node [${id}]. "appendHorizontalRule" can only be added for group with children.`
+    );
   }
 }
 
@@ -134,7 +143,15 @@ function createInternalNavNode<
 
   const { children, link, cloudLink, ...navNode } = _navNode;
   const deepLink = deepLinks.find((dl) => dl.id === link);
-  const isVisible = isNodeVisible({ link, deepLink, cloudLink }, { cloudLinks });
+  const sideNavStatus = getNodeStatus(
+    {
+      link,
+      deepLink,
+      cloudLink,
+      sideNavStatus: navNode.sideNavStatus,
+    },
+    { cloudLinks }
+  );
   const title = getTitleForNode(_navNode, { deepLink, cloudLinks });
   const href = cloudLink ? cloudLinks[cloudLink]?.href : _navNode.href;
 
@@ -142,18 +159,19 @@ function createInternalNavNode<
     throw new Error(`href must be an absolute URL. Node id [${id}].`);
   }
 
-  if (!isVisible) {
+  if (sideNavStatus === 'remove') {
     return null;
   }
 
   return {
     ...navNode,
     id,
-    path: path ?? [id],
+    path: path ?? [],
     title: title ?? '',
     deepLink,
     href,
     isActive,
+    sideNavStatus,
   };
 }
 
@@ -171,7 +189,7 @@ export const useInitNavNode = <
   Id extends string = string,
   ChildrenId extends string = Id
 >(
-  node: NodePropsEnhanced<LinkId, Id, ChildrenId>,
+  node: Omit<NodePropsEnhanced<LinkId, Id, ChildrenId>, 'children'>,
   { cloudLinks }: { cloudLinks: CloudLinks }
 ) => {
   const { isActive: isActiveControlled } = node;
@@ -215,7 +233,7 @@ export const useInitNavNode = <
   const { register: registerNodeOnParent } = useRegisterTreeNode();
   const { activeNodes } = useNavigation();
 
-  const id = getIdFromNavigationNode(node);
+  const id = getNavigationNodeId(node);
 
   const internalNavNode = useMemo(
     () => createInternalNavNode(id, node, deepLinks, nodePath, isActive, { cloudLinks }),
diff --git a/packages/shared-ux/chrome/navigation/src/ui/index.ts b/packages/shared-ux/chrome/navigation/src/ui/index.ts
index 1335a1844f45c..60b55fc5d200a 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/index.ts
+++ b/packages/shared-ux/chrome/navigation/src/ui/index.ts
@@ -7,6 +7,7 @@
  */
 
 export { Navigation } from './components';
+export type { PanelContent, PanelComponentProps } from './components';
 
 export { DefaultNavigation } from './default_navigation';
 
@@ -14,6 +15,8 @@ export { getPresets } from './nav_tree_presets';
 
 export type {
   GroupDefinition,
+  PresetDefinition,
+  ItemDefinition,
   NavigationGroupPreset,
   NavigationTreeDefinition,
   ProjectNavigationDefinition,
diff --git a/packages/shared-ux/chrome/navigation/src/ui/navigation.stories.tsx b/packages/shared-ux/chrome/navigation/src/ui/navigation.stories.tsx
index c014678265ce9..95a5dbe163668 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/navigation.stories.tsx
+++ b/packages/shared-ux/chrome/navigation/src/ui/navigation.stories.tsx
@@ -7,9 +7,9 @@
  */
 
 import { action } from '@storybook/addon-actions';
-import { useState } from '@storybook/addons';
+import { useState as useStateStorybook } from '@storybook/addons';
 import { ComponentMeta } from '@storybook/react';
-import React, { EventHandler, FC, PropsWithChildren, MouseEvent } from 'react';
+import React, { EventHandler, FC, MouseEvent, useState, useEffect } from 'react';
 import { BehaviorSubject, of } from 'rxjs';
 
 import {
@@ -34,19 +34,51 @@ import { NavigationProvider } from '../services';
 import { Navigation } from './components';
 import { DefaultNavigation } from './default_navigation';
 import { getPresets } from './nav_tree_presets';
-import type { GroupDefinition, NonEmptyArray, ProjectNavigationDefinition } from './types';
+import type { GroupDefinition, ProjectNavigationDefinition } from './types';
+import { ContentProvider } from './components/panel';
 
 const storybookMock = new NavigationStorybookMock();
 
-const NavigationWrapper: FC<
-  PropsWithChildren<{ clickAction?: EventHandler<MouseEvent>; clickActionText?: string }> &
-    Partial<EuiCollapsibleNavBetaProps>
-> = (props) => {
+interface Props {
+  clickAction?: EventHandler<MouseEvent>;
+  clickActionText?: string;
+  children?: React.ReactNode | (({ isCollapsed }: { isCollapsed: boolean }) => React.ReactNode);
+}
+
+const NavigationWrapper: FC<Props & Partial<EuiCollapsibleNavBetaProps>> = (props) => {
+  const [isCollapsed, setIsCollapsed] = useState(false);
+
+  const onCollapseToggle = (nextIsCollapsed: boolean) => {
+    setIsCollapsed(nextIsCollapsed);
+  };
+
+  useEffect(() => {
+    // Set padding to body to avoid unnecessary scrollbars
+    document.body.style.paddingTop = '0px';
+    document.body.style.paddingRight = '0px';
+    document.body.style.paddingBottom = '0px';
+  }, []);
+
   return (
     <>
       <EuiHeader position="fixed">
         <EuiHeaderSection side={props?.side}>
-          <EuiCollapsibleNavBeta {...props} />
+          <EuiCollapsibleNavBeta
+            {...props}
+            children={
+              typeof props.children === 'function'
+                ? props.children({ isCollapsed })
+                : props.children
+            }
+            initialIsCollapsed={isCollapsed}
+            onCollapseToggle={onCollapseToggle}
+            css={
+              props.css ?? {
+                overflow: 'visible',
+                clipPath: 'polygon(0 0, 300% 0, 300% 100%, 0 100%)',
+              }
+            }
+          />
         </EuiHeaderSection>
       </EuiHeader>
       <EuiPageTemplate>
@@ -68,7 +100,7 @@ const baseDeeplink: ChromeNavLink = {
   id: 'foo',
   title: 'Title from deep link',
   href: 'https://elastic.co',
-  url: '',
+  url: '/dashboard-mocked',
   baseUrl: '',
 };
 
@@ -83,15 +115,19 @@ const createDeepLink = (id: string, title: string = baseDeeplink.title) => {
 const deepLinks: ChromeNavLink[] = [
   createDeepLink('item1'),
   createDeepLink('item2', 'Foo'),
+  createDeepLink('item3'),
   createDeepLink('group1:item1'),
   createDeepLink('group1:groupA:groupI:item1'),
   createDeepLink('group1:groupA', 'Group title from deep link'),
   createDeepLink('group2', 'Group title from deep link'),
   createDeepLink('group2:item1'),
   createDeepLink('group2:item3'),
+  createDeepLink('group:settings.logs'),
+  createDeepLink('group:settings.signals'),
+  createDeepLink('group:settings.tracing'),
 ];
 
-const simpleNavigationDefinition: ProjectNavigationDefinition = {
+const simpleNavigationDefinition: ProjectNavigationDefinition<any> = {
   projectNavigationTree: [
     {
       id: 'example_projet',
@@ -100,15 +136,15 @@ const simpleNavigationDefinition: ProjectNavigationDefinition = {
       defaultIsCollapsed: false,
       children: [
         {
-          id: 'item1',
+          link: 'item1',
           title: 'Get started',
         },
         {
-          id: 'item2',
+          link: 'item2',
           title: 'Alerts',
         },
         {
-          id: 'item3',
+          link: 'item3',
           title: 'Dashboards',
         },
         {
@@ -117,7 +153,7 @@ const simpleNavigationDefinition: ProjectNavigationDefinition = {
           href: 'https://elastic.co',
         },
         {
-          id: 'item5',
+          link: 'item5',
           title: 'Another link',
         },
         {
@@ -125,15 +161,15 @@ const simpleNavigationDefinition: ProjectNavigationDefinition = {
           title: 'Settings',
           children: [
             {
-              id: 'logs',
+              link: 'item1',
               title: 'Logs',
             },
             {
-              id: 'signals',
+              link: 'item2',
               title: 'Signals',
             },
             {
-              id: 'tracing',
+              link: 'item3',
               title: 'Tracing',
             },
           ],
@@ -165,7 +201,7 @@ export const SimpleObjectDefinition = (args: NavigationServices) => {
   );
 };
 
-const navigationDefinition: ProjectNavigationDefinition = {
+const navigationDefinition: ProjectNavigationDefinition<any> = {
   navigationTree: {
     body: [
       // My custom project
@@ -177,42 +213,158 @@ const navigationDefinition: ProjectNavigationDefinition = {
         defaultIsCollapsed: false,
         children: [
           {
-            id: 'item1',
+            link: 'item1',
             title: 'Get started',
           },
           {
-            id: 'item2',
+            link: 'item2',
             title: 'Alerts',
           },
           {
-            id: 'item3',
+            id: 'item2-2',
+            link: 'item2',
+            title: 'Item should NOT appear!!',
+            sideNavStatus: 'hidden', // Should not appear
+          },
+          {
+            link: 'item3',
             title: 'Some other node',
           },
           {
-            id: 'group:settings',
-            title: 'Settings',
+            id: 'group:settings-2',
+            title: 'Settings as nav Item',
+            renderAs: 'item', // Render just like any other item, even if it has children
             children: [
               {
-                id: 'logs',
+                link: 'group:settings.logs',
                 title: 'Logs',
               },
               {
-                id: 'signals',
+                link: 'group:settings.signals',
                 title: 'Signals',
               },
               {
-                id: 'tracing',
+                id: 'group:settings.signals2',
+                link: 'group:settings.signals',
+                title: 'Signals - should NOT appear',
+                sideNavStatus: 'hidden', // Should not appear
+              },
+              {
+                link: 'group:settings.tracing',
                 title: 'Tracing',
               },
             ],
           },
+          {
+            id: 'group:settings',
+            link: 'item1',
+            title: 'Settings as panel opener',
+            renderAs: 'panelOpener',
+            children: [
+              {
+                title: 'Group 1',
+                children: [
+                  {
+                    link: 'group:settings.logs',
+                    title: 'Logs',
+                  },
+                  {
+                    link: 'group:settings.signals',
+                    title: 'Signals',
+                  },
+                  {
+                    id: 'group:settings.signals-2',
+                    link: 'group:settings.signals',
+                    title: 'Signals - should NOT appear',
+                    sideNavStatus: 'hidden', // Should not appear
+                  },
+                  {
+                    link: 'group:settings.tracing',
+                    title: 'Tracing',
+                  },
+                ],
+              },
+              {
+                children: [
+                  {
+                    id: 'group.nestedGroup',
+                    link: 'group:settings.tracing',
+                    title: 'Group 2',
+                    renderAs: 'item',
+                    children: [
+                      {
+                        id: 'item1',
+                        link: 'group:settings.signals',
+                        title: 'Hidden - should NOT appear',
+                        sideNavStatus: 'hidden', // Should not appear
+                      },
+                    ],
+                  },
+                ],
+              },
+              {
+                children: [
+                  {
+                    id: 'group.nestedGroup',
+                    link: 'group:settings.tracing',
+                    title: 'Just an item in a group',
+                  },
+                ],
+              },
+            ],
+          },
+          {
+            id: 'group:settings.hidden',
+            title: 'Settings 1 - should NOT appear', // sideNavStatus is 'hidden'
+            sideNavStatus: 'hidden',
+            children: [
+              {
+                link: 'group:settings.logs',
+                title: 'Logs',
+              },
+            ],
+          },
+          {
+            id: 'group:settings.childrenHidden',
+            link: 'item1',
+            title: 'Settings 2 - should NOT appear', // All children are hidden
+            children: [
+              {
+                link: 'group:settings.logs',
+                title: 'Logs',
+                sideNavStatus: 'hidden',
+              },
+            ],
+          },
         ],
       },
       // Add ml
       {
-        type: 'navGroup',
+        type: 'preset',
         preset: 'ml',
       },
+      {
+        type: 'navItem',
+        title: 'Custom link at root level',
+      },
+      {
+        type: 'navGroup',
+        id: 'test_all_hidden',
+        title: 'Test group render as Item',
+        renderAs: 'item',
+        children: [
+          {
+            id: 'test.item1',
+            link: 'item1',
+          },
+        ],
+      },
+      {
+        type: 'navItem',
+        icon: 'logoElastic',
+        link: 'ml',
+        title: 'Link at root level + icon',
+      },
       // And specific links from analytics
       {
         type: 'navGroup',
@@ -224,7 +376,7 @@ const navigationDefinition: ProjectNavigationDefinition = {
             // Hide discover and dashboard
             return item.link !== 'discover' && item.link !== 'dashboards';
           }),
-        })) as NonEmptyArray<any>,
+        })),
       },
     ],
     footer: [
@@ -275,7 +427,505 @@ export const ComplexObjectDefinition = (args: NavigationServices) => {
   );
 };
 
-export const WithUIComponents = (args: NavigationServices) => {
+const panelContentProvider: ContentProvider = (id: string) => {
+  if (id === 'example_projet.group:openpanel1') {
+    return; // Use default title & content
+  }
+
+  if (id === 'example_projet.group:openpanel2') {
+    // Custom content
+    return {
+      content: ({ closePanel }) => {
+        return (
+          <div>
+            <EuiText>This is a custom component to render in the panel.</EuiText>
+            <EuiButton onClick={() => closePanel()}>Close panel</EuiButton>
+          </div>
+        );
+      },
+    };
+  }
+
+  if (id === 'example_projet.group:openpanel3') {
+    return {
+      title: <div style={{ backgroundColor: 'yellow', fontWeight: 600 }}>Custom title</div>,
+    };
+  }
+};
+
+const navigationDefinitionWithPanel: ProjectNavigationDefinition<any> = {
+  navigationTree: {
+    body: [
+      // My custom project
+      {
+        type: 'navGroup',
+        id: 'example_projet',
+        title: 'Example project',
+        icon: 'logoObservability',
+        defaultIsCollapsed: false,
+        accordionProps: {
+          arrowProps: { css: { display: 'none' } },
+        },
+        children: [
+          {
+            link: 'item1',
+            title: 'Get started',
+          },
+          {
+            link: 'item2',
+            title: 'Alerts',
+          },
+          {
+            // Panel with default content
+            // Groups with title
+            id: 'group:openpanel1',
+            title: 'Open panel (1)',
+            renderAs: 'panelOpener',
+            link: 'item1',
+            children: [
+              {
+                title: 'Group 1',
+                children: [
+                  {
+                    link: 'group:settings.logs',
+                    title: 'Logs',
+                    icon: 'logoObservability',
+                  },
+                  {
+                    link: 'group:settings.signals',
+                    title: 'Signals',
+                    openInNewTab: true,
+                  },
+                  {
+                    link: 'group:settings.tracing',
+                    title: 'Tracing',
+                    withBadge: true, // Default to "Beta" badge
+                  },
+                ],
+              },
+              {
+                title: 'Group 2',
+                children: [
+                  {
+                    id: 'group2:settings.logs',
+                    link: 'group:settings.logs',
+                    title: 'Logs',
+                  },
+                  {
+                    id: 'group2:settings.signals',
+                    link: 'group:settings.signals',
+                    title: 'Signals',
+                  },
+                  {
+                    id: 'group2:settings.tracing',
+                    link: 'group:settings.tracing',
+                    title: 'Tracing',
+                  },
+                ],
+              },
+            ],
+          },
+          {
+            // Panel with default content
+            // Groups with **not** title
+            id: 'group.openpanel2',
+            title: 'Open panel (2)',
+            renderAs: 'panelOpener',
+            link: 'item1',
+            children: [
+              {
+                appendHorizontalRule: true, // Add a separator after the group
+                children: [
+                  {
+                    link: 'group:settings.logs',
+                    title: 'Logs',
+                  },
+                  {
+                    link: 'group:settings.signals',
+                    title: 'Signals',
+                  },
+                  {
+                    link: 'group:settings.tracing',
+                    title: 'Tracing',
+                    withBadge: true, // Default to "Beta" badge
+                  },
+                ],
+              },
+              {
+                id: 'group2',
+                children: [
+                  {
+                    id: 'group2:settings.logs',
+                    link: 'group:settings.logs',
+                    title: 'Logs',
+                  },
+                  {
+                    id: 'group2:settings.signals',
+                    link: 'group:settings.signals',
+                    title: 'Signals',
+                  },
+                  {
+                    id: 'group2:settings.tracing',
+                    link: 'group:settings.tracing',
+                    title: 'Tracing',
+                  },
+                ],
+              },
+            ],
+          },
+          {
+            // Panel with default content
+            // Accordion to wrap groups
+            id: 'group.openpanel3',
+            title: 'Open panel (3)',
+            renderAs: 'panelOpener',
+            link: 'item1',
+            children: [
+              {
+                id: 'group1',
+                appendHorizontalRule: true,
+                children: [
+                  {
+                    link: 'group:settings.logs',
+                    title: 'Logs',
+                  },
+                  {
+                    link: 'group:settings.signals',
+                    title: 'Signals',
+                  },
+                  {
+                    link: 'group:settings.tracing',
+                    title: 'Tracing',
+                    withBadge: true, // Default to "Beta" badge
+                  },
+                ],
+              },
+              // Groups with accordion
+              {
+                id: 'group2',
+                title: 'MANAGEMENT',
+                renderAs: 'accordion',
+                children: [
+                  {
+                    id: 'group2-A',
+                    title: 'Group 1',
+                    children: [
+                      {
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                      },
+                      {
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                      },
+                      {
+                        link: 'group:settings.tracing',
+                        title: 'Tracing',
+                        withBadge: true, // Default to "Beta" badge
+                      },
+                    ],
+                  },
+                  {
+                    id: 'group2-B',
+                    title: 'Group 2 (marked as collapsible)',
+                    renderAs: 'accordion',
+                    children: [
+                      {
+                        id: 'group2:settings.logs',
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                      },
+                      {
+                        id: 'group2:settings.signals',
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                      },
+                      {
+                        id: 'group2:settings.tracing',
+                        link: 'group:settings.tracing',
+                        title: 'Tracing',
+                      },
+                    ],
+                  },
+                  {
+                    id: 'group2-C',
+                    title: 'Group 3',
+                    children: [
+                      {
+                        id: 'group2:settings.logs',
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                      },
+                      {
+                        id: 'group2:settings.signals',
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                      },
+                      {
+                        id: 'group2:settings.tracing',
+                        link: 'group:settings.tracing',
+                        title: 'Tracing',
+                      },
+                    ],
+                  },
+                ],
+              },
+            ],
+          },
+          {
+            // Panel with nav group title that acts like nav items
+            id: 'group.openpanel4',
+            title: 'Open panel (4) - sideNavStatus',
+            renderAs: 'panelOpener',
+            link: 'item1',
+            children: [
+              {
+                id: 'root',
+                children: [
+                  {
+                    title: 'Should act as item 1',
+                    link: 'item1',
+                    renderAs: 'item',
+                    children: [
+                      {
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                      },
+                      {
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                      },
+                    ],
+                  },
+                  {
+                    link: 'group:settings.logs',
+                    title: 'Normal item',
+                  },
+                  {
+                    link: 'group:settings.logs2',
+                    title: 'Item should NOT appear!', // Should not appear
+                    sideNavStatus: 'hidden',
+                  },
+                  {
+                    title: 'Group should NOT appear!',
+                    id: 'group:settings.logs3',
+                    link: 'group:settings.logs',
+                    sideNavStatus: 'hidden', // This group should not appear
+                    children: [
+                      {
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                      },
+                      {
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                      },
+                    ],
+                  },
+                  {
+                    title: 'Should act as item 2',
+                    renderAs: 'item', // This group renders as a normal item
+                    children: [
+                      {
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                      },
+                      {
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                      },
+                    ],
+                  },
+                ],
+              },
+              {
+                children: [
+                  {
+                    title: 'Another group as Item',
+                    id: 'group2.renderAsItem',
+                    renderAs: 'item',
+                    children: [
+                      {
+                        id: 'group2:settings.logs',
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                        sideNavStatus: 'hidden',
+                      },
+                      {
+                        id: 'group2:settings.signals',
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                        sideNavStatus: 'hidden',
+                      },
+                      {
+                        id: 'group2:settings.tracing',
+                        link: 'group:settings.tracing',
+                        title: 'Tracing',
+                        sideNavStatus: 'hidden',
+                      },
+                    ],
+                  },
+                ],
+              },
+              // Groups with accordion
+              {
+                id: 'group2',
+                title: 'MANAGEMENT',
+                renderAs: 'accordion',
+                children: [
+                  {
+                    id: 'group2-A',
+                    title: 'Group 1',
+                    children: [
+                      {
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                      },
+                      {
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                      },
+                      {
+                        link: 'group:settings.tracing',
+                        title: 'Tracing',
+                        withBadge: true, // Default to "Beta" badge
+                      },
+                    ],
+                  },
+                  {
+                    id: 'root-groupB',
+                    children: [
+                      {
+                        id: 'group2-B',
+                        title: 'Group 2 (render as Item)',
+                        renderAs: 'item', // This group renders as a normal item
+                        children: [
+                          {
+                            id: 'group2:settings.logs',
+                            link: 'group:settings.logs',
+                            title: 'Logs',
+                          },
+                          {
+                            id: 'group2:settings.signals',
+                            link: 'group:settings.signals',
+                            title: 'Signals',
+                          },
+                          {
+                            id: 'group2:settings.tracing',
+                            link: 'group:settings.tracing',
+                            title: 'Tracing',
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                  {
+                    id: 'group2-C',
+                    title: 'Group 3',
+                    children: [
+                      {
+                        id: 'group2:settings.logs',
+                        link: 'group:settings.logs',
+                        title: 'Logs',
+                      },
+                      {
+                        title: 'Yet another group as item',
+                        renderAs: 'item',
+                        children: [
+                          {
+                            id: 'group2:settings.logs',
+                            link: 'group:settings.logs',
+                            title: 'Logs',
+                          },
+                          {
+                            id: 'group2:settings.signals',
+                            link: 'group:settings.signals',
+                            title: 'Signals',
+                          },
+                        ],
+                      },
+                      {
+                        id: 'group2:settings.signals',
+                        link: 'group:settings.signals',
+                        title: 'Signals',
+                      },
+                    ],
+                  },
+                ],
+              },
+            ],
+          },
+          {
+            // Panel where all children are hidden. The "open panel" icon should NOT
+            // appear next to the node title
+            id: 'group.openpanel5',
+            title: 'Open panel (5) - all children hidden',
+            renderAs: 'panelOpener',
+            link: 'item1',
+            children: [
+              {
+                link: 'test1',
+                sideNavStatus: 'hidden',
+              },
+              {
+                title: 'Some group',
+                children: [
+                  {
+                    link: 'item1',
+                    title: 'My first group item',
+                    sideNavStatus: 'hidden',
+                  },
+                ],
+              },
+            ],
+          },
+          {
+            id: 'group.openpanel6',
+            title: 'Open panel (custom content)',
+            renderAs: 'panelOpener',
+            link: 'item1',
+            children: [
+              {
+                link: 'group:settings.logs',
+                title: 'Logs',
+              },
+              {
+                link: 'group:settings.signals',
+                title: 'Signals',
+              },
+              {
+                link: 'group:settings.tracing',
+                title: 'Tracing',
+              },
+            ],
+          },
+          {
+            id: 'group.openpanel7',
+            title: 'Open panel (custom title)',
+            renderAs: 'panelOpener',
+            link: 'item1',
+            children: [
+              {
+                link: 'group:settings.logs',
+                title: 'Those links',
+              },
+              {
+                link: 'group:settings.signals',
+                title: 'are automatically',
+              },
+              {
+                link: 'group:settings.tracing',
+                title: 'generated',
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  },
+};
+
+export const ObjectDefinitionWithPanel = (args: NavigationServices) => {
   const services = storybookMock.getServices({
     ...args,
     navLinks$: of([...navLinksMock, ...deepLinks]),
@@ -290,59 +940,122 @@ export const WithUIComponents = (args: NavigationServices) => {
 
   return (
     <NavigationWrapper>
-      <NavigationProvider {...services}>
-        <Navigation>
-          <Navigation.RecentlyAccessed />
-
-          <Navigation.Group
-            id="example_projet"
-            title="Example project"
-            icon="logoObservability"
-            defaultIsCollapsed={false}
-          >
-            <Navigation.Item<any> id="item1" link="item1" />
-            <Navigation.Item id="item2" title="Alerts">
-              {(navNode) => {
-                return (
-                  <div className="euiSideNavItemButton">
-                    <EuiText size="s">{`Render prop: ${navNode.id} - ${navNode.title}`}</EuiText>
-                  </div>
-                );
-              }}
-            </Navigation.Item>
-            <Navigation.Item id="item3" title="Title in ReactNode">
-              <div className="euiSideNavItemButton">
-                <EuiLink>Title in ReactNode</EuiLink>
-              </div>
-            </Navigation.Item>
-            <Navigation.Item id="item4" title="External link" href="https://elastic.co" />
+      {({ isCollapsed }) => (
+        <NavigationProvider {...services} isSideNavCollapsed={isCollapsed}>
+          <DefaultNavigation
+            {...navigationDefinitionWithPanel}
+            panelContentProvider={panelContentProvider}
+          />
+        </NavigationProvider>
+      )}
+    </NavigationWrapper>
+  );
+};
 
-            <Navigation.Group id="group:settings" title="Settings">
-              <Navigation.Item id="logs" title="Logs" />
-              <Navigation.Item id="signals" title="Signals" />
-              <Navigation.Item id="tracing" title="Tracing" />
-            </Navigation.Group>
-          </Navigation.Group>
+export const WithUIComponents = (args: NavigationServices) => {
+  const services = storybookMock.getServices({
+    ...args,
+    navLinks$: of([...navLinksMock, ...deepLinks]),
+    onProjectNavigationChange: (updated) => {
+      action('Update chrome navigation')(JSON.stringify(updated, null, 2));
+    },
+    recentlyAccessed$: of([
+      { label: 'This is an example', link: '/app/example/39859', id: '39850' },
+      { label: 'Another example', link: '/app/example/5235', id: '5235' },
+    ]),
+  });
 
-          <Navigation.Group preset="analytics" defaultIsCollapsed={false} />
-          <Navigation.Group preset="ml" />
+  return (
+    <NavigationWrapper>
+      {({ isCollapsed }) => (
+        <NavigationProvider {...services} isSideNavCollapsed={isCollapsed}>
+          <Navigation>
+            <Navigation.RecentlyAccessed />
 
-          <Navigation.Footer>
-            <Navigation.Group link="dev_tools" icon="editorCodeBlock" title="Developer tools" />
             <Navigation.Group
-              id="project_settings_project_nav"
-              title="Project settings"
-              breadcrumbStatus="hidden"
-              icon="gear"
+              id="example_projet"
+              title="Example project"
+              icon="logoObservability"
+              defaultIsCollapsed={false}
             >
-              <Navigation.Item link="management" title="Management" />
-              <Navigation.Item id="cloudLinkUserAndRoles" cloudLink="userAndRoles" />
-              <Navigation.Item id="cloudLinkPerformance" cloudLink="performance" />
-              <Navigation.Item id="cloudLinkBilling" cloudLink="billingAndSub" />
+              <Navigation.Item<any> id="item1" link="item1" />
+              <Navigation.Item id="item2" title="Alerts">
+                {(navNode) => {
+                  return (
+                    <div className="euiSideNavItemButton">
+                      <EuiText size="s">{`Render prop: ${navNode.id} - ${navNode.title}`}</EuiText>
+                    </div>
+                  );
+                }}
+              </Navigation.Item>
+              <Navigation.Item id="item3" title="Title in ReactNode">
+                <div className="euiSideNavItemButton">
+                  <EuiLink>Title in ReactNode</EuiLink>
+                </div>
+              </Navigation.Item>
+              <Navigation.Item id="item4" title="External link" href="https://elastic.co" />
+
+              <Navigation.Group<any>
+                id="group:openPanel"
+                link="item1"
+                title="Open panel"
+                renderAs="panelOpener"
+              >
+                <Navigation.Group id="group1">
+                  <Navigation.Item<any> link="group:settings.logs" title="Logs" />
+                  <Navigation.Item<any> link="group:settings.signals" title="Signals" withBadge />
+                  <Navigation.Item<any> link="group:settings.tracing" title="Tracing" />
+                </Navigation.Group>
+                <Navigation.Group id="group2" appendHorizontalRule title="Group 2">
+                  <Navigation.Item<any> link="group:settings.logs" title="Logs" />
+                  <Navigation.Item<any> link="group:settings.signals" title="Signals" />
+                  <Navigation.Item<any> link="group:settings.tracing" title="Tracing" />
+                </Navigation.Group>
+                <Navigation.Group title="MANAGEMENT" id="group3" renderAs="accordion">
+                  <Navigation.Group title="Group A" id="group3-a">
+                    <Navigation.Item<any> link="group:settings.logs" title="Logs" />
+                    <Navigation.Item<any>
+                      link="group:settings.signals"
+                      title="Signals"
+                      withBadge
+                      badgeOptions={{ text: 'coolio' }}
+                    />
+                    <Navigation.Item<any> link="group:settings.tracing" title="Tracing" />
+                  </Navigation.Group>
+                  <Navigation.Group title="Group B" id="group3-b">
+                    <Navigation.Item<any> link="group:settings.logs" title="Logs" />
+                    <Navigation.Item<any> link="group:settings.signals" title="Signals" />
+                    <Navigation.Item<any> link="group:settings.tracing" title="Tracing" />
+                  </Navigation.Group>
+                  <Navigation.Group title="Group C" id="group3-c">
+                    <Navigation.Item<any> link="group:settings.logs" title="Logs" />
+                    <Navigation.Item<any> link="group:settings.signals" title="Signals" />
+                    <Navigation.Item<any> link="group:settings.tracing" title="Tracing" />
+                  </Navigation.Group>
+                </Navigation.Group>
+              </Navigation.Group>
             </Navigation.Group>
-          </Navigation.Footer>
-        </Navigation>
-      </NavigationProvider>
+
+            <Navigation.Group preset="analytics" defaultIsCollapsed={false} />
+            <Navigation.Group preset="ml" />
+
+            <Navigation.Footer>
+              <Navigation.Group link="dev_tools" icon="editorCodeBlock" title="Developer tools" />
+              <Navigation.Group
+                id="project_settings_project_nav"
+                title="Project settings"
+                breadcrumbStatus="hidden"
+                icon="gear"
+              >
+                <Navigation.Item link="management" title="Management" />
+                <Navigation.Item id="cloudLinkUserAndRoles" cloudLink="userAndRoles" />
+                <Navigation.Item id="cloudLinkPerformance" cloudLink="performance" />
+                <Navigation.Item id="cloudLinkBilling" cloudLink="billingAndSub" />
+              </Navigation.Group>
+            </Navigation.Footer>
+          </Navigation>
+        </NavigationProvider>
+      )}
     </NavigationWrapper>
   );
 };
@@ -398,17 +1111,6 @@ export const MinimalUI = (args: NavigationServices) => {
   );
 };
 
-export default {
-  title: 'Chrome/Navigation',
-  description: 'Navigation container to render items for cross-app linking',
-  parameters: {
-    docs: {
-      page: mdx,
-    },
-  },
-  component: WithUIComponents,
-} as ComponentMeta<typeof WithUIComponents>;
-
 export const CreativeUI = (args: NavigationServices) => {
   const services = storybookMock.getServices({
     ...args,
@@ -602,7 +1304,7 @@ export const UpdatingState = (args: NavigationServices) => {
   ];
 
   // use state to track which element of activeNodeSets is active
-  const [activeNodeIndex, setActiveNodeIndex] = useState<number>(0);
+  const [activeNodeIndex, setActiveNodeIndex] = useStateStorybook<number>(0);
   const changeActiveNode = () => {
     const value = (activeNodeIndex + 1) % 2; // toggle between 0 and 1
     setActiveNodeIndex(value);
@@ -632,3 +1334,14 @@ export const UpdatingState = (args: NavigationServices) => {
     </NavigationWrapper>
   );
 };
+
+export default {
+  title: 'Chrome/Navigation',
+  description: 'Navigation container to render items for cross-app linking',
+  parameters: {
+    docs: {
+      page: mdx,
+    },
+  },
+  component: WithUIComponents,
+} as ComponentMeta<typeof WithUIComponents>;
diff --git a/packages/shared-ux/chrome/navigation/src/ui/types.ts b/packages/shared-ux/chrome/navigation/src/ui/types.ts
index e7c642fc9d0b9..c9caa116c8b97 100644
--- a/packages/shared-ux/chrome/navigation/src/ui/types.ts
+++ b/packages/shared-ux/chrome/navigation/src/ui/types.ts
@@ -16,8 +16,6 @@ import type {
 } from '@kbn/core-chrome-browser';
 import type { RecentlyAccessedProps } from './components';
 
-export type NonEmptyArray<T> = [T, ...T[]];
-
 /**
  * @public
  *
@@ -51,6 +49,8 @@ export interface NodePropsEnhanced<
    * even if the URL does not match any of the nodes in the group.
    */
   isActive?: boolean;
+  /** Flag to indicate if the navigation node is a group or not */
+  isGroup: boolean;
 }
 
 /** The preset that can be pass to the NavigationBucket component */
@@ -74,7 +74,7 @@ export interface GroupDefinition<
   LinkId extends AppDeepLinkId = AppDeepLinkId,
   Id extends string = string,
   ChildrenId extends string = Id
-> extends NodeDefinition<LinkId, Id, ChildrenId> {
+> extends Omit<NodeDefinition<LinkId, Id, ChildrenId>, 'children'> {
   type: 'navGroup';
   /**
    * Flag to indicate if the group is initially collapsed or not.
@@ -90,7 +90,34 @@ export interface GroupDefinition<
    * Pass props to the EUI accordion component used to represent a nav group
    */
   accordionProps?: Partial<EuiAccordionProps>;
-  preset?: NavigationGroupPreset;
+  children: Array<NodeDefinition<LinkId, Id, ChildrenId>>;
+}
+
+/**
+ * @public
+ *
+ * A group root item definition built from a specific preset.
+ */
+export interface PresetDefinition<
+  LinkId extends AppDeepLinkId = AppDeepLinkId,
+  Id extends string = string,
+  ChildrenId extends string = Id
+> extends Omit<GroupDefinition<LinkId, Id, ChildrenId>, 'children' | 'type'> {
+  type: 'preset';
+  preset: NavigationGroupPreset;
+}
+
+/**
+ * @public
+ *
+ * An item root.
+ */
+export interface ItemDefinition<
+  LinkId extends AppDeepLinkId = AppDeepLinkId,
+  Id extends string = string,
+  ChildrenId extends string = Id
+> extends Omit<NodeDefinition<LinkId, Id, ChildrenId>, 'children'> {
+  type: 'navItem';
 }
 
 /**
@@ -102,30 +129,41 @@ export type RootNavigationItemDefinition<
   LinkId extends AppDeepLinkId = AppDeepLinkId,
   Id extends string = string,
   ChildrenId extends string = Id
-> = RecentlyAccessedDefinition | GroupDefinition<LinkId, Id, ChildrenId>;
+> =
+  | RecentlyAccessedDefinition
+  | GroupDefinition<LinkId, Id, ChildrenId>
+  | PresetDefinition<LinkId, Id, ChildrenId>
+  | ItemDefinition<LinkId, Id, ChildrenId>;
 
 export type ProjectNavigationTreeDefinition<
   LinkId extends AppDeepLinkId = AppDeepLinkId,
   Id extends string = string,
   ChildrenId extends string = Id
-> = Array<Omit<GroupDefinition<LinkId, Id, ChildrenId>, 'type'>>;
+> = Array<
+  | Omit<GroupDefinition<LinkId, Id, ChildrenId>, 'type'>
+  | Omit<ItemDefinition<LinkId, Id, ChildrenId>, 'type'>
+>;
 
 /**
  * @public
  *
  * Definition for the complete navigation tree, including body and footer
  */
-export interface NavigationTreeDefinition {
+export interface NavigationTreeDefinition<
+  LinkId extends AppDeepLinkId = AppDeepLinkId,
+  Id extends string = string,
+  ChildrenId extends string = Id
+> {
   /**
    * Main content of the navigation. Can contain any number of "cloudLink", "recentlyAccessed"
    * or "group" items. Be mindeful though, with great power comes great responsibility.
    * */
-  body?: RootNavigationItemDefinition[];
+  body?: Array<RootNavigationItemDefinition<LinkId, Id, ChildrenId>>;
   /**
    * Footer content of the navigation. Can contain any number of "cloudLink", "recentlyAccessed"
    * or "group" items. Be mindeful though, with great power comes great responsibility.
    * */
-  footer?: RootNavigationItemDefinition[];
+  footer?: Array<RootNavigationItemDefinition<LinkId, Id, ChildrenId>>;
 }
 
 /**
@@ -134,19 +172,23 @@ export interface NavigationTreeDefinition {
  * A project navigation definition that can be passed to the `<DefaultNavigation />` component
  * or when calling `setNavigation()` on the serverless plugin.
  */
-export interface ProjectNavigationDefinition {
+export interface ProjectNavigationDefinition<
+  LinkId extends AppDeepLinkId = AppDeepLinkId,
+  Id extends string = string,
+  ChildrenId extends string = Id
+> {
   /**
    * A navigation tree structure with object items containing labels, links, and sub-items
    * for a project. Use it if you only need to configure your project navigation and leave
    * all the other navigation items to the default (Recently viewed items, Management, etc.)
    */
-  projectNavigationTree?: ProjectNavigationTreeDefinition;
+  projectNavigationTree?: ProjectNavigationTreeDefinition<LinkId, Id, ChildrenId>;
   /**
    * A navigation tree structure with object items containing labels, links, and sub-items
    * that defines a complete side navigation. This configuration overrides `projectNavigationTree`
    * if both are provided.
    */
-  navigationTree?: NavigationTreeDefinition;
+  navigationTree?: NavigationTreeDefinition<LinkId, Id, ChildrenId>;
 }
 
 /**
diff --git a/packages/shared-ux/chrome/navigation/src/utils.ts b/packages/shared-ux/chrome/navigation/src/utils.ts
index 9458d2b6fc283..8322fe797590b 100644
--- a/packages/shared-ux/chrome/navigation/src/utils.ts
+++ b/packages/shared-ux/chrome/navigation/src/utils.ts
@@ -6,6 +6,47 @@
  * Side Public License, v 1.
  */
 
+import type { ChromeProjectNavigationNode, NodeDefinition } from '@kbn/core-chrome-browser';
+
+let uniqueId = 0;
+
+function generateUniqueNodeId() {
+  const id = `node${uniqueId++}`;
+  return id;
+}
+
 export function isAbsoluteLink(link: string) {
   return link.startsWith('http://') || link.startsWith('https://');
 }
+
+export function nodePathToString<T extends { path?: string[]; id: string } | null>(
+  node?: T
+): T extends { path?: string[]; id: string } ? string : undefined {
+  if (!node) return undefined as T extends { path?: string[]; id: string } ? string : undefined;
+  return (node.path ? node.path.join('.') : node.id) as T extends { path?: string[]; id: string }
+    ? string
+    : undefined;
+}
+
+export function isGroupNode({ children }: Pick<ChromeProjectNavigationNode, 'children'>) {
+  return children !== undefined;
+}
+
+export function isItemNode({ children }: Pick<ChromeProjectNavigationNode, 'children'>) {
+  return children === undefined;
+}
+
+export function getNavigationNodeId(
+  { id: _id, link }: Pick<NodeDefinition, 'id' | 'link'>,
+  idGenerator = generateUniqueNodeId
+): string {
+  const id = _id ?? link;
+  return id ?? idGenerator();
+}
+
+export function getNavigationNodeHref({
+  href,
+  deepLink,
+}: Pick<ChromeProjectNavigationNode, 'href' | 'deepLink'>): string | undefined {
+  return deepLink?.url ?? href;
+}
diff --git a/packages/shared-ux/chrome/navigation/types/index.ts b/packages/shared-ux/chrome/navigation/types/index.ts
index 00d8e69edf0e3..e162e395362a9 100644
--- a/packages/shared-ux/chrome/navigation/types/index.ts
+++ b/packages/shared-ux/chrome/navigation/types/index.ts
@@ -30,6 +30,7 @@ export interface NavigationServices {
   onProjectNavigationChange: (chromeProjectNavigation: ChromeProjectNavigation) => void;
   activeNodes$: Observable<ChromeProjectNavigationNode[][]>;
   cloudLinks: CloudLinks;
+  isSideNavCollapsed: boolean;
 }
 
 /**
@@ -45,6 +46,7 @@ export interface NavigationKibanaDependencies {
       navLinks: {
         getNavLinks$: () => Observable<Readonly<ChromeNavLink[]>>;
       };
+      getIsSideNavCollapsed$: () => Observable<boolean>;
     };
     http: {
       basePath: BasePathService;
diff --git a/packages/shared-ux/page/analytics_no_data/impl/src/analytics_no_data_page.component.test.tsx b/packages/shared-ux/page/analytics_no_data/impl/src/analytics_no_data_page.component.test.tsx
index 4e16dd6c38bc0..ac59185e25ef9 100644
--- a/packages/shared-ux/page/analytics_no_data/impl/src/analytics_no_data_page.component.test.tsx
+++ b/packages/shared-ux/page/analytics_no_data/impl/src/analytics_no_data_page.component.test.tsx
@@ -147,5 +147,25 @@ describe('AnalyticsNoDataPageComponent', () => {
         await screen.findByTestId('kbnOverviewElasticsearchGettingStarted');
       });
     });
+
+    describe('serverless_observability flavor', () => {
+      it('renders getting started card', async () => {
+        render(
+          <I18nProvider>
+            <AnalyticsNoDataPageProvider {...{ ...services, hasESData: async () => false }}>
+              <AnalyticsNoDataPage
+                pageFlavor={'serverless_observability'}
+                onDataViewCreated={onDataViewCreated}
+                kibanaGuideDocLink={'http://www.test.com'}
+                showPlainSpinner={false}
+                prependBasePath={(path: string) => path}
+              />
+            </AnalyticsNoDataPageProvider>
+          </I18nProvider>
+        );
+
+        await screen.findByTestId('kbnObservabilityNoData');
+      });
+    });
   });
 });
diff --git a/packages/shared-ux/page/analytics_no_data/impl/src/analytics_no_data_page.component.tsx b/packages/shared-ux/page/analytics_no_data/impl/src/analytics_no_data_page.component.tsx
index 4c22a0acb2475..a7cb75e2c1fb0 100644
--- a/packages/shared-ux/page/analytics_no_data/impl/src/analytics_no_data_page.component.tsx
+++ b/packages/shared-ux/page/analytics_no_data/impl/src/analytics_no_data_page.component.tsx
@@ -79,6 +79,31 @@ const flavors: {
       },
     },
   }),
+  serverless_observability: ({ prependBasePath }) => ({
+    solution: i18n.translate('sharedUXPackages.noDataConfig.observability', {
+      defaultMessage: 'Observability',
+    }),
+    pageTitle: i18n.translate('sharedUXPackages.noDataConfig.observabilityPageTitle', {
+      defaultMessage: 'Welcome to Elastic Observability!',
+    }),
+    pageDescription: i18n.translate('sharedUXPackages.noDataConfig.observabilityPageDescription', {
+      defaultMessage:
+        'Converge metrics, logs, and traces to monitor the health of your applications.',
+    }),
+    logo: 'logoObservability',
+    action: {
+      observability: {
+        title: i18n.translate('sharedUXPackages.noDataConfig.observabilityTitle', {
+          defaultMessage: 'Add data',
+        }),
+        description: i18n.translate('sharedUXPackages.noDataConfig.observabilityDescription', {
+          defaultMessage: 'Get started by collecting data using one of our many integrations.',
+        }),
+        'data-test-subj': 'kbnObservabilityNoData',
+        href: prependBasePath('/app/observabilityOnboarding/'),
+      },
+    },
+  }),
 };
 
 /**
diff --git a/packages/shared-ux/page/analytics_no_data/types/index.d.ts b/packages/shared-ux/page/analytics_no_data/types/index.d.ts
index f292e297b6fdc..1b71ac172f0de 100644
--- a/packages/shared-ux/page/analytics_no_data/types/index.d.ts
+++ b/packages/shared-ux/page/analytics_no_data/types/index.d.ts
@@ -26,7 +26,7 @@ export interface Services {
  */
 export type AnalyticsNoDataPageServices = Services & KibanaNoDataPageServices;
 
-export type AnalyticsNoDataPageFlavor = 'kibana' | 'serverless_search';
+export type AnalyticsNoDataPageFlavor = 'kibana' | 'serverless_search' | 'serverless_observability';
 
 export interface KibanaDependencies {
   coreStart: {
diff --git a/packages/shared-ux/page/no_data/impl/src/no_data_page.tsx b/packages/shared-ux/page/no_data/impl/src/no_data_page.tsx
index 5aec81d942de6..0ba20b259108d 100644
--- a/packages/shared-ux/page/no_data/impl/src/no_data_page.tsx
+++ b/packages/shared-ux/page/no_data/impl/src/no_data_page.tsx
@@ -24,6 +24,7 @@ export const NoDataPage = ({
   action,
   docsLink,
   pageTitle,
+  pageDescription,
   className,
 }: NoDataPageProps) => {
   const title =
@@ -39,21 +40,23 @@ export const NoDataPage = ({
     </EuiLink>
   ) : null;
 
-  const message = link ? (
-    <FormattedMessage
-      id="sharedUXPackages.noDataPage.intro"
-      defaultMessage="Add your data to get started, or {link} about {solution}."
-      values={{
-        solution,
-        link,
-      }}
-    />
-  ) : (
-    <FormattedMessage
-      id="sharedUXPackages.noDataPage.introNoDocLink"
-      defaultMessage="Add your data to get started."
-    />
-  );
+  const message =
+    pageDescription ??
+    (link ? (
+      <FormattedMessage
+        id="sharedUXPackages.noDataPage.intro"
+        defaultMessage="Add your data to get started, or {link} about {solution}."
+        values={{
+          solution,
+          link,
+        }}
+      />
+    ) : (
+      <FormattedMessage
+        id="sharedUXPackages.noDataPage.introNoDocLink"
+        defaultMessage="Add your data to get started."
+      />
+    ));
 
   return (
     <EuiPageTemplate.Section
diff --git a/packages/shared-ux/page/no_data/types/index.d.ts b/packages/shared-ux/page/no_data/types/index.d.ts
index 6f29e5ab08d7a..782ce254213d8 100644
--- a/packages/shared-ux/page/no_data/types/index.d.ts
+++ b/packages/shared-ux/page/no_data/types/index.d.ts
@@ -42,6 +42,10 @@ export interface NoDataPageProps extends CommonProps, ActionCardProps {
    * Optionally replace the auto-generated page title (h1)
    */
   pageTitle?: string;
+  /**
+   * Optionally replace the auto-generated page description
+   */
+  pageDescription?: string;
 }
 
 /**
diff --git a/scripts/create_observability_rules.js b/scripts/create_observability_rules.js
new file mode 100644
index 0000000000000..4dce916e6de07
--- /dev/null
+++ b/scripts/create_observability_rules.js
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+require('@babel/register')({
+  extensions: ['.ts', '.js'],
+  presets: [['@babel/preset-env', { targets: { node: 'current' } }], '@babel/preset-typescript'],
+});
+
+var run = require('@kbn/observability-alerting-test-data').run;
+
+run();
diff --git a/src/dev/license_checker/config.ts b/src/dev/license_checker/config.ts
index 037ea764083ef..73c089e29d5d0 100644
--- a/src/dev/license_checker/config.ts
+++ b/src/dev/license_checker/config.ts
@@ -84,7 +84,7 @@ export const PER_PACKAGE_ALLOWED_LICENSES = {
 export const LICENSE_OVERRIDES = {
   'jsts@1.6.2': ['Eclipse Distribution License - v 1.0'], // cf. https://github.com/bjornharrtell/jsts
   '@mapbox/jsonlint-lines-primitives@2.0.2': ['MIT'], // license in readme https://github.com/tmcw/jsonlint
-  '@elastic/ems-client@8.4.0': ['Elastic License 2.0'],
+  '@elastic/ems-client@8.5.0': ['Elastic License 2.0'],
   '@elastic/eui@89.0.0': ['SSPL-1.0 OR Elastic License 2.0'],
   'language-subtag-registry@0.3.21': ['CC-BY-4.0'], // retired ODC‑By license https://github.com/mattcg/language-subtag-registry
   'buffers@0.1.1': ['MIT'], // license in importing module https://www.npmjs.com/package/binary
diff --git a/src/plugins/dashboard/public/dashboard_container/component/viewport/dashboard_viewport.tsx b/src/plugins/dashboard/public/dashboard_container/component/viewport/dashboard_viewport.tsx
index e37f14ee5b977..2072f3b630bbf 100644
--- a/src/plugins/dashboard/public/dashboard_container/component/viewport/dashboard_viewport.tsx
+++ b/src/plugins/dashboard/public/dashboard_container/component/viewport/dashboard_viewport.tsx
@@ -16,7 +16,6 @@ import { ViewMode } from '@kbn/embeddable-plugin/public';
 import { ExitFullScreenButton } from '@kbn/shared-ux-button-exit-full-screen';
 
 import { DashboardGrid } from '../grid';
-import { pluginServices } from '../../../services/plugin_services';
 import { useDashboardContainer } from '../../embeddable/dashboard_container';
 import { DashboardEmptyScreen } from '../empty_screen/dashboard_empty_screen';
 
@@ -35,9 +34,6 @@ export const useDebouncedWidthObserver = (skipDebounce = false, wait = 100) => {
 };
 
 export const DashboardViewportComponent = () => {
-  const {
-    settings: { isProjectEnabledInLabs },
-  } = pluginServices.getServices();
   const controlsRoot = useRef(null);
 
   const dashboard = useDashboardContainer();
@@ -60,7 +56,6 @@ export const DashboardViewportComponent = () => {
   const description = dashboard.select((state) => state.explicitInput.description);
   const focusedPanelId = dashboard.select((state) => state.componentState.focusedPanelId);
   const expandedPanelId = dashboard.select((state) => state.componentState.expandedPanelId);
-  const controlsEnabled = isProjectEnabledInLabs('labs:dashboard:dashboardControls');
 
   const { ref: resizeRef, width: viewportWidth } = useDebouncedWidthObserver(!!focusedPanelId);
 
@@ -71,7 +66,7 @@ export const DashboardViewportComponent = () => {
 
   return (
     <div className={'dshDashboardViewportWrapper'}>
-      {controlsEnabled && controlGroup && viewMode !== ViewMode.PRINT ? (
+      {controlGroup && viewMode !== ViewMode.PRINT ? (
         <div
           className={controlCount > 0 ? 'dshDashboardViewport-controls' : ''}
           ref={controlsRoot}
diff --git a/src/plugins/data/server/search/strategies/esql_search/esql_search_strategy.ts b/src/plugins/data/server/search/strategies/esql_search/esql_search_strategy.ts
index 7f3f6f521853d..2af032826189f 100644
--- a/src/plugins/data/server/search/strategies/esql_search/esql_search_strategy.ts
+++ b/src/plugins/data/server/search/strategies/esql_search/esql_search_strategy.ts
@@ -11,6 +11,8 @@ import type { Logger } from '@kbn/core/server';
 import { getKbnServerError, KbnServerError } from '@kbn/kibana-utils-plugin/server';
 import type { ISearchStrategy } from '../../types';
 
+const ES_TIMEOUT_IN_MS = 120000;
+
 export const esqlSearchStrategyProvider = (
   logger: Logger,
   useInternalUser: boolean = false
@@ -23,6 +25,17 @@ export const esqlSearchStrategyProvider = (
    * @returns `Observable<IEsSearchResponse<any>>`
    */
   search: (request, { abortSignal, ...options }, { esClient, uiSettingsClient }) => {
+    const abortController = new AbortController();
+    // We found out that there are cases where we are not aborting correctly
+    // For this reasons we want to manually cancel he abort signal after 2 mins
+
+    abortSignal?.addEventListener('abort', () => {
+      abortController.abort();
+    });
+
+    // Also abort after two mins
+    setTimeout(() => abortController.abort(), ES_TIMEOUT_IN_MS);
+
     // Only default index pattern type is supported here.
     // See ese for other type support.
     if (request.indexType) {
@@ -41,8 +54,10 @@ export const esqlSearchStrategyProvider = (
             },
           },
           {
-            signal: abortSignal,
+            signal: abortController.signal,
             meta: true,
+            // we don't want the ES client to retry (default value is 3)
+            maxRetries: 0,
           }
         );
         return {
diff --git a/src/plugins/es_ui_shared/public/components/section_loading/section_loading.tsx b/src/plugins/es_ui_shared/public/components/section_loading/section_loading.tsx
index 119e053312dc8..cbdaf444ca228 100644
--- a/src/plugins/es_ui_shared/public/components/section_loading/section_loading.tsx
+++ b/src/plugins/es_ui_shared/public/components/section_loading/section_loading.tsx
@@ -15,13 +15,24 @@ import { KibanaPageTemplate } from '@kbn/shared-ux-page-kibana-template';
 interface Props {
   inline?: boolean;
   children: React.ReactNode;
+  'data-test-subj'?: string;
   [key: string]: any;
 }
 
-export const SectionLoading: React.FunctionComponent<Props> = ({ inline, children, ...rest }) => {
+export const SectionLoading: React.FunctionComponent<Props> = ({
+  inline,
+  'data-test-subj': dataTestSubj,
+  children,
+  ...rest
+}) => {
   if (inline) {
     return (
-      <EuiFlexGroup justifyContent="flexStart" alignItems="center" gutterSize="s">
+      <EuiFlexGroup
+        justifyContent="flexStart"
+        alignItems="center"
+        gutterSize="s"
+        data-test-subj={dataTestSubj}
+      >
         <EuiFlexItem grow={false}>
           <EuiLoadingSpinner size="m" />
         </EuiFlexItem>
@@ -38,7 +49,7 @@ export const SectionLoading: React.FunctionComponent<Props> = ({ inline, childre
     <KibanaPageTemplate.EmptyPrompt
       title={<EuiLoadingSpinner size="xl" />}
       body={<EuiText color="subdued">{children}</EuiText>}
-      data-test-subj="sectionLoading"
+      data-test-subj={dataTestSubj ?? 'sectionLoading'}
     />
   );
 };
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
index d9a7f95108e47..0862d6ece004a 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
@@ -489,10 +489,6 @@ export const stackManagementSchema: MakeSchemaFrom<UsageStats> = {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
   },
-  'labs:dashboard:dashboardControls': {
-    type: 'boolean',
-    _meta: { description: 'Non-default value of setting.' },
-  },
   'labs:dashboard:linksPanel': {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
index 013b3de057422..3499471e0d5a8 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
@@ -137,7 +137,6 @@ export interface UsageStats {
   'labs:dashboard:enable_ui': boolean;
   'labs:dashboard:linksPanel': boolean;
   'labs:dashboard:deferBelowFold': boolean;
-  'labs:dashboard:dashboardControls': boolean;
   'discover:rowHeightOption': number;
   hideAnnouncements: boolean;
   isDefaultIndexMigrated: boolean;
diff --git a/src/plugins/management/README.md b/src/plugins/management/README.md
index 828715235b1b9..15974f6d4814d 100644
--- a/src/plugins/management/README.md
+++ b/src/plugins/management/README.md
@@ -39,13 +39,3 @@ If card needs to be hidden from the navigation you can specify that by using the
 ```
 
 More specifics about the `setupCardsNavigation` can be found in `packages/kbn-management/cards_navigation/readme.mdx`.
-
-## Landing page redirect
-
-If the consumer wants to have a separate landing page for the management section, they can use the `setLandingPageRedirect`
-method to specify the path to the landing page:
-
-
-```
-  management.setLandingPageRedirect('/app/security/management');
-```
\ No newline at end of file
diff --git a/src/plugins/management/public/components/landing/landing.tsx b/src/plugins/management/public/components/landing/landing.tsx
index b7d48d7b08491..90323ad838eb9 100644
--- a/src/plugins/management/public/components/landing/landing.tsx
+++ b/src/plugins/management/public/components/landing/landing.tsx
@@ -24,24 +24,9 @@ export const ManagementLandingPage = ({
   setBreadcrumbs,
   onAppMounted,
 }: ManagementLandingPageProps) => {
-  const {
-    appBasePath,
-    sections,
-    kibanaVersion,
-    cardsNavigationConfig,
-    landingPageRedirect,
-    navigateToUrl,
-    basePath,
-  } = useAppContext();
+  const { appBasePath, sections, kibanaVersion, cardsNavigationConfig } = useAppContext();
   setBreadcrumbs();
 
-  // Redirect the user to the configured landing page if there is one
-  useEffect(() => {
-    if (landingPageRedirect) {
-      navigateToUrl(basePath.prepend(landingPageRedirect));
-    }
-  }, [landingPageRedirect, navigateToUrl, basePath]);
-
   useEffect(() => {
     onAppMounted('');
   }, [onAppMounted]);
diff --git a/src/plugins/management/public/components/management_app/management_app.tsx b/src/plugins/management/public/components/management_app/management_app.tsx
index 0781e433b85bb..dc6a67a406282 100644
--- a/src/plugins/management/public/components/management_app/management_app.tsx
+++ b/src/plugins/management/public/components/management_app/management_app.tsx
@@ -43,7 +43,6 @@ export interface ManagementAppDependencies {
   setBreadcrumbs: (newBreadcrumbs: ChromeBreadcrumb[]) => void;
   isSidebarEnabled$: BehaviorSubject<boolean>;
   cardsNavigationConfig$: BehaviorSubject<NavigationCardsSubject>;
-  landingPageRedirect$: BehaviorSubject<string | undefined>;
 }
 
 export const ManagementApp = ({
@@ -52,13 +51,11 @@ export const ManagementApp = ({
   theme$,
   appBasePath,
 }: ManagementAppProps) => {
-  const { setBreadcrumbs, isSidebarEnabled$, cardsNavigationConfig$, landingPageRedirect$ } =
-    dependencies;
+  const { setBreadcrumbs, isSidebarEnabled$, cardsNavigationConfig$ } = dependencies;
   const [selectedId, setSelectedId] = useState<string>('');
   const [sections, setSections] = useState<ManagementSection[]>();
   const isSidebarEnabled = useObservable(isSidebarEnabled$);
   const cardsNavigationConfig = useObservable(cardsNavigationConfig$);
-  const landingPageRedirect = useObservable(landingPageRedirect$);
 
   const onAppMounted = useCallback((id: string) => {
     setSelectedId(id);
@@ -114,9 +111,6 @@ export const ManagementApp = ({
     sections,
     cardsNavigationConfig,
     kibanaVersion: dependencies.kibanaVersion,
-    landingPageRedirect,
-    navigateToUrl: dependencies.coreStart.application.navigateToUrl,
-    basePath: dependencies.coreStart.http.basePath,
   };
 
   return (
diff --git a/src/plugins/management/public/mocks/index.ts b/src/plugins/management/public/mocks/index.ts
index bc6bdcdc46814..93ccefbe5130f 100644
--- a/src/plugins/management/public/mocks/index.ts
+++ b/src/plugins/management/public/mocks/index.ts
@@ -44,7 +44,6 @@ const createSetupContract = (): ManagementSetup => ({
 const createStartContract = (): ManagementStart => ({
   setIsSidebarEnabled: jest.fn(),
   setupCardsNavigation: jest.fn(),
-  setLandingPageRedirect: jest.fn(),
 });
 
 export const managementPluginMock = {
diff --git a/src/plugins/management/public/plugin.tsx b/src/plugins/management/public/plugin.tsx
index cf0ec90af6682..7b6b0c06ec731 100644
--- a/src/plugins/management/public/plugin.tsx
+++ b/src/plugins/management/public/plugin.tsx
@@ -90,7 +90,6 @@ export class ManagementPlugin
   private hasAnyEnabledApps = true;
 
   private isSidebarEnabled$ = new BehaviorSubject<boolean>(true);
-  private landingPageRedirect$ = new BehaviorSubject<string | undefined>(undefined);
   private cardsNavigationConfig$ = new BehaviorSubject<NavigationCardsSubject>({
     enabled: false,
     hideLinksTo: [],
@@ -151,7 +150,6 @@ export class ManagementPlugin
           },
           isSidebarEnabled$: managementPlugin.isSidebarEnabled$,
           cardsNavigationConfig$: managementPlugin.cardsNavigationConfig$,
-          landingPageRedirect$: managementPlugin.landingPageRedirect$,
         });
       },
     });
@@ -209,8 +207,6 @@ export class ManagementPlugin
         this.isSidebarEnabled$.next(isSidebarEnabled),
       setupCardsNavigation: ({ enabled, hideLinksTo }) =>
         this.cardsNavigationConfig$.next({ enabled, hideLinksTo }),
-      setLandingPageRedirect: (landingPageRedirect: string) =>
-        this.landingPageRedirect$.next(landingPageRedirect),
     };
   }
 }
diff --git a/src/plugins/management/public/types.ts b/src/plugins/management/public/types.ts
index 31755c39cc7c2..439f827797f6b 100644
--- a/src/plugins/management/public/types.ts
+++ b/src/plugins/management/public/types.ts
@@ -12,8 +12,6 @@ import type { LocatorPublic } from '@kbn/share-plugin/common';
 import { ChromeBreadcrumb, CoreTheme } from '@kbn/core/public';
 import type { AppId } from '@kbn/management-cards-navigation';
 import { AppNavLinkStatus } from '@kbn/core/public';
-import type { ApplicationStart } from '@kbn/core-application-browser';
-import type { HttpStart } from '@kbn/core-http-browser';
 import { ManagementSection, RegisterManagementSectionArgs } from './utils';
 import type { ManagementAppLocatorParams } from '../common/locator';
 
@@ -33,7 +31,6 @@ export interface DefinedSections {
 
 export interface ManagementStart {
   setIsSidebarEnabled: (enabled: boolean) => void;
-  setLandingPageRedirect: (landingPageRedirect: string) => void;
   setupCardsNavigation: ({ enabled, hideLinksTo }: NavigationCardsSubject) => void;
 }
 
@@ -95,9 +92,6 @@ export interface AppDependencies {
   kibanaVersion: string;
   sections: ManagementSection[];
   cardsNavigationConfig?: NavigationCardsSubject;
-  landingPageRedirect: string | undefined;
-  navigateToUrl: ApplicationStart['navigateToUrl'];
-  basePath: HttpStart['basePath'];
 }
 
 export interface ConfigSchema {
diff --git a/src/plugins/management/tsconfig.json b/src/plugins/management/tsconfig.json
index 0f060475796c5..493178682496b 100644
--- a/src/plugins/management/tsconfig.json
+++ b/src/plugins/management/tsconfig.json
@@ -24,8 +24,6 @@
     "@kbn/shared-ux-link-redirect-app",
     "@kbn/test-jest-helpers",
     "@kbn/config-schema",
-    "@kbn/core-application-browser",
-    "@kbn/core-http-browser",
     "@kbn/serverless",
     "@kbn/management-settings-application",
     "@kbn/react-kibana-context-render",
diff --git a/src/plugins/maps_ems/common/ems_defaults.ts b/src/plugins/maps_ems/common/ems_defaults.ts
index f434434ba542f..93b4e2574c73b 100644
--- a/src/plugins/maps_ems/common/ems_defaults.ts
+++ b/src/plugins/maps_ems/common/ems_defaults.ts
@@ -17,3 +17,5 @@ export const DEFAULT_EMS_ROADMAP_DESATURATED_ID = 'road_map_desaturated';
 export const DEFAULT_EMS_DARKMAP_ID = 'dark_map';
 
 export const EMS_APP_NAME = 'kibana'; // app-name submitted as the `app`-param to EMS
+
+export const DEFAULT_EMS_REST_VERSION = '2023-10-31';
diff --git a/src/plugins/maps_ems/common/index.ts b/src/plugins/maps_ems/common/index.ts
index 4ec8250cfc676..a766a321296d1 100644
--- a/src/plugins/maps_ems/common/index.ts
+++ b/src/plugins/maps_ems/common/index.ts
@@ -14,6 +14,7 @@ export {
   DEFAULT_EMS_ROADMAP_ID,
   DEFAULT_EMS_ROADMAP_DESATURATED_ID,
   DEFAULT_EMS_DARKMAP_ID,
+  DEFAULT_EMS_REST_VERSION,
   EMS_APP_NAME,
 } from './ems_defaults';
 
diff --git a/src/plugins/maps_ems/public/lazy_load_bundle/create_ems_client.test.ts b/src/plugins/maps_ems/public/lazy_load_bundle/create_ems_client.test.ts
new file mode 100644
index 0000000000000..c30c7f1df97f3
--- /dev/null
+++ b/src/plugins/maps_ems/public/lazy_load_bundle/create_ems_client.test.ts
@@ -0,0 +1,116 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ELASTIC_HTTP_VERSION_HEADER } from '@kbn/core-http-common';
+import { EMSSettings } from '../../common/ems_settings';
+import {
+  DEFAULT_EMS_FILE_API_URL,
+  DEFAULT_EMS_FONT_LIBRARY_URL,
+  DEFAULT_EMS_LANDING_PAGE_URL,
+  DEFAULT_EMS_TILE_API_URL,
+  DEFAULT_EMS_REST_VERSION,
+} from '../../common/ems_defaults';
+import { createEMSClient } from './create_ems_client';
+
+import type { EMSConfig } from '../../common/ems_settings';
+import { BuildFlavor } from '@kbn/config/src/types';
+import { LATEST_API_URL_PATH } from '@elastic/ems-client';
+
+const IS_ENTERPRISE_PLUS = () => true;
+
+describe('createEMSClient', () => {
+  const mockConfig: EMSConfig = {
+    includeElasticMapsService: true,
+    emsUrl: '',
+    emsFileApiUrl: DEFAULT_EMS_FILE_API_URL,
+    emsTileApiUrl: DEFAULT_EMS_TILE_API_URL,
+    emsLandingPageUrl: DEFAULT_EMS_LANDING_PAGE_URL,
+    emsFontLibraryUrl: DEFAULT_EMS_FONT_LIBRARY_URL,
+  };
+  const emsSettings = new EMSSettings(mockConfig, IS_ENTERPRISE_PLUS);
+
+  describe('settings for traditional (SemVer)', () => {
+    const kbnVersion = '8.7.6';
+    const minorKbnVersion = 'v8.7';
+    const build: BuildFlavor = 'traditional';
+    const emsClient = createEMSClient(emsSettings, kbnVersion, build);
+
+    test('should point to the /vX.Y folder on traditional SemVer (X.Y.Z)', () => {
+      expect(emsClient.getLandingPageUrl()).toBe(
+        DEFAULT_EMS_LANDING_PAGE_URL + '/' + minorKbnVersion
+      );
+    });
+
+    test('client should use the Kibana Version as my_app_version query param', () => {
+      const clientParams = new URLSearchParams(emsClient.extendUrlWithParams('https://my.host'));
+      expect(clientParams.get('my_app_version')).toBe(kbnVersion);
+    });
+
+    test('client should point to /vX.Y on the services URLs ', async () => {
+      const { services } = await emsClient.getMainManifest();
+
+      ['tms', 'file'].map((type) => {
+        const service = services.find((s) => s.type === type);
+        expect(service?.manifest.match(minorKbnVersion));
+      });
+    });
+
+    test('fetch function should not include the serverless header', async () => {
+      global.fetch = jest.fn((_, { headers }: { headers: Headers }) => {
+        expect(headers.has(ELASTIC_HTTP_VERSION_HEADER)).toBeFalsy();
+        return Promise.resolve({
+          ok: true,
+          json: () => Promise.resolve({ layers: [{ layer_id: 'mock_1' }] }),
+        });
+      }) as jest.Mock;
+
+      const mocked = await emsClient.getFileLayers();
+      // Ensure we ran the mocked function
+      expect(mocked[0].getId()).toBe('mock_1');
+    });
+  });
+
+  describe('Override settings for serverless', () => {
+    const kbnVersion: string = 'foo';
+    const build: BuildFlavor = 'serverless';
+
+    const emsClient = createEMSClient(emsSettings, kbnVersion, build);
+
+    test('should point to the root', () => {
+      expect(emsClient.getLandingPageUrl()).toBe(DEFAULT_EMS_LANDING_PAGE_URL);
+    });
+
+    test('client should use DEFAULT_EMS_REST_VERSION as my_app_version query param ', () => {
+      const clientParams = new URLSearchParams(emsClient.extendUrlWithParams('https://my.host'));
+      expect(clientParams.get('my_app_version')).toBe(DEFAULT_EMS_REST_VERSION);
+    });
+
+    test('client should point to /LATEST_API_URL_PATH on the services URLs ', async () => {
+      const { services } = await emsClient.getMainManifest();
+
+      ['tms', 'file'].map((type) => {
+        const service = services.find((s) => s.type === type);
+        expect(service?.manifest.match(LATEST_API_URL_PATH));
+      });
+    });
+
+    test('fetch function should include the serverless header', async () => {
+      global.fetch = jest.fn((_, { headers }: { headers: Headers }) => {
+        expect(headers.get(ELASTIC_HTTP_VERSION_HEADER)).toBe(DEFAULT_EMS_REST_VERSION);
+        return Promise.resolve({
+          ok: true,
+          json: () => Promise.resolve({ layers: [{ layer_id: 'mock_2' }] }),
+        });
+      }) as jest.Mock;
+
+      const mocked = await emsClient.getFileLayers();
+      // Ensure we ran the mocked function
+      expect(mocked[0].getId()).toBe('mock_2');
+    });
+  });
+});
diff --git a/src/plugins/maps_ems/public/lazy_load_bundle/create_ems_client.ts b/src/plugins/maps_ems/public/lazy_load_bundle/create_ems_client.ts
index aad9ca3933e76..b86f674b6be20 100644
--- a/src/plugins/maps_ems/public/lazy_load_bundle/create_ems_client.ts
+++ b/src/plugins/maps_ems/public/lazy_load_bundle/create_ems_client.ts
@@ -8,10 +8,11 @@
 
 import coerce from 'semver/functions/coerce';
 
+import { ELASTIC_HTTP_VERSION_HEADER } from '@kbn/core-http-common';
 import { BuildFlavor } from '@kbn/config/src/types';
 import { i18n } from '@kbn/i18n';
 import { EMSClient } from '@elastic/ems-client';
-import { EMS_APP_NAME, EMSSettings } from '../../common';
+import { EMS_APP_NAME, EMSSettings, DEFAULT_EMS_REST_VERSION } from '../../common';
 
 export function createEMSClient(
   emsSettings: EMSSettings,
@@ -20,22 +21,30 @@ export function createEMSClient(
 ): EMSClient {
   let landingPageUrl = emsSettings!.getEMSLandingPageUrl();
   const kbnSemVer = coerce(kbnVersion);
+  const isServerless = buildFlavor === 'serverless';
+  const headers = new Headers();
 
-  if (buildFlavor === 'traditional' && kbnSemVer) {
+  if (!isServerless && kbnSemVer) {
     landingPageUrl = `${landingPageUrl}/v${kbnSemVer.major}.${kbnSemVer.minor}`;
   }
 
+  if (isServerless) {
+    headers.append(ELASTIC_HTTP_VERSION_HEADER, DEFAULT_EMS_REST_VERSION);
+  }
+
+  const version = isServerless ? DEFAULT_EMS_REST_VERSION : kbnVersion;
+
   return new EMSClient({
     language: i18n.getLocale(),
-    appVersion: kbnVersion,
+    appVersion: version,
+    emsVersion: version,
     appName: EMS_APP_NAME,
     tileApiUrl: emsSettings!.getEMSTileApiUrl(),
     fileApiUrl: emsSettings!.getEMSFileApiUrl(),
     landingPageUrl,
     fetchFunction(url: string) {
-      return fetch(url);
+      return fetch(url, { headers });
     },
     proxyPath: '',
-    emsVersion: kbnVersion,
   });
 }
diff --git a/src/plugins/maps_ems/tsconfig.json b/src/plugins/maps_ems/tsconfig.json
index c9d4ccde9d836..7d32dacb6d55a 100644
--- a/src/plugins/maps_ems/tsconfig.json
+++ b/src/plugins/maps_ems/tsconfig.json
@@ -10,6 +10,7 @@
     "@kbn/i18n",
     "@kbn/config-schema",
     "@kbn/config",
+    "@kbn/core-http-common",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/no_data_page/config.ts b/src/plugins/no_data_page/config.ts
index 8fae1aad10aaa..729f13000a0ba 100644
--- a/src/plugins/no_data_page/config.ts
+++ b/src/plugins/no_data_page/config.ts
@@ -11,7 +11,13 @@ import { schema, TypeOf, offeringBasedSchema } from '@kbn/config-schema';
 export const configSchema = schema.object({
   analyticsNoDataPageFlavor: offeringBasedSchema({
     serverless: schema.oneOf(
-      [schema.oneOf([schema.literal('kibana'), schema.literal('serverless_search')])],
+      [
+        schema.oneOf([
+          schema.literal('kibana'),
+          schema.literal('serverless_search'),
+          schema.literal('serverless_observability'),
+        ]),
+      ],
       { defaultValue: 'kibana' as const }
     ),
   }),
diff --git a/src/plugins/no_data_page/public/types.ts b/src/plugins/no_data_page/public/types.ts
index c9523f7fcd93a..2e33170ec06bf 100644
--- a/src/plugins/no_data_page/public/types.ts
+++ b/src/plugins/no_data_page/public/types.ts
@@ -7,7 +7,7 @@
  */
 
 export interface NoDataPagePluginSetup {
-  getAnalyticsNoDataPageFlavor: () => 'kibana' | 'serverless_search';
+  getAnalyticsNoDataPageFlavor: () => 'kibana' | 'serverless_search' | 'serverless_observability';
 }
 
 export type NoDataPagePluginStart = NoDataPagePluginSetup;
diff --git a/src/plugins/presentation_util/common/labs.ts b/src/plugins/presentation_util/common/labs.ts
index 18fd77a364429..a6ac9c7d8ae71 100644
--- a/src/plugins/presentation_util/common/labs.ts
+++ b/src/plugins/presentation_util/common/labs.ts
@@ -11,15 +11,9 @@ import { i18n } from '@kbn/i18n';
 export const LABS_PROJECT_PREFIX = 'labs:';
 export const DEFER_BELOW_FOLD = `${LABS_PROJECT_PREFIX}dashboard:deferBelowFold` as const;
 export const DASHBOARD_LINKS_PANEL = `${LABS_PROJECT_PREFIX}dashboard:linksPanel` as const;
-export const DASHBOARD_CONTROLS = `${LABS_PROJECT_PREFIX}dashboard:dashboardControls` as const;
 export const BY_VALUE_EMBEDDABLE = `${LABS_PROJECT_PREFIX}canvas:byValueEmbeddable` as const;
 
-export const projectIDs = [
-  DEFER_BELOW_FOLD,
-  DASHBOARD_CONTROLS,
-  BY_VALUE_EMBEDDABLE,
-  DASHBOARD_LINKS_PANEL,
-] as const;
+export const projectIDs = [DEFER_BELOW_FOLD, BY_VALUE_EMBEDDABLE, DASHBOARD_LINKS_PANEL] as const;
 export const environmentNames = ['kibana', 'browser', 'session'] as const;
 export const solutionNames = ['canvas', 'dashboard', 'presentation'] as const;
 
@@ -49,20 +43,6 @@ export const projects: { [ID in ProjectID]: ProjectConfig & { id: ID } } = {
     }),
     solutions: ['dashboard'],
   },
-  [DASHBOARD_CONTROLS]: {
-    id: DASHBOARD_CONTROLS,
-    isActive: true,
-    isDisplayed: true,
-    environments: ['kibana', 'browser', 'session'],
-    name: i18n.translate('presentationUtil.labs.enableDashboardControlsProjectName', {
-      defaultMessage: 'Enable dashboard controls',
-    }),
-    description: i18n.translate('presentationUtil.labs.enableDashboardControlsProjectDescription', {
-      defaultMessage:
-        'Enables the controls system for dashboard, which allows dashboard authors to more easily build interactive elements for their users.',
-    }),
-    solutions: ['dashboard'],
-  },
   [DASHBOARD_LINKS_PANEL]: {
     id: DASHBOARD_LINKS_PANEL,
     isActive: true,
diff --git a/src/plugins/telemetry/schema/oss_plugins.json b/src/plugins/telemetry/schema/oss_plugins.json
index 8f2a80e500986..0854944f39404 100644
--- a/src/plugins/telemetry/schema/oss_plugins.json
+++ b/src/plugins/telemetry/schema/oss_plugins.json
@@ -9923,12 +9923,6 @@
             "description": "Non-default value of setting."
           }
         },
-        "labs:dashboard:dashboardControls": {
-          "type": "boolean",
-          "_meta": {
-            "description": "Non-default value of setting."
-          }
-        },
         "labs:dashboard:linksPanel": {
           "type": "boolean",
           "_meta": {
diff --git a/src/plugins/unified_doc_viewer/public/components/doc_viewer_table/table.tsx b/src/plugins/unified_doc_viewer/public/components/doc_viewer_table/table.tsx
index 66a40991da9cb..5a53f8a8eee50 100644
--- a/src/plugins/unified_doc_viewer/public/components/doc_viewer_table/table.tsx
+++ b/src/plugins/unified_doc_viewer/public/components/doc_viewer_table/table.tsx
@@ -38,6 +38,7 @@ import {
   isNestedFieldParent,
   usePager,
 } from '@kbn/discover-utils';
+import { fieldNameWildcardMatcher, getFieldSearchMatchingHighlight } from '@kbn/field-utils';
 import type { DocViewRenderProps, FieldRecordLegacy } from '@kbn/unified-doc-viewer/types';
 import { FieldName } from '@kbn/unified-doc-viewer';
 import { useUnifiedDocViewerServices } from '../../hooks';
@@ -246,8 +247,13 @@ export const DocViewerTable = ({
           acc.pinnedItems.push(fieldToItem(curFieldName));
         } else {
           const fieldMapping = mapping(curFieldName);
-          const displayName = fieldMapping?.displayName ?? curFieldName;
-          if (displayName.toLowerCase().includes(searchText.toLowerCase())) {
+          if (
+            !searchText?.trim() ||
+            fieldNameWildcardMatcher(
+              { name: curFieldName, displayName: fieldMapping?.displayName },
+              searchText
+            )
+          ) {
             // filter only unpinned fields
             acc.restItems.push(fieldToItem(curFieldName));
           }
@@ -318,7 +324,6 @@ export const DocViewerTable = ({
 
   const renderRows = useCallback(
     (items: FieldRecord[]) => {
-      const highlight = searchText?.toLowerCase();
       return items.map(
         ({
           action: { flattenedField, onFilter },
@@ -362,7 +367,10 @@ export const DocViewerTable = ({
                   fieldType={fieldType}
                   fieldMapping={fieldMapping}
                   scripted={scripted}
-                  highlight={highlight}
+                  highlight={getFieldSearchMatchingHighlight(
+                    fieldMapping?.displayName ?? field,
+                    searchText
+                  )}
                 />
               </EuiTableRowCell>
               <EuiTableRowCell
@@ -405,6 +413,7 @@ export const DocViewerTable = ({
           onChange={handleOnChange}
           placeholder={searchPlaceholder}
           value={searchText}
+          data-test-subj="unifiedDocViewerFieldsSearchInput"
         />
       </EuiFlexItem>
 
diff --git a/src/plugins/unified_histogram/public/chart/histogram.tsx b/src/plugins/unified_histogram/public/chart/histogram.tsx
index 1d91b2a505174..956f4ef86f2a5 100644
--- a/src/plugins/unified_histogram/public/chart/histogram.tsx
+++ b/src/plugins/unified_histogram/public/chart/histogram.tsx
@@ -107,6 +107,7 @@ export function Histogram({
     timeRange: getTimeRange(),
     timeInterval,
     isPlainRecord,
+    timeField: dataView.timeFieldName,
   });
   const chartRef = useRef<HTMLDivElement | null>(null);
   const { height: containerHeight, width: containerWidth } = useResizeObserver(chartRef.current);
diff --git a/src/plugins/unified_histogram/public/chart/hooks/use_time_range.test.tsx b/src/plugins/unified_histogram/public/chart/hooks/use_time_range.test.tsx
index 176d69d984290..1e86bf5d9614e 100644
--- a/src/plugins/unified_histogram/public/chart/hooks/use_time_range.test.tsx
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_time_range.test.tsx
@@ -245,6 +245,7 @@ describe('useTimeRange', () => {
         timeRange,
         timeInterval,
         isPlainRecord: true,
+        timeField: '@timestamp',
       })
     );
     expect(result.current.timeRangeDisplay).toMatchInlineSnapshot(`
@@ -267,4 +268,17 @@ describe('useTimeRange', () => {
       </EuiText>
     `);
   });
+
+  it('should not render a text for text based languages when not timeField is provided', () => {
+    const { result } = renderHook(() =>
+      useTimeRange({
+        uiSettings,
+        bucketInterval,
+        timeRange,
+        timeInterval,
+        isPlainRecord: true,
+      })
+    );
+    expect(result.current.timeRangeDisplay).toBeNull();
+  });
 });
diff --git a/src/plugins/unified_histogram/public/chart/hooks/use_time_range.tsx b/src/plugins/unified_histogram/public/chart/hooks/use_time_range.tsx
index 089df5124b60a..791d332a3a89f 100644
--- a/src/plugins/unified_histogram/public/chart/hooks/use_time_range.tsx
+++ b/src/plugins/unified_histogram/public/chart/hooks/use_time_range.tsx
@@ -21,12 +21,14 @@ export const useTimeRange = ({
   timeRange: { from, to },
   timeInterval,
   isPlainRecord,
+  timeField,
 }: {
   uiSettings: IUiSettingsClient;
   bucketInterval?: UnifiedHistogramBucketInterval;
   timeRange: TimeRange;
   timeInterval?: string;
   isPlainRecord?: boolean;
+  timeField?: string;
 }) => {
   const dateFormat = useMemo(() => uiSettings.get('dateFormat'), [uiSettings]);
 
@@ -44,6 +46,10 @@ export const useTimeRange = ({
   );
 
   const timeRangeText = useMemo(() => {
+    if (!timeField && isPlainRecord) {
+      return '';
+    }
+
     const timeRange = {
       from: dateMath.parse(from),
       to: dateMath.parse(to, { roundUp: true }),
@@ -70,18 +76,18 @@ export const useTimeRange = ({
         });
 
     return `${toMoment(timeRange.from)} - ${toMoment(timeRange.to)} ${intervalText}`;
-  }, [bucketInterval?.description, from, isPlainRecord, timeInterval, to, toMoment]);
+  }, [bucketInterval?.description, from, isPlainRecord, timeField, timeInterval, to, toMoment]);
 
   const { euiTheme } = useEuiTheme();
   const timeRangeCss = css`
     padding: 0 ${euiTheme.size.s} 0 ${euiTheme.size.s};
   `;
 
-  let timeRangeDisplay = (
+  let timeRangeDisplay = timeRangeText ? (
     <EuiText size="xs" textAlign="center" css={timeRangeCss}>
       {timeRangeText}
     </EuiText>
-  );
+  ) : null;
 
   if (bucketInterval?.scaled) {
     const toolTipTitle = i18n.translate('unifiedHistogram.timeIntervalWithValueWarning', {
diff --git a/test/functional/apps/dashboard_elements/controls/common/index.ts b/test/functional/apps/dashboard_elements/controls/common/index.ts
index 8a9a7b8a54834..74e64052f1663 100644
--- a/test/functional/apps/dashboard_elements/controls/common/index.ts
+++ b/test/functional/apps/dashboard_elements/controls/common/index.ts
@@ -13,7 +13,7 @@ export default function ({ loadTestFile, getService, getPageObjects }: FtrProvid
   const kibanaServer = getService('kibanaServer');
   const security = getService('security');
 
-  const { dashboardControls, dashboard } = getPageObjects(['dashboardControls', 'dashboard']);
+  const { dashboard } = getPageObjects(['dashboard']);
 
   async function setup() {
     await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/dashboard/current/data');
@@ -28,8 +28,6 @@ export default function ({ loadTestFile, getService, getPageObjects }: FtrProvid
 
     // enable the controls lab and navigate to the dashboard listing page to start
     await dashboard.navigateToApp();
-    await dashboardControls.enableControlsLab();
-    await dashboard.navigateToApp();
     await dashboard.preserveCrossAppState();
   }
 
diff --git a/test/functional/apps/dashboard_elements/controls/common/range_slider.ts b/test/functional/apps/dashboard_elements/controls/common/range_slider.ts
index b97acde63f40b..17a1873ed098f 100644
--- a/test/functional/apps/dashboard_elements/controls/common/range_slider.ts
+++ b/test/functional/apps/dashboard_elements/controls/common/range_slider.ts
@@ -50,8 +50,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         to: 'Dec 3, 2018 @ 00:00:00.000',
       });
       await dashboard.navigateToApp();
-      await dashboardControls.enableControlsLab();
-      await dashboard.navigateToApp();
       await dashboard.preserveCrossAppState();
       await dashboard.gotoDashboardLandingPage();
       await dashboard.clickNewDashboard();
diff --git a/test/functional/apps/discover/group1/_shared_links.ts b/test/functional/apps/discover/group1/_shared_links.ts
index e8f79ea1b427a..c6269cabfda98 100644
--- a/test/functional/apps/discover/group1/_shared_links.ts
+++ b/test/functional/apps/discover/group1/_shared_links.ts
@@ -33,11 +33,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       baseUrl = baseUrl.replace(':80', '').replace(':443', '');
       log.debug('New baseUrl = ' + baseUrl);
 
-      // delete .kibana index and update configDoc
-      await kibanaServer.uiSettings.replace({
-        defaultIndex: 'logstash-*',
-      });
-
       log.debug('load kibana index with default index pattern');
       await kibanaServer.savedObjects.clean({ types: ['search', 'index-pattern'] });
       await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover.json');
@@ -45,17 +40,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       await kibanaServer.uiSettings.replace({
         'state:storeInSessionStorage': storeStateInSessionStorage,
+        defaultIndex: 'logstash-*',
       });
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
 
-      log.debug('discover');
       await PageObjects.common.navigateToApp('discover');
-
-      await PageObjects.timePicker.setDefaultAbsoluteRange();
-
-      // After hiding the time picker, we need to wait for
-      // the refresh button to hide before clicking the share button
-      await PageObjects.common.sleep(1000);
-
       await PageObjects.share.clickShareTopNavButton();
 
       return async () => {
@@ -144,8 +133,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/167405
-    describe.skip('shared links with state in sessionStorage', async () => {
+    describe('shared links with state in sessionStorage', async () => {
       let teardown: () => Promise<void>;
       before(async function () {
         teardown = await setup({ storeStateInSessionStorage: true });
@@ -168,31 +156,29 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
         await browser.clearSessionStorage();
         await browser.get(actualUrl, false);
-        await retry.waitFor('shortUrl resolves and opens', async () => {
+        await retry.try(async () => {
           const resolvedUrl = await browser.getCurrentUrl();
           expect(resolvedUrl).to.match(/discover/);
           const resolvedTime = await PageObjects.timePicker.getTimeConfig();
           expect(resolvedTime.start).to.equal(actualTime.start);
           expect(resolvedTime.end).to.equal(actualTime.end);
-          await toasts.dismissAllToasts();
-          return true;
         });
+        await toasts.dismissAllToasts();
       });
 
       it("sharing hashed url shouldn't crash the app", async () => {
         const currentUrl = await browser.getCurrentUrl();
-        await browser.clearSessionStorage();
-        await browser.get(currentUrl, false);
-        await retry.waitFor('discover to open', async () => {
+        await retry.try(async () => {
+          await browser.clearSessionStorage();
+          await browser.get(currentUrl, false);
           const resolvedUrl = await browser.getCurrentUrl();
           expect(resolvedUrl).to.match(/discover/);
-          const { message } = await toasts.getErrorToast();
-          expect(message).to.contain(
+          const { title } = await toasts.getErrorToast(1, true);
+          expect(title).to.contain(
             'Unable to completely restore the URL, be sure to use the share functionality.'
           );
-          await toasts.dismissAllToasts();
-          return true;
         });
+        await toasts.dismissAllToasts();
       });
     });
   });
diff --git a/test/functional/apps/discover/group3/_doc_viewer.ts b/test/functional/apps/discover/group3/_doc_viewer.ts
new file mode 100644
index 0000000000000..8fa3a94b969e3
--- /dev/null
+++ b/test/functional/apps/discover/group3/_doc_viewer.ts
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const kibanaServer = getService('kibanaServer');
+  const PageObjects = getPageObjects(['common', 'discover', 'timePicker', 'header']);
+  const testSubjects = getService('testSubjects');
+  const find = getService('find');
+  const retry = getService('retry');
+  const dataGrid = getService('dataGrid');
+
+  describe('discover doc viewer', function describeIndexTests() {
+    before(async function () {
+      await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
+    });
+
+    beforeEach(async () => {
+      await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover');
+      await kibanaServer.uiSettings.replace({
+        defaultIndex: 'logstash-*',
+        hideAnnouncements: true,
+      });
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
+      await PageObjects.common.navigateToApp('discover');
+      await PageObjects.header.waitUntilLoadingHasFinished();
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+    });
+
+    afterEach(async () => {
+      await kibanaServer.importExport.unload('test/functional/fixtures/kbn_archiver/discover');
+      await kibanaServer.savedObjects.cleanStandardList();
+      await kibanaServer.uiSettings.replace({});
+    });
+
+    describe('search', function () {
+      const itemsPerPage = 25;
+
+      beforeEach(async () => {
+        await dataGrid.clickRowToggle();
+        await PageObjects.discover.isShowingDocViewer();
+        await retry.waitFor('rendered items', async () => {
+          return (await find.allByCssSelector('.kbnDocViewer__fieldName')).length === itemsPerPage;
+        });
+      });
+
+      afterEach(async () => {
+        const fieldSearch = await testSubjects.find('clearSearchButton');
+        await fieldSearch.click();
+      });
+
+      it('should be able to search by string', async function () {
+        await PageObjects.discover.findFieldByNameInDocViewer('geo');
+
+        await retry.waitFor('first updates', async () => {
+          return (await find.allByCssSelector('.kbnDocViewer__fieldName')).length === 4;
+        });
+
+        await PageObjects.discover.findFieldByNameInDocViewer('.s');
+
+        await retry.waitFor('second updates', async () => {
+          return (await find.allByCssSelector('.kbnDocViewer__fieldName')).length === 2;
+        });
+      });
+
+      it('should be able to search by wildcard', async function () {
+        await PageObjects.discover.findFieldByNameInDocViewer('relatedContent*image');
+
+        await retry.waitFor('updates', async () => {
+          return (await find.allByCssSelector('.kbnDocViewer__fieldName')).length === 2;
+        });
+      });
+
+      it('should be able to search with spaces as wildcard', async function () {
+        await PageObjects.discover.findFieldByNameInDocViewer('relatedContent image');
+
+        await retry.waitFor('updates', async () => {
+          return (await find.allByCssSelector('.kbnDocViewer__fieldName')).length === 4;
+        });
+      });
+
+      it('should ignore empty search', async function () {
+        await PageObjects.discover.findFieldByNameInDocViewer('   '); // only spaces
+
+        await retry.waitFor('the clear button', async () => {
+          return await testSubjects.exists('clearSearchButton');
+        });
+
+        // expect no changes in the list
+        await retry.waitFor('all items', async () => {
+          return (await find.allByCssSelector('.kbnDocViewer__fieldName')).length === itemsPerPage;
+        });
+      });
+    });
+  });
+}
diff --git a/test/functional/apps/discover/group3/index.ts b/test/functional/apps/discover/group3/index.ts
index 3a10a8ec6f768..9af02c006b14b 100644
--- a/test/functional/apps/discover/group3/index.ts
+++ b/test/functional/apps/discover/group3/index.ts
@@ -23,5 +23,6 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./_drag_drop'));
     loadTestFile(require.resolve('./_sidebar'));
     loadTestFile(require.resolve('./_request_counts'));
+    loadTestFile(require.resolve('./_doc_viewer'));
   });
 }
diff --git a/test/functional/config.base.js b/test/functional/config.base.js
index c4f1e3695f474..2f0ec71ffbdaa 100644
--- a/test/functional/config.base.js
+++ b/test/functional/config.base.js
@@ -34,6 +34,9 @@ export default async function ({ readConfigFile }) {
 
         // to be re-enabled once kibana/issues/102552 is completed
         '--xpack.reporting.enabled=false',
+
+        // disable fleet task that writes to metrics.fleet_server.* data streams, impacting functional tests
+        `--xpack.task_manager.unsafe.exclude_task_types=${JSON.stringify(['Fleet-Metrics-Task'])}`,
       ],
     },
 
diff --git a/test/functional/page_objects/dashboard_page_controls.ts b/test/functional/page_objects/dashboard_page_controls.ts
index 720ff928b5605..f3d828a04d9cc 100644
--- a/test/functional/page_objects/dashboard_page_controls.ts
+++ b/test/functional/page_objects/dashboard_page_controls.ts
@@ -54,26 +54,11 @@ export class DashboardPageControls extends FtrService {
   private readonly testSubjects = this.ctx.getService('testSubjects');
 
   private readonly common = this.ctx.getPageObject('common');
-  private readonly header = this.ctx.getPageObject('header');
-  private readonly settings = this.ctx.getPageObject('settings');
 
   /* -----------------------------------------------------------
      General controls functions
      ----------------------------------------------------------- */
 
-  public async enableControlsLab() {
-    await this.header.clickStackManagement();
-    await this.settings.clickKibanaSettings();
-
-    const currentValue = await this.settings.getAdvancedSettingAriaCheckbox(
-      'labs:dashboard:dashboardControls'
-    );
-
-    if (currentValue !== 'true') {
-      await this.settings.toggleAdvancedSettingCheckbox('labs:dashboard:dashboardControls');
-    }
-  }
-
   public async expectControlsEmpty() {
     await this.testSubjects.existOrFail('controls-empty');
   }
diff --git a/test/functional/page_objects/discover_page.ts b/test/functional/page_objects/discover_page.ts
index d36cd4b56b129..605ea816ac1e6 100644
--- a/test/functional/page_objects/discover_page.ts
+++ b/test/functional/page_objects/discover_page.ts
@@ -363,6 +363,11 @@ export class DiscoverPageObject extends FtrService {
     return await this.find.byClassName('monaco-editor');
   }
 
+  public async findFieldByNameInDocViewer(name: string) {
+    const fieldSearch = await this.testSubjects.find('unifiedDocViewerFieldsSearchInput');
+    await fieldSearch.type(name);
+  }
+
   public async getMarks() {
     const table = await this.docTable.getTable();
     const marks = await table.findAllByTagName('mark');
diff --git a/test/functional/services/toasts.ts b/test/functional/services/toasts.ts
index ea105eb82fa93..a4d3b2dd3e457 100644
--- a/test/functional/services/toasts.ts
+++ b/test/functional/services/toasts.ts
@@ -19,12 +19,16 @@ export class ToastsService extends FtrService {
    * an additional button, that should not be part of the message.
    *
    * @param index The index of the toast (1-based, NOT 0-based!) of the toast. Use first by default.
+   * @param titleOnly If this is true, only the title of the error message is returned. There are error messages that only contain a title, no message.
    * @returns The title and message of the specified error toast.https://github.com/elastic/kibana/issues/17087
    */
-  public async getErrorToast(index: number = 1) {
+  public async getErrorToast(index: number = 1, titleOnly: boolean = false) {
     const toast = await this.getToastElement(index);
     const titleElement = await this.testSubjects.findDescendant('euiToastHeader', toast);
     const title: string = await titleElement.getVisibleText();
+    if (titleOnly) {
+      return { title };
+    }
     const messageElement = await this.testSubjects.findDescendant('errorToastMessage', toast);
     const message: string = await messageElement.getVisibleText();
     return { title, message };
diff --git a/test/plugin_functional/test_suites/core_plugins/rendering.ts b/test/plugin_functional/test_suites/core_plugins/rendering.ts
index 83ecf99f40196..88d354ff25a47 100644
--- a/test/plugin_functional/test_suites/core_plugins/rendering.ts
+++ b/test/plugin_functional/test_suites/core_plugins/rendering.ts
@@ -266,6 +266,7 @@ export default function ({ getService }: PluginFunctionalProviderContext) {
         'xpack.index_management.enableIndexActions (any)',
         'xpack.index_management.enableLegacyTemplates (any)',
         'xpack.index_management.enableIndexStats (any)',
+        'xpack.index_management.editableIndexSettings (any)',
         'xpack.infra.sources.default.fields.message (array)',
         /**
          * Feature flags bellow are conditional based on traditional/serverless offering
diff --git a/tsconfig.base.json b/tsconfig.base.json
index fd0601d9416fe..2da5e2023b35c 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -1076,6 +1076,8 @@
       "@kbn/observability-ai-assistant-plugin/*": ["x-pack/plugins/observability_ai_assistant/*"],
       "@kbn/observability-alert-details": ["x-pack/packages/observability/alert_details"],
       "@kbn/observability-alert-details/*": ["x-pack/packages/observability/alert_details/*"],
+      "@kbn/observability-alerting-test-data": ["x-pack/packages/observability/alerting_test_data"],
+      "@kbn/observability-alerting-test-data/*": ["x-pack/packages/observability/alerting_test_data/*"],
       "@kbn/observability-fixtures-plugin": ["x-pack/test/cases_api_integration/common/plugins/observability"],
       "@kbn/observability-fixtures-plugin/*": ["x-pack/test/cases_api_integration/common/plugins/observability/*"],
       "@kbn/observability-log-explorer-plugin": ["x-pack/plugins/observability_log_explorer"],
diff --git a/versions.json b/versions.json
index 624287e414444..b6ac52d0272ce 100644
--- a/versions.json
+++ b/versions.json
@@ -14,7 +14,7 @@
       "previousMinor": true
     },
     {
-      "version": "8.10.4",
+      "version": "8.10.5",
       "branch": "8.10",
       "currentMajor": true,
       "previousMinor": true
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_selector_inline/action_type_selector_modal.tsx b/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_selector_inline/action_type_selector_modal.tsx
index 84a72e0cd2b5f..02db4bf391c14 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_selector_inline/action_type_selector_modal.tsx
+++ b/x-pack/packages/kbn-elastic-assistant/impl/connectorland/connector_selector_inline/action_type_selector_modal.tsx
@@ -18,6 +18,7 @@ import {
 } from '@elastic/eui';
 import { ActionType } from '@kbn/actions-plugin/common';
 import { ActionTypeRegistryContract } from '@kbn/triggers-actions-ui-plugin/public';
+import { css } from '@emotion/css';
 import * as i18n from '../translations';
 
 interface Props {
@@ -26,6 +27,12 @@ interface Props {
   onClose: () => void;
   onSelect: (actionType: ActionType) => void;
 }
+const itemClassName = css`
+  .euiKeyPadMenuItem__label {
+    white-space: nowrap;
+    overflow: hidden;
+  }
+`;
 
 export const ActionTypeSelectorModal = ({
   actionTypes,
@@ -46,6 +53,7 @@ export const ActionTypeSelectorModal = ({
             return (
               <EuiFlexItem data-test-subj="action-option" key={actionType.id} grow={false}>
                 <EuiKeyPadMenuItem
+                  className={itemClassName}
                   key={actionType.id}
                   isDisabled={!actionType.enabled}
                   label={actionType.name}
diff --git a/x-pack/packages/kbn-elastic-assistant/impl/content/prompts/welcome/translations.ts b/x-pack/packages/kbn-elastic-assistant/impl/content/prompts/welcome/translations.ts
index 936d27fb1005a..387c1d01422f6 100644
--- a/x-pack/packages/kbn-elastic-assistant/impl/content/prompts/welcome/translations.ts
+++ b/x-pack/packages/kbn-elastic-assistant/impl/content/prompts/welcome/translations.ts
@@ -19,7 +19,7 @@ export const WELCOME_GENERAL_2 = i18n.translate(
   'xpack.elasticAssistant.securityAssistant.content.prompts.welcome.welcomeGeneral2Prompt',
   {
     defaultMessage:
-      "First things first, we'll need to set up a Generative AI Connector to get this chat experience going! With the Generative AI Connector, you'll be able to configure access to either an OpenAI service or an AWS Bedrock service, but you better believe you'll be able to deploy your own models within your Elastic Cloud instance and use those here in the future... 😉",
+      "First things first, we'll need to set up a Generative AI Connector to get this chat experience going! With the Generative AI Connector, you'll be able to configure access to either an OpenAI service or an Amazon Bedrock service, but you better believe you'll be able to deploy your own models within your Elastic Cloud instance and use those here in the future... 😉",
   }
 );
 
diff --git a/x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts b/x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts
index 706213003250b..155fea1aeb6d0 100644
--- a/x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts
+++ b/x-pack/packages/kbn-slo-schema/src/rest_specs/slo.ts
@@ -19,6 +19,7 @@ import {
   indicatorTypesSchema,
   kqlCustomIndicatorSchema,
   metricCustomIndicatorSchema,
+  timesliceMetricIndicatorSchema,
   objectiveSchema,
   optionalSettingsSchema,
   previewDataSchema,
@@ -28,6 +29,9 @@ import {
   tagsSchema,
   timeWindowSchema,
   timeWindowTypeSchema,
+  timesliceMetricBasicMetricWithField,
+  timesliceMetricDocCountMetric,
+  timesliceMetricPercentileMetric,
 } from '../schema';
 
 const createSLOParamsSchema = t.type({
@@ -270,6 +274,10 @@ type Indicator = t.OutputOf<typeof indicatorSchema>;
 type APMTransactionErrorRateIndicator = t.OutputOf<typeof apmTransactionErrorRateIndicatorSchema>;
 type APMTransactionDurationIndicator = t.OutputOf<typeof apmTransactionDurationIndicatorSchema>;
 type MetricCustomIndicator = t.OutputOf<typeof metricCustomIndicatorSchema>;
+type TimesliceMetricIndicator = t.OutputOf<typeof timesliceMetricIndicatorSchema>;
+type TimesliceMetricBasicMetricWithField = t.OutputOf<typeof timesliceMetricBasicMetricWithField>;
+type TimesliceMetricDocCountMetric = t.OutputOf<typeof timesliceMetricDocCountMetric>;
+type TimesclieMetricPercentileMetric = t.OutputOf<typeof timesliceMetricPercentileMetric>;
 type HistogramIndicator = t.OutputOf<typeof histogramIndicatorSchema>;
 type KQLCustomIndicator = t.OutputOf<typeof kqlCustomIndicatorSchema>;
 
@@ -327,6 +335,10 @@ export type {
   IndicatorType,
   Indicator,
   MetricCustomIndicator,
+  TimesliceMetricIndicator,
+  TimesliceMetricBasicMetricWithField,
+  TimesclieMetricPercentileMetric,
+  TimesliceMetricDocCountMetric,
   HistogramIndicator,
   KQLCustomIndicator,
   TimeWindow,
diff --git a/x-pack/packages/kbn-slo-schema/src/schema/indicators.ts b/x-pack/packages/kbn-slo-schema/src/schema/indicators.ts
index 07b9c69f4fb97..f8d795275acc6 100644
--- a/x-pack/packages/kbn-slo-schema/src/schema/indicators.ts
+++ b/x-pack/packages/kbn-slo-schema/src/schema/indicators.ts
@@ -59,6 +59,83 @@ const kqlCustomIndicatorSchema = t.type({
   ]),
 });
 
+const timesliceMetricComparatorMapping = {
+  GT: '>',
+  GTE: '>=',
+  LT: '<',
+  LTE: '<=',
+};
+
+const timesliceMetricComparator = t.keyof(timesliceMetricComparatorMapping);
+
+const timesliceMetricBasicMetricWithField = t.intersection([
+  t.type({
+    name: t.string,
+    aggregation: t.keyof({
+      avg: true,
+      max: true,
+      min: true,
+      sum: true,
+      cardinality: true,
+      last_value: true,
+      std_deviation: true,
+    }),
+    field: t.string,
+  }),
+  t.partial({
+    filter: t.string,
+  }),
+]);
+
+const timesliceMetricDocCountMetric = t.intersection([
+  t.type({
+    name: t.string,
+    aggregation: t.literal('doc_count'),
+  }),
+  t.partial({
+    filter: t.string,
+  }),
+]);
+
+const timesliceMetricPercentileMetric = t.intersection([
+  t.type({
+    name: t.string,
+    aggregation: t.literal('percentile'),
+    field: t.string,
+    percentile: t.number,
+  }),
+  t.partial({
+    filter: t.string,
+  }),
+]);
+
+const timesliceMetricMetricDef = t.union([
+  timesliceMetricBasicMetricWithField,
+  timesliceMetricDocCountMetric,
+  timesliceMetricPercentileMetric,
+]);
+
+const timesliceMetricDef = t.type({
+  metrics: t.array(timesliceMetricMetricDef),
+  equation: t.string,
+  threshold: t.number,
+  comparator: timesliceMetricComparator,
+});
+const timesliceMetricIndicatorTypeSchema = t.literal('sli.metric.timeslice');
+const timesliceMetricIndicatorSchema = t.type({
+  type: timesliceMetricIndicatorTypeSchema,
+  params: t.intersection([
+    t.type({
+      index: t.string,
+      metric: timesliceMetricDef,
+      timestampField: t.string,
+    }),
+    t.partial({
+      filter: t.string,
+    }),
+  ]),
+});
+
 const metricCustomValidAggregations = t.keyof({
   sum: true,
 });
@@ -149,6 +226,7 @@ const indicatorTypesSchema = t.union([
   apmTransactionErrorRateIndicatorTypeSchema,
   kqlCustomIndicatorTypeSchema,
   metricCustomIndicatorTypeSchema,
+  timesliceMetricIndicatorTypeSchema,
   histogramIndicatorTypeSchema,
 ]);
 
@@ -176,6 +254,7 @@ const indicatorSchema = t.union([
   apmTransactionErrorRateIndicatorSchema,
   kqlCustomIndicatorSchema,
   metricCustomIndicatorSchema,
+  timesliceMetricIndicatorSchema,
   histogramIndicatorSchema,
 ]);
 
@@ -186,8 +265,15 @@ export {
   apmTransactionErrorRateIndicatorTypeSchema,
   kqlCustomIndicatorSchema,
   kqlCustomIndicatorTypeSchema,
-  metricCustomIndicatorTypeSchema,
   metricCustomIndicatorSchema,
+  metricCustomIndicatorTypeSchema,
+  timesliceMetricComparatorMapping,
+  timesliceMetricIndicatorSchema,
+  timesliceMetricIndicatorTypeSchema,
+  timesliceMetricMetricDef,
+  timesliceMetricBasicMetricWithField,
+  timesliceMetricDocCountMetric,
+  timesliceMetricPercentileMetric,
   histogramIndicatorTypeSchema,
   histogramIndicatorSchema,
   indicatorSchema,
diff --git a/x-pack/packages/observability/alerting_test_data/README.md b/x-pack/packages/observability/alerting_test_data/README.md
new file mode 100644
index 0000000000000..099040887958e
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/README.md
@@ -0,0 +1,3 @@
+# @kbn/observability-alerting-test-data
+
+Provides utilities to generate alerting test data
diff --git a/x-pack/packages/observability/alerting_test_data/index.ts b/x-pack/packages/observability/alerting_test_data/index.ts
new file mode 100644
index 0000000000000..a7f0bd1e9e057
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { createApmErrorCountRule } from './src/create_apm_error_count_threshold_rule';
+export { createApmFailedTransactionRateRule } from './src/create_apm_failed_transaction_rate_rule';
+export { createCustomThresholdRule } from './src/create_custom_threshold_rule';
+export { createDataView } from './src/create_data_view';
+export { createIndexConnector } from './src/create_index_connector';
+export { createRule } from './src/create_rule';
+export { run } from './src/run';
+
+export * from './src/scenarios';
diff --git a/x-pack/plugins/index_management/public/application/constants/detail_panel_tabs.ts b/x-pack/packages/observability/alerting_test_data/jest.config.js
similarity index 53%
rename from x-pack/plugins/index_management/public/application/constants/detail_panel_tabs.ts
rename to x-pack/packages/observability/alerting_test_data/jest.config.js
index 29000412d30e8..05b0dbe613054 100644
--- a/x-pack/plugins/index_management/public/application/constants/detail_panel_tabs.ts
+++ b/x-pack/packages/observability/alerting_test_data/jest.config.js
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-export const TAB_SUMMARY = 'TAB_SUMMARY';
-export const TAB_SETTINGS = 'TAB_SETTINGS';
-export const TAB_MAPPING = 'TAB_MAPPING';
-export const TAB_STATS = 'TAB_STATS';
-export const TAB_EDIT_SETTINGS = 'TAB_EDIT_SETTINGS';
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../../..',
+  roots: ['<rootDir>/x-pack/packages/observability/alerting_test_data'],
+};
diff --git a/x-pack/packages/observability/alerting_test_data/kibana.jsonc b/x-pack/packages/observability/alerting_test_data/kibana.jsonc
new file mode 100644
index 0000000000000..66b007cdd30b6
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/observability-alerting-test-data",
+  "owner": "@elastic/actionable-observability"
+}
diff --git a/x-pack/packages/observability/alerting_test_data/package.json b/x-pack/packages/observability/alerting_test_data/package.json
new file mode 100644
index 0000000000000..f0023bc731ef9
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "@kbn/observability-alerting-test-data",
+  "descriptio": "Utils to generate observability alerting test data",
+  "author": "Actionable Observability",
+  "private": true,
+  "version": "1.0.0",
+  "license": "Elastic License 2.0"
+}
\ No newline at end of file
diff --git a/x-pack/packages/observability/alerting_test_data/src/constants.ts b/x-pack/packages/observability/alerting_test_data/src/constants.ts
new file mode 100644
index 0000000000000..591f7f54191fc
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/constants.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const DATA_VIEW_ID = 'data-view-id';
+export const FIRED_ACTIONS_ID = 'custom_threshold.fired';
+export const ALERT_ACTION_INDEX = 'test-alert-action-index';
+
+export const KIBANA_DEFAULT_URL = 'http://127.0.0.1:5601';
+export const USERNAME = 'elastic';
+export const PASSWORD = 'changeme';
+
+export const HEADERS = {
+  'kbn-xsrf': 'true',
+  'x-elastic-internal-origin': 'foo',
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/create_apm_error_count_threshold_rule.ts b/x-pack/packages/observability/alerting_test_data/src/create_apm_error_count_threshold_rule.ts
new file mode 100644
index 0000000000000..f98d8b1e23a99
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/create_apm_error_count_threshold_rule.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createRule } from './create_rule';
+
+export const createApmErrorCountRule = async (actionId: string) => {
+  const apmErrorRateRuleParams = {
+    tags: ['apm'],
+    consumer: 'apm',
+    name: 'apm_error_count_threshold',
+    rule_type_id: 'apm.error_rate',
+    params: {
+      threshold: 5,
+      windowSize: 5,
+      windowUnit: 'm',
+      transactionType: undefined,
+      serviceName: undefined,
+      environment: 'ENVIRONMENT_ALL',
+      searchConfiguration: {
+        query: {
+          query: 'service.environment: "rule-test"',
+          language: 'kuery',
+        },
+      },
+      groupBy: ['service.name', 'service.environment'],
+      useKqlFilter: true,
+    },
+    actions: [
+      {
+        group: 'threshold_met',
+        id: actionId,
+        params: {
+          documents: [
+            {
+              ruleName: '{{rule.name}}',
+              alertDetailsUrl: '{{context.alertDetailsUrl}}',
+              environment: '{{context.environment}}',
+              interval: '{{context.interval}}',
+              reason: '{{context.reason}}',
+              serviceName: '{{context.serviceName}}',
+              threshold: '{{context.threshold}}',
+              transactionName: '{{context.transactionName}}',
+              transactionType: '{{context.transactionType}}',
+              triggerValue: '{{context.triggerValue}}',
+              viewInAppUrl: '{{context.viewInAppUrl}}',
+            },
+          ],
+        },
+        frequency: {
+          notify_when: 'onActionGroupChange',
+          throttle: null,
+          summary: false,
+        },
+      },
+    ],
+    schedule: {
+      interval: '1m',
+    },
+  };
+
+  return createRule(apmErrorRateRuleParams);
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/create_apm_failed_transaction_rate_rule.ts b/x-pack/packages/observability/alerting_test_data/src/create_apm_failed_transaction_rate_rule.ts
new file mode 100644
index 0000000000000..204975a02cca6
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/create_apm_failed_transaction_rate_rule.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createRule } from './create_rule';
+
+export const createApmFailedTransactionRateRule = async (actionId: string) => {
+  const apmErrorRateRuleParams = {
+    tags: ['apm'],
+    consumer: 'apm',
+    name: 'apm_failed_transaction_rate_threshold',
+    rule_type_id: 'apm.transaction_error_rate',
+    params: {
+      threshold: 30,
+      windowSize: 5,
+      windowUnit: 'm',
+      transactionType: undefined,
+      serviceName: undefined,
+      environment: 'ENVIRONMENT_ALL',
+      searchConfiguration: {
+        query: {
+          query: 'service.environment: "rule-test"',
+          language: 'kuery',
+        },
+      },
+      groupBy: ['service.name', 'service.environment', 'transaction.type'],
+      useKqlFilter: true,
+    },
+    actions: [
+      {
+        group: 'threshold_met',
+        id: actionId,
+        params: {
+          documents: [
+            {
+              ruleName: '{{rule.name}}',
+              alertDetailsUrl: '{{context.alertDetailsUrl}}',
+              environment: '{{context.environment}}',
+              interval: '{{context.interval}}',
+              reason: '{{context.reason}}',
+              serviceName: '{{context.serviceName}}',
+              threshold: '{{context.threshold}}',
+              transactionName: '{{context.transactionName}}',
+              transactionType: '{{context.transactionType}}',
+              triggerValue: '{{context.triggerValue}}',
+              viewInAppUrl: '{{context.viewInAppUrl}}',
+            },
+          ],
+        },
+        frequency: {
+          notify_when: 'onActionGroupChange',
+          throttle: null,
+          summary: false,
+        },
+      },
+    ],
+    schedule: {
+      interval: '1m',
+    },
+  };
+
+  return createRule(apmErrorRateRuleParams);
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/create_custom_threshold_rule.ts b/x-pack/packages/observability/alerting_test_data/src/create_custom_threshold_rule.ts
new file mode 100644
index 0000000000000..296d1b95512d3
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/create_custom_threshold_rule.ts
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  Aggregators,
+  Comparator,
+} from '@kbn/observability-plugin/common/custom_threshold_rule/types';
+import { OBSERVABILITY_THRESHOLD_RULE_TYPE_ID } from '@kbn/rule-data-utils';
+import { FIRED_ACTIONS_ID } from './constants';
+import { createRule } from './create_rule';
+
+export const createCustomThresholdRule = async (
+  actionId: string,
+  dataViewId: string,
+  ruleParams: {
+    consumer?: string;
+    name?: string;
+    params?: {
+      criteria: any[];
+      groupBy?: string[];
+      searchConfiguration: {
+        query: {
+          query?: string;
+        };
+      };
+    };
+  }
+) => {
+  const customThresholdRuleParams = {
+    tags: ['observability'],
+    consumer: ruleParams.consumer || 'logs',
+    name: ruleParams.name || 'Default custom threshold rule name',
+    rule_type_id: OBSERVABILITY_THRESHOLD_RULE_TYPE_ID,
+    params: {
+      criteria: ruleParams.params?.criteria || [
+        {
+          aggType: Aggregators.CUSTOM,
+          comparator: Comparator.GT,
+          threshold: [1],
+          timeSize: 1,
+          timeUnit: 'm',
+          metrics: [{ name: 'A', filter: '', aggType: Aggregators.COUNT }],
+        },
+      ],
+      groupBy: ruleParams.params?.groupBy,
+      alertOnNoData: true,
+      alertOnGroupDisappear: true,
+      searchConfiguration: {
+        query: {
+          query: ruleParams.params?.searchConfiguration.query.query || '',
+          language: 'kuery',
+        },
+        index: dataViewId,
+      },
+    },
+    actions: [
+      {
+        group: FIRED_ACTIONS_ID,
+        id: actionId,
+        params: {
+          documents: [
+            {
+              ruleName: '{{rule.name}}',
+              ruleType: '{{rule.type}}',
+              alertDetailsUrl: '{{context.alertDetailsUrl}}',
+              reason: '{{context.reason}}',
+              value: '{{context.value}}',
+              host: '{{context.host}}',
+            },
+          ],
+        },
+        frequency: {
+          notify_when: 'onActionGroupChange',
+          throttle: null,
+          summary: false,
+        },
+      },
+    ],
+    schedule: {
+      interval: '1m',
+    },
+  };
+
+  return createRule(customThresholdRuleParams);
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/create_data_view.ts b/x-pack/packages/observability/alerting_test_data/src/create_data_view.ts
new file mode 100644
index 0000000000000..13e966c8c1759
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/create_data_view.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import axios from 'axios';
+import { HEADERS, PASSWORD, USERNAME } from './constants';
+import { getKibanaUrl } from './get_kibana_url';
+
+export const createDataView = async ({
+  indexPattern,
+  id,
+}: {
+  indexPattern: string;
+  id: string;
+}) => {
+  const DATA_VIEW_CREATION_API = `${await getKibanaUrl()}/api/content_management/rpc/create`;
+  const dataViewParams = {
+    contentTypeId: 'index-pattern',
+    data: {
+      fieldAttrs: '{}',
+      title: indexPattern,
+      timeFieldName: '@timestamp',
+      sourceFilters: '[]',
+      fields: '[]',
+      fieldFormatMap: '{}',
+      typeMeta: '{}',
+      runtimeFieldMap: '{}',
+      name: indexPattern,
+    },
+    options: { id },
+    version: 1,
+  };
+
+  return axios.post(DATA_VIEW_CREATION_API, dataViewParams, {
+    headers: HEADERS,
+    auth: {
+      username: USERNAME,
+      password: PASSWORD,
+    },
+  });
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/create_index_connector.ts b/x-pack/packages/observability/alerting_test_data/src/create_index_connector.ts
new file mode 100644
index 0000000000000..19fe799bae2f6
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/create_index_connector.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import axios from 'axios';
+import { ALERT_ACTION_INDEX, HEADERS, PASSWORD, USERNAME } from './constants';
+import { getKibanaUrl } from './get_kibana_url';
+
+export const createIndexConnector = async () => {
+  const INDEX_CONNECTOR_API = `${await getKibanaUrl()}/api/actions/connector`;
+  const indexConnectorParams = {
+    name: 'Test Index Connector',
+    config: {
+      index: ALERT_ACTION_INDEX,
+      refresh: true,
+    },
+    connector_type_id: '.index',
+  };
+
+  return axios.post(INDEX_CONNECTOR_API, indexConnectorParams, {
+    headers: HEADERS,
+    auth: {
+      username: USERNAME,
+      password: PASSWORD,
+    },
+  });
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/create_rule.ts b/x-pack/packages/observability/alerting_test_data/src/create_rule.ts
new file mode 100644
index 0000000000000..3b5fcb92562dc
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/create_rule.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import axios from 'axios';
+import { HEADERS, PASSWORD, USERNAME } from './constants';
+import { getKibanaUrl } from './get_kibana_url';
+
+export const createRule = async (ruleParams: any) => {
+  const RULE_CREATION_API = `${await getKibanaUrl()}/api/alerting/rule`;
+  return axios.post(RULE_CREATION_API, ruleParams, {
+    headers: HEADERS,
+    auth: {
+      username: USERNAME,
+      password: PASSWORD,
+    },
+  });
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/get_kibana_url.ts b/x-pack/packages/observability/alerting_test_data/src/get_kibana_url.ts
new file mode 100644
index 0000000000000..5e6062310f49e
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/get_kibana_url.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import fetch from 'node-fetch';
+import { format, parse } from 'url';
+import { KIBANA_DEFAULT_URL } from './constants';
+
+let kibanaUrl: string;
+
+export async function getKibanaUrl() {
+  if (kibanaUrl) {
+    return kibanaUrl;
+  }
+
+  try {
+    const unredirectedResponse = await fetch(KIBANA_DEFAULT_URL, {
+      method: 'HEAD',
+      follow: 1,
+      redirect: 'manual',
+    });
+
+    const discoveredKibanaUrl =
+      unredirectedResponse.headers
+        .get('location')
+        ?.replace('/spaces/enter', '')
+        ?.replace('spaces/space_selector', '') || KIBANA_DEFAULT_URL;
+
+    const parsedTarget = parse(KIBANA_DEFAULT_URL);
+
+    const parsedDiscoveredUrl = parse(discoveredKibanaUrl);
+
+    const discoveredKibanaUrlWithAuth = format({
+      ...parsedDiscoveredUrl,
+      auth: parsedTarget.auth,
+    });
+
+    const redirectedResponse = await fetch(discoveredKibanaUrlWithAuth, {
+      method: 'HEAD',
+    });
+
+    if (redirectedResponse.status !== 200) {
+      throw new Error(
+        `Expected HTTP 200 from ${discoveredKibanaUrlWithAuth}, got ${redirectedResponse.status}`
+      );
+    }
+
+    // eslint-disable-next-line no-console
+    console.log(`Discovered kibana running at: ${discoveredKibanaUrlWithAuth}`);
+
+    kibanaUrl = discoveredKibanaUrlWithAuth.replace(/\/$/, '');
+    return kibanaUrl;
+  } catch (error) {
+    throw new Error(`Could not connect to Kibana: ` + error.message);
+  }
+}
diff --git a/x-pack/packages/observability/alerting_test_data/src/run.ts b/x-pack/packages/observability/alerting_test_data/src/run.ts
new file mode 100644
index 0000000000000..63c0c613e3e90
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/run.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createApmErrorCountRule } from './create_apm_error_count_threshold_rule';
+import { createApmFailedTransactionRateRule } from './create_apm_failed_transaction_rate_rule';
+import { createCustomThresholdRule } from './create_custom_threshold_rule';
+import { createDataView } from './create_data_view';
+import { createIndexConnector } from './create_index_connector';
+
+import { scenario1, scenario2, scenario3, scenario4, scenario5, scenario6 } from './scenarios';
+
+const scenarios = [
+  // Logs use-cases
+  scenario1,
+  scenario2,
+  scenario3,
+  // Metrics use-cases
+  scenario4,
+  scenario5,
+  scenario6,
+];
+
+/* eslint-disable no-console */
+export async function run() {
+  console.log('Creating index connector - start');
+  const response = await createIndexConnector();
+  const actionId = await response.data.id;
+  console.log('Creating index connector - finished - actionId: ', actionId);
+  for (const scenario of scenarios) {
+    if (scenario.dataView.shouldCreate) {
+      console.log('Creating data view - start - id: ', scenario.dataView.id);
+      await createDataView(scenario.dataView);
+      console.log('Creating data view - finished - id: ', scenario.dataView.id);
+    }
+    console.log('Creating Custom threshold rule - start - name: ', scenario.ruleParams.name);
+    await createCustomThresholdRule(actionId, scenario.dataView.id, scenario.ruleParams);
+    console.log('Creating Custom threshold rule - finished - name: ', scenario.ruleParams.name);
+  }
+
+  console.log('Creating APM error count rule - start');
+  await createApmErrorCountRule(actionId);
+  console.log('Creating APM error count rule - finished');
+
+  console.log('Creating APM failed transaction rate rule - start');
+  await createApmFailedTransactionRateRule(actionId);
+  console.log('Creating APM failed transaction rate rule - finished');
+}
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count.ts
new file mode 100644
index 0000000000000..39b7159ff478b
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  Aggregators,
+  Comparator,
+} from '@kbn/observability-plugin/common/custom_threshold_rule/types';
+
+export const scenario1 = {
+  dataView: {
+    indexPattern: 'high-cardinality-data-fake_hosts.fake_hosts-*',
+    id: 'data-view-id',
+    shouldCreate: true,
+  },
+  ruleParams: {
+    consumer: 'logs',
+    name: 'custom_threshold_log_count',
+    params: {
+      criteria: [
+        {
+          aggType: Aggregators.CUSTOM,
+          comparator: Comparator.LT,
+          threshold: [100],
+          timeSize: 1,
+          timeUnit: 'm',
+          metrics: [{ name: 'A', filter: '', aggType: Aggregators.COUNT }],
+        },
+      ],
+      searchConfiguration: {
+        query: {
+          query: 'labels.scenario: custom_threshold_log_count',
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_groupby.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_groupby.ts
new file mode 100644
index 0000000000000..882d83bbbf973
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_groupby.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  Aggregators,
+  Comparator,
+} from '@kbn/observability-plugin/common/custom_threshold_rule/types';
+
+export const scenario2 = {
+  dataView: {
+    indexPattern: 'high-cardinality-data-fake_hosts.fake_hosts-*',
+    id: 'data-view-id',
+    shouldCreate: false,
+  },
+  ruleParams: {
+    consumer: 'logs',
+    name: 'custom_threshold_log_count_groupby',
+    params: {
+      criteria: [
+        {
+          aggType: Aggregators.CUSTOM,
+          comparator: Comparator.LT,
+          threshold: [40],
+          timeSize: 1,
+          timeUnit: 'm',
+          metrics: [{ name: 'A', filter: '', aggType: Aggregators.COUNT }],
+        },
+      ],
+      groupBy: ['event.dataset'],
+      searchConfiguration: {
+        query: {
+          query: 'labels.scenario: custom_threshold_log_count_groupby',
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_nodata.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_nodata.ts
new file mode 100644
index 0000000000000..7be8b142380d1
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_log_count_nodata.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  Aggregators,
+  Comparator,
+} from '@kbn/observability-plugin/common/custom_threshold_rule/types';
+
+export const scenario3 = {
+  dataView: {
+    indexPattern: 'high-cardinality-data-fake_hosts.fake_hosts-*',
+    id: 'data-view-id',
+    shouldCreate: false,
+  },
+  ruleParams: {
+    consumer: 'logs',
+    name: 'custom_threshold_log_count_nodata',
+    params: {
+      criteria: [
+        {
+          aggType: Aggregators.CUSTOM,
+          comparator: Comparator.LT,
+          threshold: [5],
+          timeSize: 1,
+          timeUnit: 'm',
+          metrics: [{ name: 'A', filter: '', aggType: Aggregators.COUNT }],
+        },
+      ],
+      searchConfiguration: {
+        query: {
+          query: 'labels.scenario: custom_threshold_log_count_nodata',
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg.ts
new file mode 100644
index 0000000000000..755f89680b171
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  Aggregators,
+  Comparator,
+} from '@kbn/observability-plugin/common/custom_threshold_rule/types';
+
+export const scenario4 = {
+  dataView: {
+    indexPattern: 'high-cardinality-data-fake_hosts.fake_hosts-*',
+    id: 'data-view-id',
+    shouldCreate: false,
+  },
+  ruleParams: {
+    consumer: 'logs',
+    name: 'custom_threshold_metric_avg',
+    params: {
+      criteria: [
+        {
+          aggType: Aggregators.CUSTOM,
+          comparator: Comparator.GT,
+          threshold: [80],
+          timeSize: 1,
+          timeUnit: 'm',
+          metrics: [{ name: 'A', field: 'system.cpu.user.pct', aggType: Aggregators.AVERAGE }],
+        },
+      ],
+      searchConfiguration: {
+        query: {
+          query: 'labels.scenario: custom_threshold_metric_avg',
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_groupby.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_groupby.ts
new file mode 100644
index 0000000000000..a662608ab31d6
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_groupby.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  Aggregators,
+  Comparator,
+} from '@kbn/observability-plugin/common/custom_threshold_rule/types';
+
+export const scenario5 = {
+  dataView: {
+    indexPattern: 'high-cardinality-data-fake_hosts.fake_hosts-*',
+    id: 'data-view-id',
+    shouldCreate: false,
+  },
+  ruleParams: {
+    consumer: 'logs',
+    name: 'custom_threshold_metric_avg_groupby',
+    params: {
+      criteria: [
+        {
+          aggType: Aggregators.CUSTOM,
+          comparator: Comparator.GT,
+          threshold: [80],
+          timeSize: 5,
+          timeUnit: 'm',
+          metrics: [{ name: 'A', field: 'system.cpu.user.pct', aggType: Aggregators.AVERAGE }],
+        },
+      ],
+      groupBy: ['host.name'],
+      searchConfiguration: {
+        query: {
+          query: 'labels.scenario: custom_threshold_metric_avg_groupby',
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_nodata.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_nodata.ts
new file mode 100644
index 0000000000000..5e98aa1a58d31
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/custom_threshold_metric_avg_nodata.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  Aggregators,
+  Comparator,
+} from '@kbn/observability-plugin/common/custom_threshold_rule/types';
+
+export const scenario6 = {
+  dataView: {
+    indexPattern: 'high-cardinality-data-fake_hosts.fake_hosts-*',
+    id: 'data-view-id',
+    shouldCreate: false,
+  },
+  ruleParams: {
+    consumer: 'logs',
+    name: 'custom_threshold_metric_avg_nodata',
+    params: {
+      criteria: [
+        {
+          aggType: Aggregators.CUSTOM,
+          comparator: Comparator.LT,
+          threshold: [1],
+          timeSize: 1,
+          timeUnit: 'm',
+          metrics: [{ name: 'A', field: 'system.cpu.user.pct', aggType: Aggregators.AVERAGE }],
+        },
+      ],
+      searchConfiguration: {
+        query: {
+          query: 'labels.scenario: custom_threshold_metric_avg_nodata',
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/packages/observability/alerting_test_data/src/scenarios/index.ts b/x-pack/packages/observability/alerting_test_data/src/scenarios/index.ts
new file mode 100644
index 0000000000000..c91fbcfac4ca6
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/src/scenarios/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { scenario1 } from './custom_threshold_log_count';
+export { scenario2 } from './custom_threshold_log_count_groupby';
+export { scenario3 } from './custom_threshold_log_count_nodata';
+export { scenario4 } from './custom_threshold_metric_avg';
+export { scenario5 } from './custom_threshold_metric_avg_groupby';
+export { scenario6 } from './custom_threshold_metric_avg_nodata';
diff --git a/x-pack/packages/observability/alerting_test_data/tsconfig.json b/x-pack/packages/observability/alerting_test_data/tsconfig.json
new file mode 100644
index 0000000000000..d2a9a55a887de
--- /dev/null
+++ b/x-pack/packages/observability/alerting_test_data/tsconfig.json
@@ -0,0 +1,22 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node",
+      "react"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/observability-plugin",
+    "@kbn/rule-data-utils",
+  ]
+}
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/helpers.ts b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/helpers.ts
index 2ebfec9a7f257..ba195f0de0e15 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/helpers.ts
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/helpers.ts
@@ -27,6 +27,7 @@ import type {
 } from './types';
 
 const EMPTY_INDEX_NAMES: string[] = [];
+export const INTERNAL_API_VERSION = '1';
 
 export const getIndexNames = ({
   ilmExplain,
@@ -282,7 +283,7 @@ export const getSizeInBytes = ({
 }: {
   indexName: string;
   stats: Record<string, IndicesStatsIndicesStats> | null;
-}): number => (stats && stats[indexName]?.primaries?.store?.size_in_bytes) ?? 0;
+}): number => (stats && stats[indexName]?.primaries?.store?.total_data_set_size_in_bytes) ?? 0;
 
 export const getTotalDocsCount = ({
   indexNames,
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/mock/pattern_rollup/mock_auditbeat_pattern_rollup.ts b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/mock/pattern_rollup/mock_auditbeat_pattern_rollup.ts
index 7c18523e44aa3..2f83f899dc0d2 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/mock/pattern_rollup/mock_auditbeat_pattern_rollup.ts
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/mock/pattern_rollup/mock_auditbeat_pattern_rollup.ts
@@ -53,6 +53,7 @@ export const auditbeatNoResults: PatternRollup = {
       primaries: {
         store: {
           size_in_bytes: 18791790,
+          total_data_set_size_in_bytes: 18791790,
           reserved_in_bytes: 0,
         },
       },
@@ -70,6 +71,7 @@ export const auditbeatNoResults: PatternRollup = {
       primaries: {
         store: {
           size_in_bytes: 247,
+          total_data_set_size_in_bytes: 247,
           reserved_in_bytes: 0,
         },
       },
@@ -87,6 +89,7 @@ export const auditbeatNoResults: PatternRollup = {
       primaries: {
         store: {
           size_in_bytes: 28409,
+          total_data_set_size_in_bytes: 28409,
           reserved_in_bytes: 0,
         },
       },
@@ -182,6 +185,7 @@ export const auditbeatWithAllResults: PatternRollup = {
       primaries: {
         store: {
           size_in_bytes: 18791790,
+          total_data_set_size_in_bytes: 18791790,
           reserved_in_bytes: 0,
         },
       },
@@ -199,6 +203,7 @@ export const auditbeatWithAllResults: PatternRollup = {
       primaries: {
         store: {
           size_in_bytes: 247,
+          total_data_set_size_in_bytes: 247,
           reserved_in_bytes: 0,
         },
       },
@@ -216,6 +221,7 @@ export const auditbeatWithAllResults: PatternRollup = {
       primaries: {
         store: {
           size_in_bytes: 28409,
+          total_data_set_size_in_bytes: 28409,
           reserved_in_bytes: 0,
         },
       },
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/mock/pattern_rollup/mock_packetbeat_pattern_rollup.ts b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/mock/pattern_rollup/mock_packetbeat_pattern_rollup.ts
index b04c8bb87600a..369803a44a3dd 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/mock/pattern_rollup/mock_packetbeat_pattern_rollup.ts
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/mock/pattern_rollup/mock_packetbeat_pattern_rollup.ts
@@ -51,6 +51,7 @@ export const packetbeatNoResults: PatternRollup = {
       primaries: {
         store: {
           size_in_bytes: 512194751,
+          total_data_set_size_in_bytes: 512194751,
           reserved_in_bytes: 0,
         },
       },
@@ -68,6 +69,7 @@ export const packetbeatNoResults: PatternRollup = {
       primaries: {
         store: {
           size_in_bytes: 584326147,
+          total_data_set_size_in_bytes: 584326147,
           reserved_in_bytes: 0,
         },
       },
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_ilm_explain/index.tsx b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_ilm_explain/index.tsx
index ae643745bd805..4e95549338874 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_ilm_explain/index.tsx
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_ilm_explain/index.tsx
@@ -9,6 +9,7 @@ import type { IlmExplainLifecycleLifecycleExplain } from '@elastic/elasticsearch
 import { useEffect, useState } from 'react';
 
 import { useDataQualityContext } from '../data_quality_panel/data_quality_context';
+import { INTERNAL_API_VERSION } from '../helpers';
 import * as i18n from '../translations';
 
 const ILM_EXPLAIN_ENDPOINT = '/internal/ecs_data_quality_dashboard/ilm_explain';
@@ -43,6 +44,7 @@ export const useIlmExplain = (pattern: string): UseIlmExplain => {
           {
             method: 'GET',
             signal: abortController.signal,
+            version: INTERNAL_API_VERSION,
           }
         );
 
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_mappings/helpers.ts b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_mappings/helpers.ts
index 8aab64729df2f..809f543c0c0ae 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_mappings/helpers.ts
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_mappings/helpers.ts
@@ -9,6 +9,7 @@ import type { HttpHandler } from '@kbn/core-http-browser';
 import type { IndicesGetMappingIndexMappingRecord } from '@elastic/elasticsearch/lib/api/types';
 
 import * as i18n from '../translations';
+import { INTERNAL_API_VERSION } from '../helpers';
 
 export const MAPPINGS_API_ROUTE = '/internal/ecs_data_quality_dashboard/mappings';
 
@@ -29,6 +30,7 @@ export async function fetchMappings({
       {
         method: 'GET',
         signal: abortController.signal,
+        version: INTERNAL_API_VERSION,
       }
     );
   } catch (e) {
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_stats/index.tsx b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_stats/index.tsx
index 6875dad3d4dfc..fce940de15f75 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_stats/index.tsx
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_stats/index.tsx
@@ -11,6 +11,7 @@ import { HttpFetchQuery } from '@kbn/core/public';
 
 import { useDataQualityContext } from '../data_quality_panel/data_quality_context';
 import * as i18n from '../translations';
+import { INTERNAL_API_VERSION } from '../helpers';
 
 const STATS_ENDPOINT = '/internal/ecs_data_quality_dashboard/stats';
 
@@ -53,6 +54,7 @@ export const useStats = ({
         const response = await httpFetch<Record<string, IndicesStatsIndicesStats>>(
           `${STATS_ENDPOINT}/${encodedIndexName}`,
           {
+            version: INTERNAL_API_VERSION,
             method: 'GET',
             signal: abortController.signal,
             query,
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_unallowed_values/helpers.test.ts b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_unallowed_values/helpers.test.ts
index 7b0a77d9af564..cad285a4bc976 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_unallowed_values/helpers.test.ts
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_unallowed_values/helpers.test.ts
@@ -15,6 +15,7 @@ import {
 } from './helpers';
 import { mockUnallowedValuesResponse } from '../mock/unallowed_values/mock_unallowed_values';
 import { UnallowedValueRequestItem, UnallowedValueSearchResult } from '../types';
+import { INTERNAL_API_VERSION } from '../helpers';
 
 describe('helpers', () => {
   let originalFetch: typeof global['fetch'];
@@ -406,6 +407,7 @@ describe('helpers', () => {
           headers: { 'Content-Type': 'application/json' },
           method: 'POST',
           signal: abortController.signal,
+          version: INTERNAL_API_VERSION,
         }
       );
     });
diff --git a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_unallowed_values/helpers.ts b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_unallowed_values/helpers.ts
index 5a331e7e1b8da..a193456d4afa9 100644
--- a/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_unallowed_values/helpers.ts
+++ b/x-pack/packages/security-solution/ecs_data_quality_dashboard/impl/data_quality/use_unallowed_values/helpers.ts
@@ -6,6 +6,7 @@
  */
 
 import type { HttpHandler } from '@kbn/core-http-browser';
+import { INTERNAL_API_VERSION } from '../helpers';
 import * as i18n from '../translations';
 import type {
   Bucket,
@@ -81,6 +82,7 @@ export async function fetchUnallowedValues({
       headers: { 'Content-Type': 'application/json' },
       method: 'POST',
       signal: abortController.signal,
+      version: INTERNAL_API_VERSION,
     });
   } catch (e) {
     throw new Error(
diff --git a/x-pack/packages/security-solution/navigation/src/constants.ts b/x-pack/packages/security-solution/navigation/src/constants.ts
index 8698a5dc8ac2a..704c24424cd43 100644
--- a/x-pack/packages/security-solution/navigation/src/constants.ts
+++ b/x-pack/packages/security-solution/navigation/src/constants.ts
@@ -59,7 +59,6 @@ export enum SecurityPageName {
   noPage = '',
   overview = 'overview',
   policies = 'policy',
-  projectSettings = 'project_settings',
   responseActionsHistory = 'response_actions_history',
   rules = 'rules',
   rulesAdd = 'rules-add',
diff --git a/x-pack/plugins/actions/docs/openapi/README.md b/x-pack/plugins/actions/docs/openapi/README.md
index cb0ebce144876..2bce08f0b1a4c 100644
--- a/x-pack/plugins/actions/docs/openapi/README.md
+++ b/x-pack/plugins/actions/docs/openapi/README.md
@@ -16,19 +16,23 @@ A guide about the openApi specification can be found at [https://swagger.io/docs
 It is possible to validate the docs before bundling them with the following
 command in the `x-pack/plugins/actions/docs/openapi/` folder:
 
-  ```
-    npx swagger-cli validate entrypoint.yaml
-  ```
+```
+npx swagger-cli validate entrypoint.yaml
+npx swagger-cli validate entrypoint_serverless.yaml
+```
 
 Then you can generate the `bundled` files by running the following commands:
 
-  ```
-    npx @redocly/cli bundle entrypoint.yaml --output bundled.yaml --ext yaml
-    npx @redocly/cli bundle entrypoint.yaml --output bundled.json --ext json
-  ```
+```
+npx @redocly/cli bundle entrypoint.yaml --output bundled.yaml --ext yaml
+npx @redocly/cli bundle entrypoint.yaml --output bundled.json --ext json
+npx @redocly/cli bundle entrypoint_serverless.yaml --output bundled_serverless.yaml --ext yaml
+npx @redocly/cli bundle entrypoint_serverless.yaml --output bundled_serverless.json --ext json
+```
 
 You can run additional linting with the following command:
 
-  ```
-     npx @redocly/cli lint bundled.json
-  ```
+```
+npx @redocly/cli lint bundled.json
+npx @redocly/cli lint bundled_serverless.json
+```
diff --git a/x-pack/plugins/actions/docs/openapi/bundled.json b/x-pack/plugins/actions/docs/openapi/bundled.json
index 1db5f55b1c744..06ef16a71f200 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled.json
+++ b/x-pack/plugins/actions/docs/openapi/bundled.json
@@ -33,10 +33,546 @@
     }
   ],
   "paths": {
+    "/api/actions/connector": {
+      "post": {
+        "summary": "Creates a connector.",
+        "operationId": "createConnector",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/create_connector_request"
+              },
+              "examples": {
+                "createEmailConnectorRequest": {
+                  "$ref": "#/components/examples/create_email_connector_request"
+                },
+                "createIndexConnectorRequest": {
+                  "$ref": "#/components/examples/create_index_connector_request"
+                },
+                "createWebhookConnectorRequest": {
+                  "$ref": "#/components/examples/create_webhook_connector_request"
+                },
+                "createXmattersConnectorRequest": {
+                  "$ref": "#/components/examples/create_xmatters_connector_request"
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/connector_response_properties"
+                },
+                "examples": {
+                  "createEmailConnectorResponse": {
+                    "$ref": "#/components/examples/create_email_connector_response"
+                  },
+                  "createIndexConnectorResponse": {
+                    "$ref": "#/components/examples/create_index_connector_response"
+                  },
+                  "createWebhookConnectorResponse": {
+                    "$ref": "#/components/examples/create_webhook_connector_response"
+                  },
+                  "createXmattersConnectorResponse": {
+                    "$ref": "#/components/examples/create_xmatters_connector_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    },
+    "/api/actions/connector/{connectorId}": {
+      "get": {
+        "summary": "Retrieves a connector by ID.",
+        "operationId": "getConnector",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/connector_id"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/connector_response_properties"
+                },
+                "examples": {
+                  "getConnectorResponse": {
+                    "$ref": "#/components/examples/get_connector_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          },
+          "404": {
+            "$ref": "#/components/responses/404"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "delete": {
+        "summary": "Deletes a connector.",
+        "operationId": "deleteConnector",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "$ref": "#/components/parameters/connector_id"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Indicates a successful call."
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          },
+          "404": {
+            "$ref": "#/components/responses/404"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "post": {
+        "summary": "Creates a connector.",
+        "operationId": "createConnectorId",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "in": "path",
+            "name": "connectorId",
+            "description": "A UUID v1 or v4 identifier for the connector. If you omit this parameter, an identifier is randomly generated.\n",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "example": "ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/create_connector_request"
+              },
+              "examples": {
+                "createIndexConnectorRequest": {
+                  "$ref": "#/components/examples/create_index_connector_request"
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/connector_response_properties"
+                },
+                "examples": {
+                  "createIndexConnectorResponse": {
+                    "$ref": "#/components/examples/create_index_connector_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "put": {
+        "summary": "Updates the attributes for a connector.",
+        "operationId": "updateConnector",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "$ref": "#/components/parameters/connector_id"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/update_connector_request"
+              },
+              "examples": {
+                "updateIndexConnectorRequest": {
+                  "$ref": "#/components/examples/update_index_connector_request"
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/connector_response_properties"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/401"
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          },
+          "404": {
+            "$ref": "#/components/responses/404"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    },
+    "/api/actions/connector/{connectorId}/_execute": {
+      "post": {
+        "summary": "Runs a connector.",
+        "operationId": "runConnector",
+        "description": "You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges.\n",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "$ref": "#/components/parameters/connector_id"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/run_connector_request"
+              },
+              "examples": {
+                "runIndexConnectorRequest": {
+                  "$ref": "#/components/examples/run_index_connector_request"
+                },
+                "runJiraConnectorRequest": {
+                  "$ref": "#/components/examples/run_jira_connector_request"
+                },
+                "runServerLogConnectorRequest": {
+                  "$ref": "#/components/examples/run_server_log_connector_request"
+                },
+                "runServiceNowITOMConnectorRequest": {
+                  "$ref": "#/components/examples/run_servicenow_itom_connector_request"
+                },
+                "runSwimlaneConnectorRequest": {
+                  "$ref": "#/components/examples/run_swimlane_connector_request"
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "connector_id",
+                    "status"
+                  ],
+                  "properties": {
+                    "connector_id": {
+                      "type": "string",
+                      "description": "The identifier for the connector."
+                    },
+                    "data": {
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "description": "Information returned from the action.",
+                          "additionalProperties": true
+                        },
+                        {
+                          "type": "array",
+                          "description": "An array of information returned from the action.",
+                          "items": {
+                            "type": "object"
+                          }
+                        }
+                      ]
+                    },
+                    "status": {
+                      "type": "string",
+                      "description": "The status of the action.",
+                      "enum": [
+                        "error",
+                        "ok"
+                      ]
+                    }
+                  }
+                },
+                "examples": {
+                  "runIndexConnectorResponse": {
+                    "$ref": "#/components/examples/run_index_connector_response"
+                  },
+                  "runJiraConnectorResponse": {
+                    "$ref": "#/components/examples/run_jira_connector_response"
+                  },
+                  "runServerLogConnectorResponse": {
+                    "$ref": "#/components/examples/run_server_log_connector_response"
+                  },
+                  "runServiceNowITOMConnectorResponse": {
+                    "$ref": "#/components/examples/run_servicenow_itom_connector_response"
+                  },
+                  "runSwimlaneConnectorResponse": {
+                    "$ref": "#/components/examples/run_swimlane_connector_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    },
+    "/api/actions/connectors": {
+      "get": {
+        "summary": "Retrieves all connectors.",
+        "operationId": "getConnectors",
+        "tags": [
+          "connectors"
+        ],
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/connector_response_properties"
+                  }
+                },
+                "examples": {
+                  "getConnectorsResponse": {
+                    "$ref": "#/components/examples/get_connectors_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    },
+    "/api/actions/connector_types": {
+      "get": {
+        "summary": "Retrieves a list of all connector types.",
+        "operationId": "getConnectorTypes",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "feature_id",
+            "description": "A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).",
+            "schema": {
+              "$ref": "#/components/schemas/features"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Get connector types response body properties",
+                  "description": "The properties vary for each connector type.",
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "enabled": {
+                        "type": "boolean",
+                        "description": "Indicates whether the connector type is enabled in Kibana.",
+                        "example": true
+                      },
+                      "enabled_in_config": {
+                        "type": "boolean",
+                        "description": "Indicates whether the connector type is enabled in the Kibana configuration file.",
+                        "example": true
+                      },
+                      "enabled_in_license": {
+                        "type": "boolean",
+                        "description": "Indicates whether the connector is enabled in the license.",
+                        "example": true
+                      },
+                      "id": {
+                        "$ref": "#/components/schemas/connector_types"
+                      },
+                      "is_system_action_type": {
+                        "type": "boolean",
+                        "example": false
+                      },
+                      "minimum_license_required": {
+                        "type": "string",
+                        "description": "The license that is required to use the connector type.",
+                        "example": "basic"
+                      },
+                      "name": {
+                        "type": "string",
+                        "description": "The name of the connector type.",
+                        "example": "Index"
+                      },
+                      "supported_feature_ids": {
+                        "type": "array",
+                        "description": "The features that are supported by the connector type.",
+                        "items": {
+                          "$ref": "#/components/schemas/features"
+                        },
+                        "example": [
+                          "alerting",
+                          "cases",
+                          "siem"
+                        ]
+                      }
+                    }
+                  }
+                },
+                "examples": {
+                  "getConnectorTypesServerlessResponse": {
+                    "$ref": "#/components/examples/get_connector_types_generativeai_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    },
     "/s/{spaceId}/api/actions/connector": {
       "post": {
         "summary": "Creates a connector.",
-        "operationId": "createConnector",
+        "operationId": "createConnectorWithSpaceId",
         "description": "You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.\n",
         "tags": [
           "connectors"
@@ -54,79 +590,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "title": "Create connector request body properties",
-                "description": "The properties vary depending on the connector type.",
-                "oneOf": [
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_bedrock"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_cases_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_d3security"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_email"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_genai"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_index"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_jira"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_opsgenie"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_pagerduty"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_resilient"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_serverlog"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_servicenow"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_servicenow_itom"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_servicenow_sir"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_slack_api"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_slack_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_swimlane"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_teams"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_tines"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_torq"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_xmatters"
-                  }
-                ],
-                "discriminator": {
-                  "propertyName": "connector_type_id"
-                }
+                "$ref": "#/components/schemas/create_connector_request"
               },
               "examples": {
                 "createEmailConnectorRequest": {
@@ -189,7 +653,7 @@
     "/s/{spaceId}/api/actions/connector/{connectorId}": {
       "get": {
         "summary": "Retrieves a connector by ID.",
-        "operationId": "getConnector",
+        "operationId": "getConnectorWithSpaceId",
         "description": "You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.\n",
         "tags": [
           "connectors"
@@ -222,28 +686,7 @@
             "$ref": "#/components/responses/401"
           },
           "404": {
-            "description": "Object is not found.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "error": {
-                      "type": "string",
-                      "example": "Not Found"
-                    },
-                    "message": {
-                      "type": "string",
-                      "example": "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found"
-                    },
-                    "statusCode": {
-                      "type": "integer",
-                      "example": 404
-                    }
-                  }
-                }
-              }
-            }
+            "$ref": "#/components/responses/404"
           }
         },
         "servers": [
@@ -254,7 +697,7 @@
       },
       "delete": {
         "summary": "Deletes a connector.",
-        "operationId": "deleteConnector",
+        "operationId": "deleteConnectorWithSpaceId",
         "description": "You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. WARNING: When you delete a connector, it cannot be recovered.\n",
         "tags": [
           "connectors"
@@ -278,28 +721,7 @@
             "$ref": "#/components/responses/401"
           },
           "404": {
-            "description": "Object is not found.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "error": {
-                      "type": "string",
-                      "example": "Not Found"
-                    },
-                    "message": {
-                      "type": "string",
-                      "example": "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found"
-                    },
-                    "statusCode": {
-                      "type": "integer",
-                      "example": 404
-                    }
-                  }
-                }
-              }
-            }
+            "$ref": "#/components/responses/404"
           }
         },
         "servers": [
@@ -310,7 +732,7 @@
       },
       "post": {
         "summary": "Creates a connector.",
-        "operationId": "createConnectorId",
+        "operationId": "createConnectorIdWithSpaceId",
         "description": "You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.\n",
         "tags": [
           "connectors"
@@ -338,79 +760,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "title": "Create connector request body properties",
-                "description": "The properties vary depending on the connector type.",
-                "oneOf": [
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_bedrock"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_cases_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_d3security"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_email"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_genai"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_index"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_jira"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_opsgenie"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_pagerduty"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_resilient"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_serverlog"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_servicenow"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_servicenow_itom"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_servicenow_sir"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_slack_api"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_slack_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_swimlane"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_teams"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_tines"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_torq"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_xmatters"
-                  }
-                ],
-                "discriminator": {
-                  "propertyName": "connector_type_id"
-                }
+                "$ref": "#/components/schemas/create_connector_request"
               },
               "examples": {
                 "createIndexConnectorRequest": {
@@ -448,7 +798,7 @@
       },
       "put": {
         "summary": "Updates the attributes for a connector.",
-        "operationId": "updateConnector",
+        "operationId": "updateConnectorWithSpaceId",
         "description": "You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.\n",
         "tags": [
           "connectors"
@@ -469,73 +819,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "title": "Update connector request body properties",
-                "description": "The properties vary depending on the connector type.",
-                "oneOf": [
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_bedrock"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_cases_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_d3security"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_email"
-                  },
-                  {
-                    "$ref": "#/components/schemas/create_connector_request_genai"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_index"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_jira"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_opsgenie"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_pagerduty"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_resilient"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_serverlog"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_servicenow"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_servicenow_itom"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_slack_api"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_slack_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_swimlane"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_teams"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_tines"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_torq"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_webhook"
-                  },
-                  {
-                    "$ref": "#/components/schemas/update_connector_request_xmatters"
-                  }
-                ]
+                "$ref": "#/components/schemas/update_connector_request"
               },
               "examples": {
                 "updateIndexConnectorRequest": {
@@ -557,28 +841,7 @@
             }
           },
           "400": {
-            "description": "Indicates a bad request.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "properties": {
-                    "error": {
-                      "type": "string",
-                      "example": "Bad Request"
-                    },
-                    "message": {
-                      "type": "string",
-                      "example": "error validating action type config: [index]: expected value of type [string] but got [undefined]"
-                    },
-                    "statusCode": {
-                      "type": "integer",
-                      "example": 400
-                    }
-                  }
-                }
-              }
-            }
+            "$ref": "#/components/responses/401"
           },
           "401": {
             "$ref": "#/components/responses/401"
@@ -602,7 +865,7 @@
     "/s/{spaceId}/api/actions/connectors": {
       "get": {
         "summary": "Retrieves all connectors.",
-        "operationId": "getConnectors",
+        "operationId": "getConnectorsWithSpaceId",
         "description": "You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.\n",
         "tags": [
           "connectors"
@@ -616,60 +879,11 @@
           "200": {
             "description": "Indicates a successful call.",
             "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "title": "Get connectors response body properties",
-                    "description": "The properties vary for each connector type.",
-                    "type": "object",
-                    "required": [
-                      "connector_type_id",
-                      "id",
-                      "is_deprecated",
-                      "is_preconfigured",
-                      "name",
-                      "referenced_by_count"
-                    ],
-                    "properties": {
-                      "connector_type_id": {
-                        "$ref": "#/components/schemas/connector_types"
-                      },
-                      "config": {
-                        "type": "object",
-                        "description": "The configuration for the connector. Configuration properties vary depending on the connector type.",
-                        "additionalProperties": true,
-                        "nullable": true
-                      },
-                      "id": {
-                        "type": "string",
-                        "description": "The identifier for the connector.",
-                        "example": "b0766e10-d190-11ec-b04c-776c77d14fca"
-                      },
-                      "is_deprecated": {
-                        "$ref": "#/components/schemas/is_deprecated"
-                      },
-                      "is_missing_secrets": {
-                        "$ref": "#/components/schemas/is_missing_secrets"
-                      },
-                      "is_preconfigured": {
-                        "$ref": "#/components/schemas/is_preconfigured"
-                      },
-                      "is_system_action": {
-                        "$ref": "#/components/schemas/is_system_action"
-                      },
-                      "name": {
-                        "type": "string",
-                        "description": "The display name for the connector.",
-                        "example": "my-connector"
-                      },
-                      "referenced_by_count": {
-                        "type": "integer",
-                        "description": "Indicates the number of saved objects that reference the connector. If `is_preconfigured` is true, this value is not calculated.",
-                        "example": 2,
-                        "default": 0
-                      }
-                    }
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/connector_response_properties"
                   }
                 },
                 "examples": {
@@ -699,7 +913,7 @@
     "/s/{spaceId}/api/actions/connector_types": {
       "get": {
         "summary": "Retrieves a list of all connector types.",
-        "operationId": "getConnectorTypes",
+        "operationId": "getConnectorTypesWithSpaceId",
         "description": "You do not need any Kibana feature privileges to run this API.\n",
         "tags": [
           "connectors"
@@ -799,7 +1013,7 @@
     "/s/{spaceId}/api/actions/connector/{connectorId}/_execute": {
       "post": {
         "summary": "Runs a connector.",
-        "operationId": "runConnector",
+        "operationId": "runConnectorWithSpaceId",
         "description": "You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges.\n",
         "tags": [
           "connectors"
@@ -820,66 +1034,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "title": "Run connector request body properties",
-                "description": "The properties vary depending on the connector type.",
-                "type": "object",
-                "required": [
-                  "params"
-                ],
-                "properties": {
-                  "params": {
-                    "oneOf": [
-                      {
-                        "$ref": "#/components/schemas/run_connector_params_documents"
-                      },
-                      {
-                        "$ref": "#/components/schemas/run_connector_params_level_message"
-                      },
-                      {
-                        "title": "Subaction parameters",
-                        "description": "Test an action that involves a subaction.",
-                        "oneOf": [
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_addevent"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_closealert"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_createalert"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_fieldsbyissuetype"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_getchoices"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_getfields"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_getincident"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_issue"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_issues"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_issuetypes"
-                          },
-                          {
-                            "$ref": "#/components/schemas/run_connector_subaction_pushtoservice"
-                          }
-                        ],
-                        "discriminator": {
-                          "propertyName": "subAction"
-                        }
-                      }
-                    ]
-                  }
-                }
+                "$ref": "#/components/schemas/run_connector_request"
               },
               "examples": {
                 "runIndexConnectorRequest": {
@@ -1400,24 +1555,24 @@
         "description": "Cross-site request forgery protection",
         "required": true
       },
-      "space_id": {
+      "connector_id": {
         "in": "path",
-        "name": "spaceId",
-        "description": "An identifier for the space. If `/s/` and the identifier are omitted from the path, the default space is used.",
+        "name": "connectorId",
+        "description": "An identifier for the connector.",
         "required": true,
         "schema": {
           "type": "string",
-          "example": "default"
+          "example": "df770e30-8b8b-11ed-a780-3b746c987a81"
         }
       },
-      "connector_id": {
+      "space_id": {
         "in": "path",
-        "name": "connectorId",
-        "description": "An identifier for the connector.",
+        "name": "spaceId",
+        "description": "An identifier for the space. If `/s/` and the identifier are omitted from the path, the default space is used.",
         "required": true,
         "schema": {
           "type": "string",
-          "example": "df770e30-8b8b-11ed-a780-3b746c987a81"
+          "example": "default"
         }
       },
       "action_id": {
@@ -3188,6 +3343,81 @@
           }
         }
       },
+      "create_connector_request": {
+        "title": "Create connector request body properties",
+        "description": "The properties vary depending on the connector type.",
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/create_connector_request_bedrock"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_cases_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_d3security"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_email"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_genai"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_index"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_jira"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_opsgenie"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_pagerduty"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_resilient"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_serverlog"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_servicenow"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_servicenow_itom"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_servicenow_sir"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_slack_api"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_slack_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_swimlane"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_teams"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_tines"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_torq"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_xmatters"
+          }
+        ],
+        "discriminator": {
+          "propertyName": "connector_type_id"
+        }
+      },
       "is_deprecated": {
         "type": "boolean",
         "description": "Indicates whether the connector type is deprecated.",
@@ -3200,7 +3430,7 @@
       },
       "is_preconfigured": {
         "type": "boolean",
-        "description": "Indicates whether it is a preconfigured connector. If true, the `config` and `is_missing_secrets` properties are omitted from the response.",
+        "description": "Indicates whether it is a preconfigured connector. If true, the `config` and `is_missing_secrets` properties are omitted from the response. \n",
         "example": false
       },
       "is_system_action": {
@@ -3208,11 +3438,59 @@
         "description": "Indicates whether the connector is used for system actions.",
         "example": false
       },
+      "connector_response_properties_bedrock": {
+        "title": "Connector response properties for an Amazon Bedrock connector",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_bedrock"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".bedrock"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          }
+        }
+      },
+      "referenced_by_count": {
+        "type": "integer",
+        "description": "Indicates the number of saved objects that reference the connector. If `is_preconfigured` is true, this value is not calculated. This property is returned only by the get all connectors API.\n",
+        "example": 2
+      },
       "connector_response_properties_cases_webhook": {
         "title": "Connector request properties for a Webhook - Case Management connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3249,6 +3527,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3256,7 +3537,6 @@
         "title": "Connector response properties for a D3 Security connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3293,6 +3573,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3300,7 +3583,6 @@
         "title": "Connector response properties for an email connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3337,6 +3619,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3344,7 +3629,6 @@
         "title": "Connector response properties for an index connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3381,6 +3665,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3388,7 +3675,6 @@
         "title": "Connector response properties for a Jira connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3425,6 +3711,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3432,7 +3721,6 @@
         "title": "Connector response properties for an Opsgenie connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3469,6 +3757,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3476,7 +3767,6 @@
         "title": "Connector response properties for a PagerDuty connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3513,6 +3803,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3520,7 +3813,6 @@
         "title": "Connector response properties for a IBM Resilient connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3557,6 +3849,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3564,7 +3859,6 @@
         "title": "Connector response properties for a server log connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3602,6 +3896,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3609,7 +3906,6 @@
         "title": "Connector response properties for a ServiceNow ITSM connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3646,6 +3942,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3653,7 +3952,6 @@
         "title": "Connector response properties for a ServiceNow ITOM connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3690,6 +3988,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3697,7 +3998,6 @@
         "title": "Connector response properties for a ServiceNow SecOps connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3734,6 +4034,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3774,6 +4077,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3814,6 +4120,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3821,7 +4130,6 @@
         "title": "Connector response properties for a Swimlane connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3858,6 +4166,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3901,6 +4212,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3908,7 +4222,6 @@
         "title": "Connector response properties for a Tines connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3945,6 +4258,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3952,7 +4268,6 @@
         "title": "Connector response properties for a Torq connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -3989,6 +4304,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -3996,7 +4314,6 @@
         "title": "Connector response properties for a Webhook connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -4033,6 +4350,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -4040,7 +4360,6 @@
         "title": "Connector response properties for an xMatters connector",
         "type": "object",
         "required": [
-          "config",
           "connector_type_id",
           "id",
           "is_deprecated",
@@ -4077,6 +4396,9 @@
           "name": {
             "type": "string",
             "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
           }
         }
       },
@@ -4084,6 +4406,9 @@
         "title": "Connector response properties",
         "description": "The properties vary depending on the connector type.",
         "oneOf": [
+          {
+            "$ref": "#/components/schemas/connector_response_properties_bedrock"
+          },
           {
             "$ref": "#/components/schemas/connector_response_properties_cases_webhook"
           },
@@ -4149,6 +4474,26 @@
           "propertyName": "connector_type_id"
         }
       },
+      "update_connector_request_bedrock": {
+        "title": "Update Amazon Bedrock connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_bedrock"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_bedrock"
+          }
+        }
+      },
       "update_connector_request_cases_webhook": {
         "title": "Update Webhook - Case Managment connector request",
         "type": "object",
@@ -4524,44 +4869,73 @@
           }
         }
       },
-      "connector_types": {
-        "title": "Connector types",
-        "type": "string",
-        "description": "The type of connector. For example, `.email`, `.index`, `.jira`, `.opsgenie`, or `.server-log`.",
-        "enum": [
-          ".bedrock",
-          ".cases-webhook",
-          ".d3security",
-          ".email",
-          ".gen-ai",
-          ".index",
-          ".jira",
-          ".opsgenie",
-          ".pagerduty",
-          ".resilient",
-          ".servicenow",
-          ".servicenow-itom",
-          ".servicenow-sir",
-          ".server-log",
-          ".slack",
-          ".slack_api",
-          ".swimlane",
-          ".teams",
-          ".tines",
-          ".torq",
-          ".webhook",
-          ".xmatters"
-        ],
-        "example": ".server-log"
-      },
-      "features": {
-        "type": "string",
-        "description": "The feature that uses the connector. Valid values are `alerting`, `cases`, `uptime`, and `siem`.\n",
-        "enum": [
-          "alerting",
-          "cases",
-          "uptime",
-          "siem"
+      "update_connector_request": {
+        "title": "Update connector request body properties",
+        "description": "The properties vary depending on the connector type.",
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/update_connector_request_bedrock"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_cases_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_d3security"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_email"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_genai"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_index"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_jira"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_opsgenie"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_pagerduty"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_resilient"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_serverlog"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_servicenow"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_servicenow_itom"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_slack_api"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_slack_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_swimlane"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_teams"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_tines"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_torq"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_xmatters"
+          }
         ]
       },
       "run_connector_params_documents": {
@@ -5246,6 +5620,109 @@
           }
         }
       },
+      "run_connector_request": {
+        "title": "Run connector request body properties",
+        "description": "The properties vary depending on the connector type.",
+        "type": "object",
+        "required": [
+          "params"
+        ],
+        "properties": {
+          "params": {
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/run_connector_params_documents"
+              },
+              {
+                "$ref": "#/components/schemas/run_connector_params_level_message"
+              },
+              {
+                "title": "Subaction parameters",
+                "description": "Test an action that involves a subaction.",
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_addevent"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_closealert"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_createalert"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_fieldsbyissuetype"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_getchoices"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_getfields"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_getincident"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_issue"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_issues"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_issuetypes"
+                  },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_pushtoservice"
+                  }
+                ],
+                "discriminator": {
+                  "propertyName": "subAction"
+                }
+              }
+            ]
+          }
+        }
+      },
+      "features": {
+        "type": "string",
+        "description": "The feature that uses the connector.\n",
+        "enum": [
+          "alerting",
+          "cases",
+          "generativeAI",
+          "siem",
+          "uptime"
+        ]
+      },
+      "connector_types": {
+        "title": "Connector types",
+        "type": "string",
+        "description": "The type of connector. For example, `.email`, `.index`, `.jira`, `.opsgenie`, or `.server-log`.",
+        "enum": [
+          ".bedrock",
+          ".cases-webhook",
+          ".d3security",
+          ".email",
+          ".gen-ai",
+          ".index",
+          ".jira",
+          ".opsgenie",
+          ".pagerduty",
+          ".resilient",
+          ".servicenow",
+          ".servicenow-itom",
+          ".servicenow-sir",
+          ".server-log",
+          ".slack",
+          ".slack_api",
+          ".swimlane",
+          ".teams",
+          ".tines",
+          ".torq",
+          ".webhook",
+          ".xmatters"
+        ],
+        "example": ".server-log"
+      },
       "action_response_properties": {
         "title": "Action response properties",
         "description": "The properties vary depending on the action type.",
@@ -5417,7 +5894,7 @@
         }
       },
       "get_connector_response": {
-        "summary": "A list of connector types",
+        "summary": "Get connector details.",
         "value": {
           "id": "df770e30-8b8b-11ed-a780-3b746c987a81",
           "name": "my_server_log_connector",
@@ -5438,78 +5915,6 @@
           }
         }
       },
-      "get_connectors_response": {
-        "summary": "A list of connectors",
-        "value": [
-          {
-            "id": "preconfigured-email-connector",
-            "name": "my-preconfigured-email-notification",
-            "connector_type_id": ".email",
-            "is_preconfigured": true,
-            "is_deprecated": false,
-            "referenced_by_count": 0,
-            "is_system_action": false
-          },
-          {
-            "id": "e07d0c80-8b8b-11ed-a780-3b746c987a81",
-            "name": "my-index-connector",
-            "config": {
-              "index": "test-index",
-              "refresh": false,
-              "executionTimeField": null
-            },
-            "connector_type_id": ".index",
-            "is_preconfigured": false,
-            "is_deprecated": false,
-            "referenced_by_count": 2,
-            "is_missing_secrets": false,
-            "is_system_action": false
-          }
-        ]
-      },
-      "get_connector_types_response": {
-        "summary": "A list of connector types",
-        "value": [
-          {
-            "id": ".swimlane",
-            "name": "Swimlane",
-            "enabled": true,
-            "enabled_in_config": true,
-            "enabled_in_license": true,
-            "minimum_license_required": "gold",
-            "supported_feature_ids": [
-              "alerting",
-              "cases",
-              "siem"
-            ]
-          },
-          {
-            "id": ".index",
-            "name": "Index",
-            "enabled": true,
-            "enabled_in_config": true,
-            "enabled_in_license": true,
-            "minimum_license_required": "basic",
-            "supported_feature_ids": [
-              "alerting",
-              "uptime",
-              "siem"
-            ]
-          },
-          {
-            "id": ".server-log",
-            "name": "Server log",
-            "enabled": true,
-            "enabled_in_config": true,
-            "enabled_in_license": true,
-            "minimum_license_required": "basic",
-            "supported_feature_ids": [
-              "alerting",
-              "uptime"
-            ]
-          }
-        ]
-      },
       "run_index_connector_request": {
         "summary": "Run an index connector.",
         "value": {
@@ -5726,6 +6131,107 @@
           },
           "status": "ok"
         }
+      },
+      "get_connectors_response": {
+        "summary": "A list of connectors",
+        "value": [
+          {
+            "id": "preconfigured-email-connector",
+            "name": "my-preconfigured-email-notification",
+            "connector_type_id": ".email",
+            "is_preconfigured": true,
+            "is_deprecated": false,
+            "referenced_by_count": 0,
+            "is_system_action": false
+          },
+          {
+            "id": "e07d0c80-8b8b-11ed-a780-3b746c987a81",
+            "name": "my-index-connector",
+            "config": {
+              "index": "test-index",
+              "refresh": false,
+              "executionTimeField": null
+            },
+            "connector_type_id": ".index",
+            "is_preconfigured": false,
+            "is_deprecated": false,
+            "referenced_by_count": 2,
+            "is_missing_secrets": false,
+            "is_system_action": false
+          }
+        ]
+      },
+      "get_connector_types_generativeai_response": {
+        "summary": "A list of connector types for the `generativeAI` feature.",
+        "value": [
+          {
+            "id": ".gen-ai",
+            "name": "OpenAI",
+            "enabled": true,
+            "enabled_in_config": true,
+            "enabled_in_license": true,
+            "minimum_license_required": "enterprise",
+            "supported_feature_ids": [
+              "generativeAI"
+            ],
+            "is_system_action_type": false
+          },
+          {
+            "id": ".bedrock",
+            "name": "AWS Bedrock",
+            "enabled": true,
+            "enabled_in_config": true,
+            "enabled_in_license": true,
+            "minimum_license_required": "enterprise",
+            "supported_feature_ids": [
+              "generativeAI"
+            ],
+            "is_system_action_type": false
+          }
+        ]
+      },
+      "get_connector_types_response": {
+        "summary": "A list of connector types",
+        "value": [
+          {
+            "id": ".swimlane",
+            "name": "Swimlane",
+            "enabled": true,
+            "enabled_in_config": true,
+            "enabled_in_license": true,
+            "minimum_license_required": "gold",
+            "supported_feature_ids": [
+              "alerting",
+              "cases",
+              "siem"
+            ]
+          },
+          {
+            "id": ".index",
+            "name": "Index",
+            "enabled": true,
+            "enabled_in_config": true,
+            "enabled_in_license": true,
+            "minimum_license_required": "basic",
+            "supported_feature_ids": [
+              "alerting",
+              "uptime",
+              "siem"
+            ]
+          },
+          {
+            "id": ".server-log",
+            "name": "Server log",
+            "enabled": true,
+            "enabled_in_config": true,
+            "enabled_in_license": true,
+            "minimum_license_required": "basic",
+            "supported_feature_ids": [
+              "alerting",
+              "uptime"
+            ]
+          }
+        ]
       }
     },
     "responses": {
diff --git a/x-pack/plugins/actions/docs/openapi/bundled.yaml b/x-pack/plugins/actions/docs/openapi/bundled.yaml
index 9fb7caccd1f17..099757a354f9e 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/actions/docs/openapi/bundled.yaml
@@ -18,49 +18,20 @@ tags:
   - name: connectors
     description: Connector APIs enable you to create and manage connectors.
 paths:
-  /s/{spaceId}/api/actions/connector:
+  /api/actions/connector:
     post:
       summary: Creates a connector.
       operationId: createConnector
-      description: |
-        You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
       tags:
         - connectors
       parameters:
         - $ref: '#/components/parameters/kbn_xsrf'
-        - $ref: '#/components/parameters/space_id'
       requestBody:
         required: true
         content:
           application/json:
             schema:
-              title: Create connector request body properties
-              description: The properties vary depending on the connector type.
-              oneOf:
-                - $ref: '#/components/schemas/create_connector_request_bedrock'
-                - $ref: '#/components/schemas/create_connector_request_cases_webhook'
-                - $ref: '#/components/schemas/create_connector_request_d3security'
-                - $ref: '#/components/schemas/create_connector_request_email'
-                - $ref: '#/components/schemas/create_connector_request_genai'
-                - $ref: '#/components/schemas/create_connector_request_index'
-                - $ref: '#/components/schemas/create_connector_request_jira'
-                - $ref: '#/components/schemas/create_connector_request_opsgenie'
-                - $ref: '#/components/schemas/create_connector_request_pagerduty'
-                - $ref: '#/components/schemas/create_connector_request_resilient'
-                - $ref: '#/components/schemas/create_connector_request_serverlog'
-                - $ref: '#/components/schemas/create_connector_request_servicenow'
-                - $ref: '#/components/schemas/create_connector_request_servicenow_itom'
-                - $ref: '#/components/schemas/create_connector_request_servicenow_sir'
-                - $ref: '#/components/schemas/create_connector_request_slack_api'
-                - $ref: '#/components/schemas/create_connector_request_slack_webhook'
-                - $ref: '#/components/schemas/create_connector_request_swimlane'
-                - $ref: '#/components/schemas/create_connector_request_teams'
-                - $ref: '#/components/schemas/create_connector_request_tines'
-                - $ref: '#/components/schemas/create_connector_request_torq'
-                - $ref: '#/components/schemas/create_connector_request_webhook'
-                - $ref: '#/components/schemas/create_connector_request_xmatters'
-              discriminator:
-                propertyName: connector_type_id
+              $ref: '#/components/schemas/create_connector_request'
             examples:
               createEmailConnectorRequest:
                 $ref: '#/components/examples/create_email_connector_request'
@@ -92,17 +63,14 @@ paths:
         - url: https://localhost:5601
     servers:
       - url: https://localhost:5601
-  /s/{spaceId}/api/actions/connector/{connectorId}:
+  /api/actions/connector/{connectorId}:
     get:
       summary: Retrieves a connector by ID.
       operationId: getConnector
-      description: |
-        You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
       tags:
         - connectors
       parameters:
         - $ref: '#/components/parameters/connector_id'
-        - $ref: '#/components/parameters/space_id'
       responses:
         '200':
           description: Indicates a successful call.
@@ -116,26 +84,341 @@ paths:
         '401':
           $ref: '#/components/responses/401'
         '404':
-          description: Object is not found.
+          $ref: '#/components/responses/404'
+      servers:
+        - url: https://localhost:5601
+    delete:
+      summary: Deletes a connector.
+      operationId: deleteConnector
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - $ref: '#/components/parameters/connector_id'
+      responses:
+        '204':
+          description: Indicates a successful call.
+        '401':
+          $ref: '#/components/responses/401'
+        '404':
+          $ref: '#/components/responses/404'
+      servers:
+        - url: https://localhost:5601
+    post:
+      summary: Creates a connector.
+      operationId: createConnectorId
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - in: path
+          name: connectorId
+          description: |
+            A UUID v1 or v4 identifier for the connector. If you omit this parameter, an identifier is randomly generated.
+          required: true
+          schema:
+            type: string
+            example: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/create_connector_request'
+            examples:
+              createIndexConnectorRequest:
+                $ref: '#/components/examples/create_index_connector_request'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connector_response_properties'
+              examples:
+                createIndexConnectorResponse:
+                  $ref: '#/components/examples/create_index_connector_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    put:
+      summary: Updates the attributes for a connector.
+      operationId: updateConnector
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - $ref: '#/components/parameters/connector_id'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/update_connector_request'
+            examples:
+              updateIndexConnectorRequest:
+                $ref: '#/components/examples/update_index_connector_request'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connector_response_properties'
+        '400':
+          $ref: '#/components/responses/401'
+        '401':
+          $ref: '#/components/responses/401'
+        '404':
+          $ref: '#/components/responses/404'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+  /api/actions/connector/{connectorId}/_execute:
+    post:
+      summary: Runs a connector.
+      operationId: runConnector
+      description: |
+        You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges.
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - $ref: '#/components/parameters/connector_id'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/run_connector_request'
+            examples:
+              runIndexConnectorRequest:
+                $ref: '#/components/examples/run_index_connector_request'
+              runJiraConnectorRequest:
+                $ref: '#/components/examples/run_jira_connector_request'
+              runServerLogConnectorRequest:
+                $ref: '#/components/examples/run_server_log_connector_request'
+              runServiceNowITOMConnectorRequest:
+                $ref: '#/components/examples/run_servicenow_itom_connector_request'
+              runSwimlaneConnectorRequest:
+                $ref: '#/components/examples/run_swimlane_connector_request'
+      responses:
+        '200':
+          description: Indicates a successful call.
           content:
             application/json:
               schema:
                 type: object
+                required:
+                  - connector_id
+                  - status
                 properties:
-                  error:
+                  connector_id:
                     type: string
-                    example: Not Found
-                  message:
+                    description: The identifier for the connector.
+                  data:
+                    oneOf:
+                      - type: object
+                        description: Information returned from the action.
+                        additionalProperties: true
+                      - type: array
+                        description: An array of information returned from the action.
+                        items:
+                          type: object
+                  status:
                     type: string
-                    example: Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found
-                  statusCode:
-                    type: integer
-                    example: 404
+                    description: The status of the action.
+                    enum:
+                      - error
+                      - ok
+              examples:
+                runIndexConnectorResponse:
+                  $ref: '#/components/examples/run_index_connector_response'
+                runJiraConnectorResponse:
+                  $ref: '#/components/examples/run_jira_connector_response'
+                runServerLogConnectorResponse:
+                  $ref: '#/components/examples/run_server_log_connector_response'
+                runServiceNowITOMConnectorResponse:
+                  $ref: '#/components/examples/run_servicenow_itom_connector_response'
+                runSwimlaneConnectorResponse:
+                  $ref: '#/components/examples/run_swimlane_connector_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+  /api/actions/connectors:
+    get:
+      summary: Retrieves all connectors.
+      operationId: getConnectors
+      tags:
+        - connectors
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/connector_response_properties'
+              examples:
+                getConnectorsResponse:
+                  $ref: '#/components/examples/get_connectors_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+  /api/actions/connector_types:
+    get:
+      summary: Retrieves a list of all connector types.
+      operationId: getConnectorTypes
+      tags:
+        - connectors
+      parameters:
+        - in: query
+          name: feature_id
+          description: A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).
+          schema:
+            $ref: '#/components/schemas/features'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                title: Get connector types response body properties
+                description: The properties vary for each connector type.
+                type: array
+                items:
+                  type: object
+                  properties:
+                    enabled:
+                      type: boolean
+                      description: Indicates whether the connector type is enabled in Kibana.
+                      example: true
+                    enabled_in_config:
+                      type: boolean
+                      description: Indicates whether the connector type is enabled in the Kibana configuration file.
+                      example: true
+                    enabled_in_license:
+                      type: boolean
+                      description: Indicates whether the connector is enabled in the license.
+                      example: true
+                    id:
+                      $ref: '#/components/schemas/connector_types'
+                    is_system_action_type:
+                      type: boolean
+                      example: false
+                    minimum_license_required:
+                      type: string
+                      description: The license that is required to use the connector type.
+                      example: basic
+                    name:
+                      type: string
+                      description: The name of the connector type.
+                      example: Index
+                    supported_feature_ids:
+                      type: array
+                      description: The features that are supported by the connector type.
+                      items:
+                        $ref: '#/components/schemas/features'
+                      example:
+                        - alerting
+                        - cases
+                        - siem
+              examples:
+                getConnectorTypesServerlessResponse:
+                  $ref: '#/components/examples/get_connector_types_generativeai_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+  /s/{spaceId}/api/actions/connector:
+    post:
+      summary: Creates a connector.
+      operationId: createConnectorWithSpaceId
+      description: |
+        You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - $ref: '#/components/parameters/space_id'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/create_connector_request'
+            examples:
+              createEmailConnectorRequest:
+                $ref: '#/components/examples/create_email_connector_request'
+              createIndexConnectorRequest:
+                $ref: '#/components/examples/create_index_connector_request'
+              createWebhookConnectorRequest:
+                $ref: '#/components/examples/create_webhook_connector_request'
+              createXmattersConnectorRequest:
+                $ref: '#/components/examples/create_xmatters_connector_request'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connector_response_properties'
+              examples:
+                createEmailConnectorResponse:
+                  $ref: '#/components/examples/create_email_connector_response'
+                createIndexConnectorResponse:
+                  $ref: '#/components/examples/create_index_connector_response'
+                createWebhookConnectorResponse:
+                  $ref: '#/components/examples/create_webhook_connector_response'
+                createXmattersConnectorResponse:
+                  $ref: '#/components/examples/create_xmatters_connector_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+  /s/{spaceId}/api/actions/connector/{connectorId}:
+    get:
+      summary: Retrieves a connector by ID.
+      operationId: getConnectorWithSpaceId
+      description: |
+        You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/connector_id'
+        - $ref: '#/components/parameters/space_id'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connector_response_properties'
+              examples:
+                getConnectorResponse:
+                  $ref: '#/components/examples/get_connector_response'
+        '401':
+          $ref: '#/components/responses/401'
+        '404':
+          $ref: '#/components/responses/404'
       servers:
         - url: https://localhost:5601
     delete:
       summary: Deletes a connector.
-      operationId: deleteConnector
+      operationId: deleteConnectorWithSpaceId
       description: |
         You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. WARNING: When you delete a connector, it cannot be recovered.
       tags:
@@ -150,26 +433,12 @@ paths:
         '401':
           $ref: '#/components/responses/401'
         '404':
-          description: Object is not found.
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  error:
-                    type: string
-                    example: Not Found
-                  message:
-                    type: string
-                    example: Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found
-                  statusCode:
-                    type: integer
-                    example: 404
+          $ref: '#/components/responses/404'
       servers:
         - url: https://localhost:5601
     post:
       summary: Creates a connector.
-      operationId: createConnectorId
+      operationId: createConnectorIdWithSpaceId
       description: |
         You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
       tags:
@@ -189,33 +458,7 @@ paths:
         content:
           application/json:
             schema:
-              title: Create connector request body properties
-              description: The properties vary depending on the connector type.
-              oneOf:
-                - $ref: '#/components/schemas/create_connector_request_bedrock'
-                - $ref: '#/components/schemas/create_connector_request_cases_webhook'
-                - $ref: '#/components/schemas/create_connector_request_d3security'
-                - $ref: '#/components/schemas/create_connector_request_email'
-                - $ref: '#/components/schemas/create_connector_request_genai'
-                - $ref: '#/components/schemas/create_connector_request_index'
-                - $ref: '#/components/schemas/create_connector_request_jira'
-                - $ref: '#/components/schemas/create_connector_request_opsgenie'
-                - $ref: '#/components/schemas/create_connector_request_pagerduty'
-                - $ref: '#/components/schemas/create_connector_request_resilient'
-                - $ref: '#/components/schemas/create_connector_request_serverlog'
-                - $ref: '#/components/schemas/create_connector_request_servicenow'
-                - $ref: '#/components/schemas/create_connector_request_servicenow_itom'
-                - $ref: '#/components/schemas/create_connector_request_servicenow_sir'
-                - $ref: '#/components/schemas/create_connector_request_slack_api'
-                - $ref: '#/components/schemas/create_connector_request_slack_webhook'
-                - $ref: '#/components/schemas/create_connector_request_swimlane'
-                - $ref: '#/components/schemas/create_connector_request_teams'
-                - $ref: '#/components/schemas/create_connector_request_tines'
-                - $ref: '#/components/schemas/create_connector_request_torq'
-                - $ref: '#/components/schemas/create_connector_request_webhook'
-                - $ref: '#/components/schemas/create_connector_request_xmatters'
-              discriminator:
-                propertyName: connector_type_id
+              $ref: '#/components/schemas/create_connector_request'
             examples:
               createIndexConnectorRequest:
                 $ref: '#/components/examples/create_index_connector_request'
@@ -235,7 +478,7 @@ paths:
         - url: https://localhost:5601
     put:
       summary: Updates the attributes for a connector.
-      operationId: updateConnector
+      operationId: updateConnectorWithSpaceId
       description: |
         You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
       tags:
@@ -249,30 +492,7 @@ paths:
         content:
           application/json:
             schema:
-              title: Update connector request body properties
-              description: The properties vary depending on the connector type.
-              oneOf:
-                - $ref: '#/components/schemas/create_connector_request_bedrock'
-                - $ref: '#/components/schemas/update_connector_request_cases_webhook'
-                - $ref: '#/components/schemas/update_connector_request_d3security'
-                - $ref: '#/components/schemas/update_connector_request_email'
-                - $ref: '#/components/schemas/create_connector_request_genai'
-                - $ref: '#/components/schemas/update_connector_request_index'
-                - $ref: '#/components/schemas/update_connector_request_jira'
-                - $ref: '#/components/schemas/update_connector_request_opsgenie'
-                - $ref: '#/components/schemas/update_connector_request_pagerduty'
-                - $ref: '#/components/schemas/update_connector_request_resilient'
-                - $ref: '#/components/schemas/update_connector_request_serverlog'
-                - $ref: '#/components/schemas/update_connector_request_servicenow'
-                - $ref: '#/components/schemas/update_connector_request_servicenow_itom'
-                - $ref: '#/components/schemas/update_connector_request_slack_api'
-                - $ref: '#/components/schemas/update_connector_request_slack_webhook'
-                - $ref: '#/components/schemas/update_connector_request_swimlane'
-                - $ref: '#/components/schemas/update_connector_request_teams'
-                - $ref: '#/components/schemas/update_connector_request_tines'
-                - $ref: '#/components/schemas/update_connector_request_torq'
-                - $ref: '#/components/schemas/update_connector_request_webhook'
-                - $ref: '#/components/schemas/update_connector_request_xmatters'
+              $ref: '#/components/schemas/update_connector_request'
             examples:
               updateIndexConnectorRequest:
                 $ref: '#/components/examples/update_index_connector_request'
@@ -284,21 +504,7 @@ paths:
               schema:
                 $ref: '#/components/schemas/connector_response_properties'
         '400':
-          description: Indicates a bad request.
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  error:
-                    type: string
-                    example: Bad Request
-                  message:
-                    type: string
-                    example: 'error validating action type config: [index]: expected value of type [string] but got [undefined]'
-                  statusCode:
-                    type: integer
-                    example: 400
+          $ref: '#/components/responses/401'
         '401':
           $ref: '#/components/responses/401'
         '404':
@@ -310,7 +516,7 @@ paths:
   /s/{spaceId}/api/actions/connectors:
     get:
       summary: Retrieves all connectors.
-      operationId: getConnectors
+      operationId: getConnectorsWithSpaceId
       description: |
         You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
       tags:
@@ -325,45 +531,7 @@ paths:
               schema:
                 type: array
                 items:
-                  title: Get connectors response body properties
-                  description: The properties vary for each connector type.
-                  type: object
-                  required:
-                    - connector_type_id
-                    - id
-                    - is_deprecated
-                    - is_preconfigured
-                    - name
-                    - referenced_by_count
-                  properties:
-                    connector_type_id:
-                      $ref: '#/components/schemas/connector_types'
-                    config:
-                      type: object
-                      description: The configuration for the connector. Configuration properties vary depending on the connector type.
-                      additionalProperties: true
-                      nullable: true
-                    id:
-                      type: string
-                      description: The identifier for the connector.
-                      example: b0766e10-d190-11ec-b04c-776c77d14fca
-                    is_deprecated:
-                      $ref: '#/components/schemas/is_deprecated'
-                    is_missing_secrets:
-                      $ref: '#/components/schemas/is_missing_secrets'
-                    is_preconfigured:
-                      $ref: '#/components/schemas/is_preconfigured'
-                    is_system_action:
-                      $ref: '#/components/schemas/is_system_action'
-                    name:
-                      type: string
-                      description: The display name for the connector.
-                      example: my-connector
-                    referenced_by_count:
-                      type: integer
-                      description: Indicates the number of saved objects that reference the connector. If `is_preconfigured` is true, this value is not calculated.
-                      example: 2
-                      default: 0
+                  $ref: '#/components/schemas/connector_response_properties'
               examples:
                 getConnectorsResponse:
                   $ref: '#/components/examples/get_connectors_response'
@@ -376,7 +544,7 @@ paths:
   /s/{spaceId}/api/actions/connector_types:
     get:
       summary: Retrieves a list of all connector types.
-      operationId: getConnectorTypes
+      operationId: getConnectorTypesWithSpaceId
       description: |
         You do not need any Kibana feature privileges to run this API.
       tags:
@@ -443,7 +611,7 @@ paths:
   /s/{spaceId}/api/actions/connector/{connectorId}/_execute:
     post:
       summary: Runs a connector.
-      operationId: runConnector
+      operationId: runConnectorWithSpaceId
       description: |
         You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges.
       tags:
@@ -457,32 +625,7 @@ paths:
         content:
           application/json:
             schema:
-              title: Run connector request body properties
-              description: The properties vary depending on the connector type.
-              type: object
-              required:
-                - params
-              properties:
-                params:
-                  oneOf:
-                    - $ref: '#/components/schemas/run_connector_params_documents'
-                    - $ref: '#/components/schemas/run_connector_params_level_message'
-                    - title: Subaction parameters
-                      description: Test an action that involves a subaction.
-                      oneOf:
-                        - $ref: '#/components/schemas/run_connector_subaction_addevent'
-                        - $ref: '#/components/schemas/run_connector_subaction_closealert'
-                        - $ref: '#/components/schemas/run_connector_subaction_createalert'
-                        - $ref: '#/components/schemas/run_connector_subaction_fieldsbyissuetype'
-                        - $ref: '#/components/schemas/run_connector_subaction_getchoices'
-                        - $ref: '#/components/schemas/run_connector_subaction_getfields'
-                        - $ref: '#/components/schemas/run_connector_subaction_getincident'
-                        - $ref: '#/components/schemas/run_connector_subaction_issue'
-                        - $ref: '#/components/schemas/run_connector_subaction_issues'
-                        - $ref: '#/components/schemas/run_connector_subaction_issuetypes'
-                        - $ref: '#/components/schemas/run_connector_subaction_pushtoservice'
-                      discriminator:
-                        propertyName: subAction
+              $ref: '#/components/schemas/run_connector_request'
             examples:
               runIndexConnectorRequest:
                 $ref: '#/components/examples/run_index_connector_request'
@@ -796,14 +939,6 @@ components:
       name: kbn-xsrf
       description: Cross-site request forgery protection
       required: true
-    space_id:
-      in: path
-      name: spaceId
-      description: An identifier for the space. If `/s/` and the identifier are omitted from the path, the default space is used.
-      required: true
-      schema:
-        type: string
-        example: default
     connector_id:
       in: path
       name: connectorId
@@ -812,6 +947,14 @@ components:
       schema:
         type: string
         example: df770e30-8b8b-11ed-a780-3b746c987a81
+    space_id:
+      in: path
+      name: spaceId
+      description: An identifier for the space. If `/s/` and the identifier are omitted from the path, the default space is used.
+      required: true
+      schema:
+        type: string
+        example: default
     action_id:
       in: path
       name: actionId
@@ -2189,30 +2332,95 @@ components:
         name:
           type: string
           description: The display name for the connector.
-          example: my-connector
-        secrets:
-          $ref: '#/components/schemas/secrets_properties_xmatters'
-    is_deprecated:
-      type: boolean
-      description: Indicates whether the connector type is deprecated.
-      example: false
-    is_missing_secrets:
-      type: boolean
-      description: Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
-      example: false
-    is_preconfigured:
-      type: boolean
-      description: Indicates whether it is a preconfigured connector. If true, the `config` and `is_missing_secrets` properties are omitted from the response.
-      example: false
-    is_system_action:
-      type: boolean
-      description: Indicates whether the connector is used for system actions.
-      example: false
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_xmatters'
+    create_connector_request:
+      title: Create connector request body properties
+      description: The properties vary depending on the connector type.
+      oneOf:
+        - $ref: '#/components/schemas/create_connector_request_bedrock'
+        - $ref: '#/components/schemas/create_connector_request_cases_webhook'
+        - $ref: '#/components/schemas/create_connector_request_d3security'
+        - $ref: '#/components/schemas/create_connector_request_email'
+        - $ref: '#/components/schemas/create_connector_request_genai'
+        - $ref: '#/components/schemas/create_connector_request_index'
+        - $ref: '#/components/schemas/create_connector_request_jira'
+        - $ref: '#/components/schemas/create_connector_request_opsgenie'
+        - $ref: '#/components/schemas/create_connector_request_pagerduty'
+        - $ref: '#/components/schemas/create_connector_request_resilient'
+        - $ref: '#/components/schemas/create_connector_request_serverlog'
+        - $ref: '#/components/schemas/create_connector_request_servicenow'
+        - $ref: '#/components/schemas/create_connector_request_servicenow_itom'
+        - $ref: '#/components/schemas/create_connector_request_servicenow_sir'
+        - $ref: '#/components/schemas/create_connector_request_slack_api'
+        - $ref: '#/components/schemas/create_connector_request_slack_webhook'
+        - $ref: '#/components/schemas/create_connector_request_swimlane'
+        - $ref: '#/components/schemas/create_connector_request_teams'
+        - $ref: '#/components/schemas/create_connector_request_tines'
+        - $ref: '#/components/schemas/create_connector_request_torq'
+        - $ref: '#/components/schemas/create_connector_request_webhook'
+        - $ref: '#/components/schemas/create_connector_request_xmatters'
+      discriminator:
+        propertyName: connector_type_id
+    is_deprecated:
+      type: boolean
+      description: Indicates whether the connector type is deprecated.
+      example: false
+    is_missing_secrets:
+      type: boolean
+      description: Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
+      example: false
+    is_preconfigured:
+      type: boolean
+      description: |
+        Indicates whether it is a preconfigured connector. If true, the `config` and `is_missing_secrets` properties are omitted from the response. 
+      example: false
+    is_system_action:
+      type: boolean
+      description: Indicates whether the connector is used for system actions.
+      example: false
+    connector_response_properties_bedrock:
+      title: Connector response properties for an Amazon Bedrock connector
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_bedrock'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .bedrock
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+    referenced_by_count:
+      type: integer
+      description: |
+        Indicates the number of saved objects that reference the connector. If `is_preconfigured` is true, this value is not calculated. This property is returned only by the get all connectors API.
+      example: 2
     connector_response_properties_cases_webhook:
       title: Connector request properties for a Webhook - Case Management connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2240,11 +2448,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_d3security:
       title: Connector response properties for a D3 Security connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2272,11 +2481,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_email:
       title: Connector response properties for an email connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2304,11 +2514,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_index:
       title: Connector response properties for an index connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2336,11 +2547,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_jira:
       title: Connector response properties for a Jira connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2368,11 +2580,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_opsgenie:
       title: Connector response properties for an Opsgenie connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2400,11 +2613,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_pagerduty:
       title: Connector response properties for a PagerDuty connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2432,11 +2646,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_resilient:
       title: Connector response properties for a IBM Resilient connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2464,11 +2679,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_serverlog:
       title: Connector response properties for a server log connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2497,11 +2713,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_servicenow:
       title: Connector response properties for a ServiceNow ITSM connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2529,11 +2746,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_servicenow_itom:
       title: Connector response properties for a ServiceNow ITOM connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2561,11 +2779,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_servicenow_sir:
       title: Connector response properties for a ServiceNow SecOps connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2593,6 +2812,8 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_slack_api:
       title: Connector response properties for a Slack connector
       type: object
@@ -2622,6 +2843,8 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_slack_webhook:
       title: Connector response properties for a Slack connector
       type: object
@@ -2651,11 +2874,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_swimlane:
       title: Connector response properties for a Swimlane connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2683,6 +2907,8 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_teams:
       title: Connector response properties for a Microsoft Teams connector
       type: object
@@ -2714,11 +2940,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_tines:
       title: Connector response properties for a Tines connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2746,11 +2973,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_torq:
       title: Connector response properties for a Torq connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2778,11 +3006,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_webhook:
       title: Connector response properties for a Webhook connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2810,11 +3039,12 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties_xmatters:
       title: Connector response properties for an xMatters connector
       type: object
       required:
-        - config
         - connector_type_id
         - id
         - is_deprecated
@@ -2842,10 +3072,13 @@ components:
         name:
           type: string
           description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
     connector_response_properties:
       title: Connector response properties
       description: The properties vary depending on the connector type.
       oneOf:
+        - $ref: '#/components/schemas/connector_response_properties_bedrock'
         - $ref: '#/components/schemas/connector_response_properties_cases_webhook'
         - $ref: '#/components/schemas/connector_response_properties_d3security'
         - $ref: '#/components/schemas/connector_response_properties_email'
@@ -2868,6 +3101,20 @@ components:
         - $ref: '#/components/schemas/connector_response_properties_xmatters'
       discriminator:
         propertyName: connector_type_id
+    update_connector_request_bedrock:
+      title: Update Amazon Bedrock connector request
+      type: object
+      required:
+        - config
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_bedrock'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_bedrock'
     update_connector_request_cases_webhook:
       title: Update Webhook - Case Managment connector request
       type: object
@@ -3135,43 +3382,31 @@ components:
           description: The display name for the connector.
         secrets:
           $ref: '#/components/schemas/secrets_properties_xmatters'
-    connector_types:
-      title: Connector types
-      type: string
-      description: The type of connector. For example, `.email`, `.index`, `.jira`, `.opsgenie`, or `.server-log`.
-      enum:
-        - .bedrock
-        - .cases-webhook
-        - .d3security
-        - .email
-        - .gen-ai
-        - .index
-        - .jira
-        - .opsgenie
-        - .pagerduty
-        - .resilient
-        - .servicenow
-        - .servicenow-itom
-        - .servicenow-sir
-        - .server-log
-        - .slack
-        - .slack_api
-        - .swimlane
-        - .teams
-        - .tines
-        - .torq
-        - .webhook
-        - .xmatters
-      example: .server-log
-    features:
-      type: string
-      description: |
-        The feature that uses the connector. Valid values are `alerting`, `cases`, `uptime`, and `siem`.
-      enum:
-        - alerting
-        - cases
-        - uptime
-        - siem
+    update_connector_request:
+      title: Update connector request body properties
+      description: The properties vary depending on the connector type.
+      oneOf:
+        - $ref: '#/components/schemas/update_connector_request_bedrock'
+        - $ref: '#/components/schemas/update_connector_request_cases_webhook'
+        - $ref: '#/components/schemas/update_connector_request_d3security'
+        - $ref: '#/components/schemas/update_connector_request_email'
+        - $ref: '#/components/schemas/create_connector_request_genai'
+        - $ref: '#/components/schemas/update_connector_request_index'
+        - $ref: '#/components/schemas/update_connector_request_jira'
+        - $ref: '#/components/schemas/update_connector_request_opsgenie'
+        - $ref: '#/components/schemas/update_connector_request_pagerduty'
+        - $ref: '#/components/schemas/update_connector_request_resilient'
+        - $ref: '#/components/schemas/update_connector_request_serverlog'
+        - $ref: '#/components/schemas/update_connector_request_servicenow'
+        - $ref: '#/components/schemas/update_connector_request_servicenow_itom'
+        - $ref: '#/components/schemas/update_connector_request_slack_api'
+        - $ref: '#/components/schemas/update_connector_request_slack_webhook'
+        - $ref: '#/components/schemas/update_connector_request_swimlane'
+        - $ref: '#/components/schemas/update_connector_request_teams'
+        - $ref: '#/components/schemas/update_connector_request_tines'
+        - $ref: '#/components/schemas/update_connector_request_torq'
+        - $ref: '#/components/schemas/update_connector_request_webhook'
+        - $ref: '#/components/schemas/update_connector_request_xmatters'
     run_connector_params_documents:
       title: Index connector parameters
       description: Test an action that indexes a document into Elasticsearch.
@@ -3661,6 +3896,71 @@ components:
                 urgency:
                   type: string
                   description: The urgency of the incident for ServiceNow ITSM connectors.
+    run_connector_request:
+      title: Run connector request body properties
+      description: The properties vary depending on the connector type.
+      type: object
+      required:
+        - params
+      properties:
+        params:
+          oneOf:
+            - $ref: '#/components/schemas/run_connector_params_documents'
+            - $ref: '#/components/schemas/run_connector_params_level_message'
+            - title: Subaction parameters
+              description: Test an action that involves a subaction.
+              oneOf:
+                - $ref: '#/components/schemas/run_connector_subaction_addevent'
+                - $ref: '#/components/schemas/run_connector_subaction_closealert'
+                - $ref: '#/components/schemas/run_connector_subaction_createalert'
+                - $ref: '#/components/schemas/run_connector_subaction_fieldsbyissuetype'
+                - $ref: '#/components/schemas/run_connector_subaction_getchoices'
+                - $ref: '#/components/schemas/run_connector_subaction_getfields'
+                - $ref: '#/components/schemas/run_connector_subaction_getincident'
+                - $ref: '#/components/schemas/run_connector_subaction_issue'
+                - $ref: '#/components/schemas/run_connector_subaction_issues'
+                - $ref: '#/components/schemas/run_connector_subaction_issuetypes'
+                - $ref: '#/components/schemas/run_connector_subaction_pushtoservice'
+              discriminator:
+                propertyName: subAction
+    features:
+      type: string
+      description: |
+        The feature that uses the connector.
+      enum:
+        - alerting
+        - cases
+        - generativeAI
+        - siem
+        - uptime
+    connector_types:
+      title: Connector types
+      type: string
+      description: The type of connector. For example, `.email`, `.index`, `.jira`, `.opsgenie`, or `.server-log`.
+      enum:
+        - .bedrock
+        - .cases-webhook
+        - .d3security
+        - .email
+        - .gen-ai
+        - .index
+        - .jira
+        - .opsgenie
+        - .pagerduty
+        - .resilient
+        - .servicenow
+        - .servicenow-itom
+        - .servicenow-sir
+        - .server-log
+        - .slack
+        - .slack_api
+        - .swimlane
+        - .teams
+        - .tines
+        - .torq
+        - .webhook
+        - .xmatters
+      example: .server-log
     action_response_properties:
       title: Action response properties
       description: The properties vary depending on the action type.
@@ -3795,7 +4095,7 @@ components:
         is_missing_secrets: false
         is_system_action: false
     get_connector_response:
-      summary: A list of connector types
+      summary: Get connector details.
       value:
         id: df770e30-8b8b-11ed-a780-3b746c987a81
         name: my_server_log_connector
@@ -3811,60 +4111,6 @@ components:
         name: updated-connector
         config:
           index: updated-index
-    get_connectors_response:
-      summary: A list of connectors
-      value:
-        - id: preconfigured-email-connector
-          name: my-preconfigured-email-notification
-          connector_type_id: .email
-          is_preconfigured: true
-          is_deprecated: false
-          referenced_by_count: 0
-          is_system_action: false
-        - id: e07d0c80-8b8b-11ed-a780-3b746c987a81
-          name: my-index-connector
-          config:
-            index: test-index
-            refresh: false
-            executionTimeField: null
-          connector_type_id: .index
-          is_preconfigured: false
-          is_deprecated: false
-          referenced_by_count: 2
-          is_missing_secrets: false
-          is_system_action: false
-    get_connector_types_response:
-      summary: A list of connector types
-      value:
-        - id: .swimlane
-          name: Swimlane
-          enabled: true
-          enabled_in_config: true
-          enabled_in_license: true
-          minimum_license_required: gold
-          supported_feature_ids:
-            - alerting
-            - cases
-            - siem
-        - id: .index
-          name: Index
-          enabled: true
-          enabled_in_config: true
-          enabled_in_license: true
-          minimum_license_required: basic
-          supported_feature_ids:
-            - alerting
-            - uptime
-            - siem
-        - id: .server-log
-          name: Server log
-          enabled: true
-          enabled_in_config: true
-          enabled_in_license: true
-          minimum_license_required: basic
-          supported_feature_ids:
-            - alerting
-            - uptime
     run_index_connector_request:
       summary: Run an index connector.
       value:
@@ -4005,6 +4251,81 @@ components:
             - commentId: 1
               pushedDate: '2022-09-08T16:52:27.865Z'
         status: ok
+    get_connectors_response:
+      summary: A list of connectors
+      value:
+        - id: preconfigured-email-connector
+          name: my-preconfigured-email-notification
+          connector_type_id: .email
+          is_preconfigured: true
+          is_deprecated: false
+          referenced_by_count: 0
+          is_system_action: false
+        - id: e07d0c80-8b8b-11ed-a780-3b746c987a81
+          name: my-index-connector
+          config:
+            index: test-index
+            refresh: false
+            executionTimeField: null
+          connector_type_id: .index
+          is_preconfigured: false
+          is_deprecated: false
+          referenced_by_count: 2
+          is_missing_secrets: false
+          is_system_action: false
+    get_connector_types_generativeai_response:
+      summary: A list of connector types for the `generativeAI` feature.
+      value:
+        - id: .gen-ai
+          name: OpenAI
+          enabled: true
+          enabled_in_config: true
+          enabled_in_license: true
+          minimum_license_required: enterprise
+          supported_feature_ids:
+            - generativeAI
+          is_system_action_type: false
+        - id: .bedrock
+          name: AWS Bedrock
+          enabled: true
+          enabled_in_config: true
+          enabled_in_license: true
+          minimum_license_required: enterprise
+          supported_feature_ids:
+            - generativeAI
+          is_system_action_type: false
+    get_connector_types_response:
+      summary: A list of connector types
+      value:
+        - id: .swimlane
+          name: Swimlane
+          enabled: true
+          enabled_in_config: true
+          enabled_in_license: true
+          minimum_license_required: gold
+          supported_feature_ids:
+            - alerting
+            - cases
+            - siem
+        - id: .index
+          name: Index
+          enabled: true
+          enabled_in_config: true
+          enabled_in_license: true
+          minimum_license_required: basic
+          supported_feature_ids:
+            - alerting
+            - uptime
+            - siem
+        - id: .server-log
+          name: Server log
+          enabled: true
+          enabled_in_config: true
+          enabled_in_license: true
+          minimum_license_required: basic
+          supported_feature_ids:
+            - alerting
+            - uptime
   responses:
     '401':
       description: Authorization information is missing or invalid.
diff --git a/x-pack/plugins/actions/docs/openapi/bundled_serverless.json b/x-pack/plugins/actions/docs/openapi/bundled_serverless.json
new file mode 100644
index 0000000000000..25d7b7484ae8d
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/bundled_serverless.json
@@ -0,0 +1,4155 @@
+{
+  "openapi": "3.0.1",
+  "info": {
+    "title": "Connectors",
+    "description": "OpenAPI schema for connectors in Serverless projects",
+    "version": "0.1",
+    "contact": {
+      "name": "Connectors Team"
+    },
+    "license": {
+      "name": "Elastic License 2.0",
+      "url": "https://www.elastic.co/licensing/elastic-license"
+    }
+  },
+  "servers": [
+    {
+      "url": "http://localhost:5601",
+      "description": "local"
+    }
+  ],
+  "security": [
+    {
+      "apiKeyAuth": []
+    }
+  ],
+  "tags": [
+    {
+      "name": "connectors",
+      "description": "Connector APIs enable you to create and manage connectors."
+    }
+  ],
+  "paths": {
+    "/api/actions/connector": {
+      "post": {
+        "summary": "Creates a connector.",
+        "operationId": "createConnector",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/create_connector_request"
+              },
+              "examples": {
+                "createEmailConnectorRequest": {
+                  "$ref": "#/components/examples/create_email_connector_request"
+                },
+                "createIndexConnectorRequest": {
+                  "$ref": "#/components/examples/create_index_connector_request"
+                },
+                "createWebhookConnectorRequest": {
+                  "$ref": "#/components/examples/create_webhook_connector_request"
+                },
+                "createXmattersConnectorRequest": {
+                  "$ref": "#/components/examples/create_xmatters_connector_request"
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/connector_response_properties"
+                },
+                "examples": {
+                  "createEmailConnectorResponse": {
+                    "$ref": "#/components/examples/create_email_connector_response"
+                  },
+                  "createIndexConnectorResponse": {
+                    "$ref": "#/components/examples/create_index_connector_response"
+                  },
+                  "createWebhookConnectorResponse": {
+                    "$ref": "#/components/examples/create_webhook_connector_response"
+                  },
+                  "createXmattersConnectorResponse": {
+                    "$ref": "#/components/examples/create_xmatters_connector_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    },
+    "/api/actions/connector/{connectorId}": {
+      "get": {
+        "summary": "Retrieves a connector by ID.",
+        "operationId": "getConnector",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/connector_id"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/connector_response_properties"
+                },
+                "examples": {
+                  "getConnectorResponse": {
+                    "$ref": "#/components/examples/get_connector_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          },
+          "404": {
+            "$ref": "#/components/responses/404"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "delete": {
+        "summary": "Deletes a connector.",
+        "operationId": "deleteConnector",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "$ref": "#/components/parameters/connector_id"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Indicates a successful call."
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          },
+          "404": {
+            "$ref": "#/components/responses/404"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "post": {
+        "summary": "Creates a connector.",
+        "operationId": "createConnectorId",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "in": "path",
+            "name": "connectorId",
+            "description": "A UUID v1 or v4 identifier for the connector. If you omit this parameter, an identifier is randomly generated.\n",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "example": "ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/create_connector_request"
+              },
+              "examples": {
+                "createIndexConnectorRequest": {
+                  "$ref": "#/components/examples/create_index_connector_request"
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/connector_response_properties"
+                },
+                "examples": {
+                  "createIndexConnectorResponse": {
+                    "$ref": "#/components/examples/create_index_connector_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "put": {
+        "summary": "Updates the attributes for a connector.",
+        "operationId": "updateConnector",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/kbn_xsrf"
+          },
+          {
+            "$ref": "#/components/parameters/connector_id"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/update_connector_request"
+              },
+              "examples": {
+                "updateIndexConnectorRequest": {
+                  "$ref": "#/components/examples/update_index_connector_request"
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/connector_response_properties"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/401"
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          },
+          "404": {
+            "$ref": "#/components/responses/404"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    },
+    "/api/actions/connectors": {
+      "get": {
+        "summary": "Retrieves all connectors.",
+        "operationId": "getConnectors",
+        "tags": [
+          "connectors"
+        ],
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/connector_response_properties"
+                  }
+                },
+                "examples": {
+                  "getConnectorsResponse": {
+                    "$ref": "#/components/examples/get_connectors_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    },
+    "/api/actions/connector_types": {
+      "get": {
+        "summary": "Retrieves a list of all connector types.",
+        "operationId": "getConnectorTypes",
+        "tags": [
+          "connectors"
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "feature_id",
+            "description": "A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).",
+            "schema": {
+              "$ref": "#/components/schemas/features"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "title": "Get connector types response body properties",
+                  "description": "The properties vary for each connector type.",
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "enabled": {
+                        "type": "boolean",
+                        "description": "Indicates whether the connector type is enabled in Kibana.",
+                        "example": true
+                      },
+                      "enabled_in_config": {
+                        "type": "boolean",
+                        "description": "Indicates whether the connector type is enabled in the Kibana configuration file.",
+                        "example": true
+                      },
+                      "enabled_in_license": {
+                        "type": "boolean",
+                        "description": "Indicates whether the connector is enabled in the license.",
+                        "example": true
+                      },
+                      "id": {
+                        "$ref": "#/components/schemas/connector_types"
+                      },
+                      "is_system_action_type": {
+                        "type": "boolean",
+                        "example": false
+                      },
+                      "minimum_license_required": {
+                        "type": "string",
+                        "description": "The license that is required to use the connector type.",
+                        "example": "basic"
+                      },
+                      "name": {
+                        "type": "string",
+                        "description": "The name of the connector type.",
+                        "example": "Index"
+                      },
+                      "supported_feature_ids": {
+                        "type": "array",
+                        "description": "The features that are supported by the connector type.",
+                        "items": {
+                          "$ref": "#/components/schemas/features"
+                        },
+                        "example": [
+                          "alerting",
+                          "cases",
+                          "siem"
+                        ]
+                      }
+                    }
+                  }
+                },
+                "examples": {
+                  "getConnectorTypesServerlessResponse": {
+                    "$ref": "#/components/examples/get_connector_types_generativeai_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/401"
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "apiKeyAuth": {
+        "type": "apiKey",
+        "in": "header",
+        "name": "ApiKey"
+      }
+    },
+    "parameters": {
+      "kbn_xsrf": {
+        "schema": {
+          "type": "string"
+        },
+        "in": "header",
+        "name": "kbn-xsrf",
+        "description": "Cross-site request forgery protection",
+        "required": true
+      },
+      "connector_id": {
+        "in": "path",
+        "name": "connectorId",
+        "description": "An identifier for the connector.",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "example": "df770e30-8b8b-11ed-a780-3b746c987a81"
+        }
+      }
+    },
+    "schemas": {
+      "config_properties_bedrock": {
+        "title": "Connector request properties for an Amazon Bedrock connector",
+        "description": "Defines properties for connectors when type is `.bedrock`.",
+        "type": "object",
+        "required": [
+          "apiUrl"
+        ],
+        "properties": {
+          "apiUrl": {
+            "type": "string",
+            "description": "The Amazon Bedrock request URL."
+          },
+          "defaultModel": {
+            "type": "string",
+            "description": "The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.\n",
+            "default": "anthropic.claude-v2"
+          }
+        }
+      },
+      "secrets_properties_bedrock": {
+        "title": "Connector secrets properties for an Amazon Bedrock connector",
+        "description": "Defines secrets for connectors when type is `.bedrock`.",
+        "type": "object",
+        "required": [
+          "accessKey",
+          "secret"
+        ],
+        "properties": {
+          "accessKey": {
+            "type": "string",
+            "description": "The AWS access key for authentication."
+          },
+          "secret": {
+            "type": "string",
+            "description": "The AWS secret for authentication."
+          }
+        }
+      },
+      "create_connector_request_bedrock": {
+        "title": "Create Amazon Bedrock connector request",
+        "description": "The Amazon Bedrock connector uses axios to send a POST request to Amazon Bedrock.",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_bedrock"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".bedrock"
+            ],
+            "example": ".bedrock"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_bedrock"
+          }
+        }
+      },
+      "config_properties_cases_webhook": {
+        "title": "Connector request properties for Webhook - Case Management connector",
+        "required": [
+          "createIncidentJson",
+          "createIncidentResponseKey",
+          "createIncidentUrl",
+          "getIncidentResponseExternalTitleKey",
+          "getIncidentUrl",
+          "updateIncidentJson",
+          "updateIncidentUrl",
+          "viewIncidentUrl"
+        ],
+        "description": "Defines properties for connectors when type is `.cases-webhook`.",
+        "type": "object",
+        "properties": {
+          "createCommentJson": {
+            "type": "string",
+            "description": "A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n",
+            "example": {
+              "body": {
+                "[object Object]": null
+              }
+            }
+          },
+          "createCommentMethod": {
+            "type": "string",
+            "description": "The REST API HTTP request method to create a case comment in the third-party system. Valid values are `patch`, `post`, and `put`.\n",
+            "default": "put",
+            "enum": [
+              "patch",
+              "post",
+              "put"
+            ]
+          },
+          "createCommentUrl": {
+            "type": "string",
+            "description": "The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts setting`, add the hostname to the allowed hosts.\n",
+            "example": "https://testing-jira.atlassian.net/rest/api/2/issue/{{{external.system.id}}}/comment"
+          },
+          "createIncidentJson": {
+            "type": "string",
+            "description": "A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n",
+            "example": {
+              "fields": {
+                "summary": {
+                  "[object Object]": null
+                },
+                "description": {
+                  "[object Object]": null
+                },
+                "labels": {
+                  "[object Object]": null
+                }
+              }
+            }
+          },
+          "createIncidentMethod": {
+            "type": "string",
+            "description": "The REST API HTTP request method to create a case in the third-party system. Valid values are `patch`, `post`, and `put`.\n",
+            "enum": [
+              "patch",
+              "post",
+              "put"
+            ],
+            "default": "post"
+          },
+          "createIncidentResponseKey": {
+            "type": "string",
+            "description": "The JSON key in the create case response that contains the external case ID."
+          },
+          "createIncidentUrl": {
+            "type": "string",
+            "description": "The REST API URL to create a case in the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
+          },
+          "getIncidentResponseExternalTitleKey": {
+            "type": "string",
+            "description": "The JSON key in get case response that contains the external case title."
+          },
+          "getIncidentUrl": {
+            "type": "string",
+            "description": "The REST API URL to get the case by ID from the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n",
+            "example": "https://testing-jira.atlassian.net/rest/api/2/issue/{{{external.system.id}}}"
+          },
+          "hasAuth": {
+            "type": "boolean",
+            "description": "If true, a username and password for login type authentication must be provided.",
+            "default": true
+          },
+          "headers": {
+            "type": "string",
+            "description": "A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.\n"
+          },
+          "updateIncidentJson": {
+            "type": "string",
+            "description": "The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n",
+            "example": {
+              "fields": {
+                "summary": {
+                  "[object Object]": null
+                },
+                "description": {
+                  "[object Object]": null
+                },
+                "labels": {
+                  "[object Object]": null
+                }
+              }
+            }
+          },
+          "updateIncidentMethod": {
+            "type": "string",
+            "description": "The REST API HTTP request method to update the case in the third-party system. Valid values are `patch`, `post`, and `put`.\n",
+            "default": "put",
+            "enum": [
+              "patch",
+              "post",
+              "put"
+            ]
+          },
+          "updateIncidentUrl": {
+            "type": "string",
+            "description": "The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n",
+            "example": "https://testing-jira.atlassian.net/rest/api/2/issue/{{{external.system.ID}}}"
+          },
+          "viewIncidentUrl": {
+            "type": "string",
+            "description": "The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.\n",
+            "example": "https://testing-jira.atlassian.net/browse/{{{external.system.title}}}"
+          }
+        }
+      },
+      "secrets_properties_cases_webhook": {
+        "title": "Connector secrets properties for Webhook - Case Management connector",
+        "type": "object",
+        "properties": {
+          "password": {
+            "type": "string",
+            "description": "The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required."
+          },
+          "user": {
+            "type": "string",
+            "description": "The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required."
+          }
+        }
+      },
+      "create_connector_request_cases_webhook": {
+        "title": "Create Webhook - Case Managment connector request",
+        "description": "The Webhook - Case Management connector uses axios to send POST, PUT, and GET requests to a case management RESTful API web service.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_cases_webhook"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".cases-webhook"
+            ],
+            "example": ".cases-webhook"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_cases_webhook"
+          }
+        }
+      },
+      "config_properties_d3security": {
+        "title": "Connector request properties for a D3 Security connector",
+        "description": "Defines properties for connectors when type is `.d3security`.",
+        "type": "object",
+        "required": [
+          "url"
+        ],
+        "properties": {
+          "url": {
+            "type": "string",
+            "description": "The D3 Security API request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
+          }
+        }
+      },
+      "secrets_properties_d3security": {
+        "title": "Connector secrets properties for a D3 Security connector",
+        "description": "Defines secrets for connectors when type is `.d3security`.",
+        "required": [
+          "token"
+        ],
+        "type": "object",
+        "properties": {
+          "token": {
+            "type": "string",
+            "description": "The D3 Security token."
+          }
+        }
+      },
+      "create_connector_request_d3security": {
+        "title": "Create D3 Security connector request",
+        "description": "The connector uses axios to send a POST request to a D3 Security endpoint.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_d3security"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".d3security"
+            ],
+            "example": ".d3security"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_d3security"
+          }
+        }
+      },
+      "config_properties_email": {
+        "title": "Connector request properties for an email connector",
+        "description": "Defines properties for connectors when type is `.email`.",
+        "required": [
+          "from"
+        ],
+        "type": "object",
+        "properties": {
+          "clientId": {
+            "description": "The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n",
+            "type": "string",
+            "nullable": true
+          },
+          "from": {
+            "description": "The from address for all emails sent by the connector. It must be specified in `user@host-name` format.\n",
+            "type": "string"
+          },
+          "hasAuth": {
+            "description": "Specifies whether a user and password are required inside the secrets configuration.\n",
+            "default": true,
+            "type": "boolean"
+          },
+          "host": {
+            "description": "The host name of the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined. \n",
+            "type": "string"
+          },
+          "oauthTokenUrl": {
+            "type": "string",
+            "nullable": true
+          },
+          "port": {
+            "description": "The port to connect to on the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined. \n",
+            "type": "integer"
+          },
+          "secure": {
+            "description": "Specifies whether the connection to the service provider will use TLS. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.\n",
+            "type": "boolean"
+          },
+          "service": {
+            "description": "The name of the email service.\n",
+            "type": "string",
+            "enum": [
+              "elastic_cloud",
+              "exchange_server",
+              "gmail",
+              "other",
+              "outlook365",
+              "ses"
+            ]
+          },
+          "tenantId": {
+            "description": "The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n",
+            "type": "string",
+            "nullable": true
+          }
+        }
+      },
+      "secrets_properties_email": {
+        "title": "Connector secrets properties for an email connector",
+        "description": "Defines secrets for connectors when type is `.email`.",
+        "type": "object",
+        "properties": {
+          "clientSecret": {
+            "type": "string",
+            "description": "The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If `service` is `exchange_server`, this property is required.\n"
+          },
+          "password": {
+            "type": "string",
+            "description": "The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n"
+          },
+          "user": {
+            "type": "string",
+            "description": "The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n"
+          }
+        }
+      },
+      "create_connector_request_email": {
+        "title": "Create email connector request",
+        "description": "The email connector uses the SMTP protocol to send mail messages, using an integration of Nodemailer. An exception is Microsoft Exchange, which uses HTTP protocol for sending emails, Send mail. Email message text is sent as both plain text and html text.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_email"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".email"
+            ],
+            "example": ".email"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_email"
+          }
+        }
+      },
+      "config_properties_genai": {
+        "title": "Connector request properties for an OpenAI connector",
+        "description": "Defines properties for connectors when type is `.gen-ai`.",
+        "oneOf": [
+          {
+            "type": "object",
+            "required": [
+              "apiProvider",
+              "apiUrl"
+            ],
+            "properties": {
+              "apiProvider": {
+                "type": "string",
+                "description": "The OpenAI API provider.",
+                "enum": [
+                  "Azure OpenAI"
+                ]
+              },
+              "apiUrl": {
+                "type": "string",
+                "description": "The OpenAI API endpoint."
+              }
+            }
+          },
+          {
+            "type": "object",
+            "required": [
+              "apiProvider",
+              "apiUrl"
+            ],
+            "properties": {
+              "apiProvider": {
+                "type": "string",
+                "description": "The OpenAI API provider.",
+                "enum": [
+                  "OpenAI"
+                ]
+              },
+              "apiUrl": {
+                "type": "string",
+                "description": "The OpenAI API endpoint."
+              },
+              "defaultModel": {
+                "type": "string",
+                "description": "The default model to use for requests."
+              }
+            }
+          }
+        ],
+        "discriminator": {
+          "propertyName": "apiProvider"
+        }
+      },
+      "secrets_properties_genai": {
+        "title": "Connector secrets properties for an OpenAI connector",
+        "description": "Defines secrets for connectors when type is `.gen-ai`.",
+        "type": "object",
+        "properties": {
+          "apiKey": {
+            "type": "string",
+            "description": "The OpenAI API key."
+          }
+        }
+      },
+      "create_connector_request_genai": {
+        "title": "Create OpenAI connector request",
+        "description": "The OpenAI connector uses axios to send a POST request to either OpenAI or Azure OpenAPI.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_genai"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".gen-ai"
+            ],
+            "example": ".gen-ai"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_genai"
+          }
+        }
+      },
+      "config_properties_index": {
+        "title": "Connector request properties for an index connector",
+        "required": [
+          "index"
+        ],
+        "description": "Defines properties for connectors when type is `.index`.",
+        "type": "object",
+        "properties": {
+          "executionTimeField": {
+            "description": "A field that indicates when the document was indexed.",
+            "default": null,
+            "type": "string",
+            "nullable": true
+          },
+          "index": {
+            "description": "The Elasticsearch index to be written to.",
+            "type": "string"
+          },
+          "refresh": {
+            "description": "The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.\n",
+            "default": false,
+            "type": "boolean"
+          }
+        }
+      },
+      "create_connector_request_index": {
+        "title": "Create index connector request",
+        "description": "The index connector indexes a document into Elasticsearch.",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_index"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".index"
+            ],
+            "example": ".index"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          }
+        }
+      },
+      "config_properties_jira": {
+        "title": "Connector request properties for a Jira connector",
+        "required": [
+          "apiUrl",
+          "projectKey"
+        ],
+        "description": "Defines properties for connectors when type is `.jira`.",
+        "type": "object",
+        "properties": {
+          "apiUrl": {
+            "description": "The Jira instance URL.",
+            "type": "string"
+          },
+          "projectKey": {
+            "description": "The Jira project key.",
+            "type": "string"
+          }
+        }
+      },
+      "secrets_properties_jira": {
+        "title": "Connector secrets properties for a Jira connector",
+        "required": [
+          "apiToken",
+          "email"
+        ],
+        "description": "Defines secrets for connectors when type is `.jira`.",
+        "type": "object",
+        "properties": {
+          "apiToken": {
+            "description": "The Jira API authentication token for HTTP basic authentication.",
+            "type": "string"
+          },
+          "email": {
+            "description": "The account email for HTTP Basic authentication.",
+            "type": "string"
+          }
+        }
+      },
+      "create_connector_request_jira": {
+        "title": "Create Jira connector request",
+        "description": "The Jira connector uses the REST API v2 to create Jira issues.",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_jira"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".jira"
+            ],
+            "example": ".jira"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_jira"
+          }
+        }
+      },
+      "config_properties_opsgenie": {
+        "title": "Connector request properties for an Opsgenie connector",
+        "required": [
+          "apiUrl"
+        ],
+        "description": "Defines properties for connectors when type is `.opsgenie`.",
+        "type": "object",
+        "properties": {
+          "apiUrl": {
+            "description": "The Opsgenie URL. For example, `https://api.opsgenie.com` or `https://api.eu.opsgenie.com`. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n",
+            "type": "string"
+          }
+        }
+      },
+      "secrets_properties_opsgenie": {
+        "title": "Connector secrets properties for an Opsgenie connector",
+        "required": [
+          "apiKey"
+        ],
+        "description": "Defines secrets for connectors when type is `.opsgenie`.",
+        "type": "object",
+        "properties": {
+          "apiKey": {
+            "description": "The Opsgenie API authentication key for HTTP Basic authentication.",
+            "type": "string"
+          }
+        }
+      },
+      "create_connector_request_opsgenie": {
+        "title": "Create Opsgenie connector request",
+        "description": "The Opsgenie connector uses the Opsgenie alert API.",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_opsgenie"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".opsgenie"
+            ],
+            "example": ".opsgenie"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_opsgenie"
+          }
+        }
+      },
+      "config_properties_pagerduty": {
+        "title": "Connector request properties for a PagerDuty connector",
+        "description": "Defines properties for connectors when type is `.pagerduty`.",
+        "type": "object",
+        "properties": {
+          "apiUrl": {
+            "description": "The PagerDuty event URL.",
+            "type": "string",
+            "nullable": true,
+            "example": "https://events.pagerduty.com/v2/enqueue"
+          }
+        }
+      },
+      "secrets_properties_pagerduty": {
+        "title": "Connector secrets properties for a PagerDuty connector",
+        "description": "Defines secrets for connectors when type is `.pagerduty`.",
+        "type": "object",
+        "required": [
+          "routingKey"
+        ],
+        "properties": {
+          "routingKey": {
+            "description": "A 32 character PagerDuty Integration Key for an integration on a service.\n",
+            "type": "string"
+          }
+        }
+      },
+      "create_connector_request_pagerduty": {
+        "title": "Create PagerDuty connector request",
+        "description": "The PagerDuty connector uses the v2 Events API to trigger, acknowledge, and resolve PagerDuty alerts.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_pagerduty"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".pagerduty"
+            ],
+            "example": ".pagerduty"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_pagerduty"
+          }
+        }
+      },
+      "config_properties_resilient": {
+        "title": "Connector request properties for a IBM Resilient connector",
+        "required": [
+          "apiUrl",
+          "orgId"
+        ],
+        "description": "Defines properties for connectors when type is `.resilient`.",
+        "type": "object",
+        "properties": {
+          "apiUrl": {
+            "description": "The IBM Resilient instance URL.",
+            "type": "string"
+          },
+          "orgId": {
+            "description": "The IBM Resilient organization ID.",
+            "type": "string"
+          }
+        }
+      },
+      "secrets_properties_resilient": {
+        "title": "Connector secrets properties for IBM Resilient connector",
+        "required": [
+          "apiKeyId",
+          "apiKeySecret"
+        ],
+        "description": "Defines secrets for connectors when type is `.resilient`.",
+        "type": "object",
+        "properties": {
+          "apiKeyId": {
+            "type": "string",
+            "description": "The authentication key ID for HTTP Basic authentication."
+          },
+          "apiKeySecret": {
+            "type": "string",
+            "description": "The authentication key secret for HTTP Basic authentication."
+          }
+        }
+      },
+      "create_connector_request_resilient": {
+        "title": "Create IBM Resilient connector request",
+        "description": "The IBM Resilient connector uses the RESILIENT REST v2 to create IBM Resilient incidents.",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_resilient"
+          },
+          "connector_type_id": {
+            "description": "The type of connector.",
+            "type": "string",
+            "example": ".resilient",
+            "enum": [
+              ".resilient"
+            ]
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_resilient"
+          }
+        }
+      },
+      "create_connector_request_serverlog": {
+        "title": "Create server log connector request",
+        "description": "This connector writes an entry to the Kibana server log.",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "name"
+        ],
+        "properties": {
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".server-log"
+            ],
+            "example": ".server-log"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          }
+        }
+      },
+      "config_properties_servicenow": {
+        "title": "Connector request properties for a ServiceNow ITSM connector",
+        "required": [
+          "apiUrl"
+        ],
+        "description": "Defines properties for connectors when type is `.servicenow`.",
+        "type": "object",
+        "properties": {
+          "apiUrl": {
+            "type": "string",
+            "description": "The ServiceNow instance URL."
+          },
+          "clientId": {
+            "description": "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n",
+            "type": "string"
+          },
+          "isOAuth": {
+            "description": "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n",
+            "default": false,
+            "type": "boolean"
+          },
+          "jwtKeyId": {
+            "description": "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n",
+            "type": "string"
+          },
+          "userIdentifierValue": {
+            "description": "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n",
+            "type": "string"
+          },
+          "usesTableApi": {
+            "description": "Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors.  NOTE: If this property is set to `false`, the Elastic application should be installed in ServiceNow.\n",
+            "default": true,
+            "type": "boolean"
+          }
+        }
+      },
+      "secrets_properties_servicenow": {
+        "title": "Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors",
+        "description": "Defines secrets for connectors when type is `.servicenow`, `.servicenow-sir`, or `.servicenow-itom`.",
+        "type": "object",
+        "properties": {
+          "clientSecret": {
+            "type": "string",
+            "description": "The client secret assigned to your OAuth application. This property is required when `isOAuth` is `true`."
+          },
+          "password": {
+            "type": "string",
+            "description": "The password for HTTP basic authentication. This property is required when `isOAuth` is `false`."
+          },
+          "privateKey": {
+            "type": "string",
+            "description": "The RSA private key that you created for use in ServiceNow. This property is required when `isOAuth` is `true`."
+          },
+          "privateKeyPassword": {
+            "type": "string",
+            "description": "The password for the RSA private key. This property is required when `isOAuth` is `true` and you set a password on your private key."
+          },
+          "username": {
+            "type": "string",
+            "description": "The username for HTTP basic authentication. This property is required when `isOAuth` is `false`."
+          }
+        }
+      },
+      "create_connector_request_servicenow": {
+        "title": "Create ServiceNow ITSM connector request",
+        "description": "The ServiceNow ITSM connector uses the import set API to create ServiceNow incidents. You can use the connector for rule actions and cases.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_servicenow"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".servicenow"
+            ],
+            "example": ".servicenow"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_servicenow"
+          }
+        }
+      },
+      "config_properties_servicenow_itom": {
+        "title": "Connector request properties for a ServiceNow ITSM connector",
+        "required": [
+          "apiUrl"
+        ],
+        "description": "Defines properties for connectors when type is `.servicenow`.",
+        "type": "object",
+        "properties": {
+          "apiUrl": {
+            "type": "string",
+            "description": "The ServiceNow instance URL."
+          },
+          "clientId": {
+            "description": "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n",
+            "type": "string"
+          },
+          "isOAuth": {
+            "description": "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n",
+            "default": false,
+            "type": "boolean"
+          },
+          "jwtKeyId": {
+            "description": "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n",
+            "type": "string"
+          },
+          "userIdentifierValue": {
+            "description": "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n",
+            "type": "string"
+          }
+        }
+      },
+      "create_connector_request_servicenow_itom": {
+        "title": "Create ServiceNow ITOM connector request",
+        "description": "The ServiceNow ITOM connector uses the event API to create ServiceNow events. You can use the connector for rule actions.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_servicenow_itom"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".servicenow-itom"
+            ],
+            "example": ".servicenow-itom"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_servicenow"
+          }
+        }
+      },
+      "create_connector_request_servicenow_sir": {
+        "title": "Create ServiceNow SecOps connector request",
+        "description": "The ServiceNow SecOps connector uses the import set API to create ServiceNow security incidents. You can use the connector for rule actions and cases.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_servicenow"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".servicenow-sir"
+            ],
+            "example": ".servicenow-sir"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_servicenow"
+          }
+        }
+      },
+      "secrets_properties_slack_api": {
+        "title": "Connector secrets properties for a Web API Slack connector",
+        "description": "Defines secrets for connectors when type is `.slack`.",
+        "required": [
+          "token"
+        ],
+        "type": "object",
+        "properties": {
+          "token": {
+            "type": "string",
+            "description": "Slack bot user OAuth token."
+          }
+        }
+      },
+      "create_connector_request_slack_api": {
+        "title": "Create Slack connector request",
+        "description": "The Slack connector uses Slack Incoming Webhooks.",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".slack_api"
+            ],
+            "example": ".slack_api"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_slack_api"
+          }
+        }
+      },
+      "secrets_properties_slack_webhook": {
+        "title": "Connector secrets properties for a Webhook Slack connector",
+        "description": "Defines secrets for connectors when type is `.slack`.",
+        "required": [
+          "webhookUrl"
+        ],
+        "type": "object",
+        "properties": {
+          "webhookUrl": {
+            "type": "string",
+            "description": "Slack webhook url."
+          }
+        }
+      },
+      "create_connector_request_slack_webhook": {
+        "title": "Create Slack connector request",
+        "description": "The Slack connector uses Slack Incoming Webhooks.",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".slack"
+            ],
+            "example": ".slack"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_slack_webhook"
+          }
+        }
+      },
+      "config_properties_swimlane": {
+        "title": "Connector request properties for a Swimlane connector",
+        "required": [
+          "apiUrl",
+          "appId",
+          "connectorType"
+        ],
+        "description": "Defines properties for connectors when type is `.swimlane`.",
+        "type": "object",
+        "properties": {
+          "apiUrl": {
+            "description": "The Swimlane instance URL.",
+            "type": "string"
+          },
+          "appId": {
+            "description": "The Swimlane application ID.",
+            "type": "string"
+          },
+          "connectorType": {
+            "description": "The type of connector. Valid values are `all`, `alerts`, and `cases`.",
+            "type": "string",
+            "enum": [
+              "all",
+              "alerts",
+              "cases"
+            ]
+          },
+          "mappings": {
+            "title": "Connector mappings properties for a Swimlane connector",
+            "description": "The field mapping.",
+            "type": "object",
+            "properties": {
+              "alertIdConfig": {
+                "title": "Alert identifier mapping",
+                "description": "Mapping for the alert ID.",
+                "type": "object",
+                "required": [
+                  "fieldType",
+                  "id",
+                  "key",
+                  "name"
+                ],
+                "properties": {
+                  "fieldType": {
+                    "type": "string",
+                    "description": "The type of field in Swimlane."
+                  },
+                  "id": {
+                    "type": "string",
+                    "description": "The identifier for the field in Swimlane."
+                  },
+                  "key": {
+                    "type": "string",
+                    "description": "The key for the field in Swimlane."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "The name of the field in Swimlane."
+                  }
+                }
+              },
+              "caseIdConfig": {
+                "title": "Case identifier mapping",
+                "description": "Mapping for the case ID.",
+                "type": "object",
+                "required": [
+                  "fieldType",
+                  "id",
+                  "key",
+                  "name"
+                ],
+                "properties": {
+                  "fieldType": {
+                    "type": "string",
+                    "description": "The type of field in Swimlane."
+                  },
+                  "id": {
+                    "type": "string",
+                    "description": "The identifier for the field in Swimlane."
+                  },
+                  "key": {
+                    "type": "string",
+                    "description": "The key for the field in Swimlane."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "The name of the field in Swimlane."
+                  }
+                }
+              },
+              "caseNameConfig": {
+                "title": "Case name mapping",
+                "description": "Mapping for the case name.",
+                "type": "object",
+                "required": [
+                  "fieldType",
+                  "id",
+                  "key",
+                  "name"
+                ],
+                "properties": {
+                  "fieldType": {
+                    "type": "string",
+                    "description": "The type of field in Swimlane."
+                  },
+                  "id": {
+                    "type": "string",
+                    "description": "The identifier for the field in Swimlane."
+                  },
+                  "key": {
+                    "type": "string",
+                    "description": "The key for the field in Swimlane."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "The name of the field in Swimlane."
+                  }
+                }
+              },
+              "commentsConfig": {
+                "title": "Case comment mapping",
+                "description": "Mapping for the case comments.",
+                "type": "object",
+                "required": [
+                  "fieldType",
+                  "id",
+                  "key",
+                  "name"
+                ],
+                "properties": {
+                  "fieldType": {
+                    "type": "string",
+                    "description": "The type of field in Swimlane."
+                  },
+                  "id": {
+                    "type": "string",
+                    "description": "The identifier for the field in Swimlane."
+                  },
+                  "key": {
+                    "type": "string",
+                    "description": "The key for the field in Swimlane."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "The name of the field in Swimlane."
+                  }
+                }
+              },
+              "descriptionConfig": {
+                "title": "Case description mapping",
+                "description": "Mapping for the case description.",
+                "type": "object",
+                "required": [
+                  "fieldType",
+                  "id",
+                  "key",
+                  "name"
+                ],
+                "properties": {
+                  "fieldType": {
+                    "type": "string",
+                    "description": "The type of field in Swimlane."
+                  },
+                  "id": {
+                    "type": "string",
+                    "description": "The identifier for the field in Swimlane."
+                  },
+                  "key": {
+                    "type": "string",
+                    "description": "The key for the field in Swimlane."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "The name of the field in Swimlane."
+                  }
+                }
+              },
+              "ruleNameConfig": {
+                "title": "Rule name mapping",
+                "description": "Mapping for the name of the alert's rule.",
+                "type": "object",
+                "required": [
+                  "fieldType",
+                  "id",
+                  "key",
+                  "name"
+                ],
+                "properties": {
+                  "fieldType": {
+                    "type": "string",
+                    "description": "The type of field in Swimlane."
+                  },
+                  "id": {
+                    "type": "string",
+                    "description": "The identifier for the field in Swimlane."
+                  },
+                  "key": {
+                    "type": "string",
+                    "description": "The key for the field in Swimlane."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "The name of the field in Swimlane."
+                  }
+                }
+              },
+              "severityConfig": {
+                "title": "Severity mapping",
+                "description": "Mapping for the severity.",
+                "type": "object",
+                "required": [
+                  "fieldType",
+                  "id",
+                  "key",
+                  "name"
+                ],
+                "properties": {
+                  "fieldType": {
+                    "type": "string",
+                    "description": "The type of field in Swimlane."
+                  },
+                  "id": {
+                    "type": "string",
+                    "description": "The identifier for the field in Swimlane."
+                  },
+                  "key": {
+                    "type": "string",
+                    "description": "The key for the field in Swimlane."
+                  },
+                  "name": {
+                    "type": "string",
+                    "description": "The name of the field in Swimlane."
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "secrets_properties_swimlane": {
+        "title": "Connector secrets properties for a Swimlane connector",
+        "description": "Defines secrets for connectors when type is `.swimlane`.",
+        "type": "object",
+        "properties": {
+          "apiToken": {
+            "description": "Swimlane API authentication token.",
+            "type": "string"
+          }
+        }
+      },
+      "create_connector_request_swimlane": {
+        "title": "Create Swimlane connector request",
+        "description": "The Swimlane connector uses the Swimlane REST API to create Swimlane records.",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_swimlane"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".swimlane"
+            ],
+            "example": ".swimlane"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_swimlane"
+          }
+        }
+      },
+      "secrets_properties_teams": {
+        "title": "Connector secrets properties for a Microsoft Teams connector",
+        "description": "Defines secrets for connectors when type is `.teams`.",
+        "type": "object",
+        "required": [
+          "webhookUrl"
+        ],
+        "properties": {
+          "webhookUrl": {
+            "type": "string",
+            "description": "The URL of the incoming webhook. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
+          }
+        }
+      },
+      "create_connector_request_teams": {
+        "title": "Create Microsoft Teams connector request",
+        "description": "The Microsoft Teams connector uses Incoming Webhooks.",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".teams"
+            ],
+            "example": ".teams"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_teams"
+          }
+        }
+      },
+      "config_properties_tines": {
+        "title": "Connector request properties for a Tines connector",
+        "description": "Defines properties for connectors when type is `.tines`.",
+        "type": "object",
+        "required": [
+          "url"
+        ],
+        "properties": {
+          "url": {
+            "description": "The Tines tenant URL. If you are using the `xpack.actions.allowedHosts` setting, make sure this hostname is added to the allowed hosts.\n",
+            "type": "string"
+          }
+        }
+      },
+      "secrets_properties_tines": {
+        "title": "Connector secrets properties for a Tines connector",
+        "description": "Defines secrets for connectors when type is `.tines`.",
+        "type": "object",
+        "required": [
+          "email",
+          "token"
+        ],
+        "properties": {
+          "email": {
+            "description": "The email used to sign in to Tines.",
+            "type": "string"
+          },
+          "token": {
+            "description": "The Tines API token.",
+            "type": "string"
+          }
+        }
+      },
+      "create_connector_request_tines": {
+        "title": "Create Tines connector request",
+        "description": "The Tines connector uses Tines Webhook actions to send events via POST request.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_tines"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".tines"
+            ],
+            "example": ".tines"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_tines"
+          }
+        }
+      },
+      "config_properties_torq": {
+        "title": "Connector request properties for a Torq connector",
+        "description": "Defines properties for connectors when type is `.torq`.",
+        "type": "object",
+        "required": [
+          "webhookIntegrationUrl"
+        ],
+        "properties": {
+          "webhookIntegrationUrl": {
+            "description": "The endpoint URL of the Elastic Security integration in Torq.",
+            "type": "string"
+          }
+        }
+      },
+      "secrets_properties_torq": {
+        "title": "Connector secrets properties for a Torq connector",
+        "description": "Defines secrets for connectors when type is `.torq`.",
+        "type": "object",
+        "required": [
+          "token"
+        ],
+        "properties": {
+          "token": {
+            "description": "The secret of the webhook authentication header.",
+            "type": "string"
+          }
+        }
+      },
+      "create_connector_request_torq": {
+        "title": "Create Torq connector request",
+        "description": "The Torq connector uses a Torq webhook to trigger workflows with Kibana actions.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_torq"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".torq"
+            ],
+            "example": ".torq"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_torq"
+          }
+        }
+      },
+      "config_properties_webhook": {
+        "title": "Connector request properties for a Webhook connector",
+        "description": "Defines properties for connectors when type is `.webhook`.",
+        "type": "object",
+        "properties": {
+          "authType": {
+            "type": "string",
+            "enum": [
+              "webhook-authentication-basic",
+              "webhook-authentication-ssl",
+              "null"
+            ],
+            "description": "The type of authentication to use: basic, SSL, or none.\n"
+          },
+          "ca": {
+            "type": "string",
+            "description": "A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.\n"
+          },
+          "certType": {
+            "type": "string",
+            "description": "If the `authType` is `webhook-authentication-ssl`, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.\n",
+            "enum": [
+              "ssl-crt-key",
+              "ssl-pfx"
+            ]
+          },
+          "hasAuth": {
+            "type": "boolean",
+            "description": "If `true`, a user name and password must be provided for login type authentication.\n"
+          },
+          "headers": {
+            "type": "object",
+            "nullable": true,
+            "description": "A set of key-value pairs sent as headers with the request."
+          },
+          "method": {
+            "type": "string",
+            "default": "post",
+            "enum": [
+              "post",
+              "put"
+            ],
+            "description": "The HTTP request method, either `post` or `put`.\n"
+          },
+          "url": {
+            "type": "string",
+            "description": "The request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
+          },
+          "verificationMode": {
+            "type": "string",
+            "enum": [
+              "certificate",
+              "full",
+              "none"
+            ],
+            "default": "full",
+            "description": "Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation.\n"
+          }
+        }
+      },
+      "secrets_properties_webhook": {
+        "title": "Connector secrets properties for a Webhook connector",
+        "description": "Defines secrets for connectors when type is `.webhook`.",
+        "type": "object",
+        "properties": {
+          "crt": {
+            "type": "string",
+            "description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the CRT or CERT file."
+          },
+          "key": {
+            "type": "string",
+            "description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the KEY file."
+          },
+          "pfx": {
+            "type": "string",
+            "description": "If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-pfx`, it is a base64 encoded version of the PFX or P12 file."
+          },
+          "password": {
+            "type": "string",
+            "description": "The password for HTTP basic authentication or the passphrase for the SSL certificate files. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
+          },
+          "user": {
+            "type": "string",
+            "description": "The username for HTTP basic authentication. If `hasAuth` is set to `true`  and `authType` is `webhook-authentication-basic`, this property is required.\n"
+          }
+        }
+      },
+      "create_connector_request_webhook": {
+        "title": "Create Webhook connector request",
+        "description": "The Webhook connector uses axios to send a POST or PUT request to a web service.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_webhook"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".webhook"
+            ],
+            "example": ".webhook"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_webhook"
+          }
+        }
+      },
+      "config_properties_xmatters": {
+        "title": "Connector request properties for an xMatters connector",
+        "description": "Defines properties for connectors when type is `.xmatters`.",
+        "type": "object",
+        "properties": {
+          "configUrl": {
+            "description": "The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when `usesBasic` is `true`.\n",
+            "type": "string",
+            "nullable": true
+          },
+          "usesBasic": {
+            "description": "Specifies whether the connector uses HTTP basic authentication (`true`) or URL authentication (`false`).",
+            "type": "boolean",
+            "default": true
+          }
+        }
+      },
+      "secrets_properties_xmatters": {
+        "title": "Connector secrets properties for an xMatters connector",
+        "description": "Defines secrets for connectors when type is `.xmatters`.",
+        "type": "object",
+        "properties": {
+          "password": {
+            "description": "A user name for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n",
+            "type": "string"
+          },
+          "secretsUrl": {
+            "description": "The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when `usesBasic` is `false`.\n",
+            "type": "string"
+          },
+          "user": {
+            "description": "A password for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n",
+            "type": "string"
+          }
+        }
+      },
+      "create_connector_request_xmatters": {
+        "title": "Create xMatters connector request",
+        "description": "The xMatters connector uses the xMatters Workflow for Elastic to send actionable alerts to on-call xMatters resources.\n",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_xmatters"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".xmatters"
+            ],
+            "example": ".xmatters"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_xmatters"
+          }
+        }
+      },
+      "create_connector_request": {
+        "title": "Create connector request body properties",
+        "description": "The properties vary depending on the connector type.",
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/create_connector_request_bedrock"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_cases_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_d3security"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_email"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_genai"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_index"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_jira"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_opsgenie"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_pagerduty"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_resilient"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_serverlog"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_servicenow"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_servicenow_itom"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_servicenow_sir"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_slack_api"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_slack_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_swimlane"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_teams"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_tines"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_torq"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_xmatters"
+          }
+        ],
+        "discriminator": {
+          "propertyName": "connector_type_id"
+        }
+      },
+      "is_deprecated": {
+        "type": "boolean",
+        "description": "Indicates whether the connector type is deprecated.",
+        "example": false
+      },
+      "is_missing_secrets": {
+        "type": "boolean",
+        "description": "Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.",
+        "example": false
+      },
+      "is_preconfigured": {
+        "type": "boolean",
+        "description": "Indicates whether it is a preconfigured connector. If true, the `config` and `is_missing_secrets` properties are omitted from the response. \n",
+        "example": false
+      },
+      "is_system_action": {
+        "type": "boolean",
+        "description": "Indicates whether the connector is used for system actions.",
+        "example": false
+      },
+      "connector_response_properties_bedrock": {
+        "title": "Connector response properties for an Amazon Bedrock connector",
+        "type": "object",
+        "required": [
+          "config",
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_bedrock"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".bedrock"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          }
+        }
+      },
+      "referenced_by_count": {
+        "type": "integer",
+        "description": "Indicates the number of saved objects that reference the connector. If `is_preconfigured` is true, this value is not calculated. This property is returned only by the get all connectors API.\n",
+        "example": 2
+      },
+      "connector_response_properties_cases_webhook": {
+        "title": "Connector request properties for a Webhook - Case Management connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_cases_webhook"
+          },
+          "connector_type_id": {
+            "description": "The type of connector.",
+            "type": "string",
+            "enum": [
+              ".cases-webhook"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_d3security": {
+        "title": "Connector response properties for a D3 Security connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_d3security"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".d3security"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_email": {
+        "title": "Connector response properties for an email connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_email"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".email"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_index": {
+        "title": "Connector response properties for an index connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_index"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".index"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_jira": {
+        "title": "Connector response properties for a Jira connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_jira"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".jira"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_opsgenie": {
+        "title": "Connector response properties for an Opsgenie connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_opsgenie"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".opsgenie"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_pagerduty": {
+        "title": "Connector response properties for a PagerDuty connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_pagerduty"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".pagerduty"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_resilient": {
+        "title": "Connector response properties for a IBM Resilient connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_resilient"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".resilient"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_serverlog": {
+        "title": "Connector response properties for a server log connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "type": "object",
+            "nullable": true
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".server-log"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_servicenow": {
+        "title": "Connector response properties for a ServiceNow ITSM connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_servicenow"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".servicenow"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_servicenow_itom": {
+        "title": "Connector response properties for a ServiceNow ITOM connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_servicenow_itom"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".servicenow-itom"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_servicenow_sir": {
+        "title": "Connector response properties for a ServiceNow SecOps connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_servicenow"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".servicenow-sir"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_slack_api": {
+        "title": "Connector response properties for a Slack connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".slack_api"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_slack_webhook": {
+        "title": "Connector response properties for a Slack connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".slack"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_swimlane": {
+        "title": "Connector response properties for a Swimlane connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_swimlane"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".swimlane"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_teams": {
+        "title": "Connector response properties for a Microsoft Teams connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "type": "object"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".teams"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_tines": {
+        "title": "Connector response properties for a Tines connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_tines"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".tines"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_torq": {
+        "title": "Connector response properties for a Torq connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_torq"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".torq"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_webhook": {
+        "title": "Connector response properties for a Webhook connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_webhook"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".webhook"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties_xmatters": {
+        "title": "Connector response properties for an xMatters connector",
+        "type": "object",
+        "required": [
+          "connector_type_id",
+          "id",
+          "is_deprecated",
+          "is_preconfigured",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_xmatters"
+          },
+          "connector_type_id": {
+            "type": "string",
+            "description": "The type of connector.",
+            "enum": [
+              ".xmatters"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "description": "The identifier for the connector."
+          },
+          "is_deprecated": {
+            "$ref": "#/components/schemas/is_deprecated"
+          },
+          "is_missing_secrets": {
+            "$ref": "#/components/schemas/is_missing_secrets"
+          },
+          "is_preconfigured": {
+            "$ref": "#/components/schemas/is_preconfigured"
+          },
+          "is_system_action": {
+            "$ref": "#/components/schemas/is_system_action"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "referenced_by_count": {
+            "$ref": "#/components/schemas/referenced_by_count"
+          }
+        }
+      },
+      "connector_response_properties": {
+        "title": "Connector response properties",
+        "description": "The properties vary depending on the connector type.",
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/connector_response_properties_bedrock"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_cases_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_d3security"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_email"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_index"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_jira"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_opsgenie"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_pagerduty"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_resilient"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_serverlog"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_servicenow"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_servicenow_itom"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_servicenow_sir"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_slack_api"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_slack_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_swimlane"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_teams"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_tines"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_torq"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/connector_response_properties_xmatters"
+          }
+        ],
+        "discriminator": {
+          "propertyName": "connector_type_id"
+        }
+      },
+      "update_connector_request_bedrock": {
+        "title": "Update Amazon Bedrock connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_bedrock"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_bedrock"
+          }
+        }
+      },
+      "update_connector_request_cases_webhook": {
+        "title": "Update Webhook - Case Managment connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_cases_webhook"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_cases_webhook"
+          }
+        }
+      },
+      "update_connector_request_d3security": {
+        "title": "Update D3 Security connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_d3security"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_d3security"
+          }
+        }
+      },
+      "update_connector_request_email": {
+        "title": "Update email connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_email"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_email"
+          }
+        }
+      },
+      "update_connector_request_index": {
+        "title": "Update index connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_index"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          }
+        }
+      },
+      "update_connector_request_jira": {
+        "title": "Update Jira connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_jira"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_jira"
+          }
+        }
+      },
+      "update_connector_request_opsgenie": {
+        "title": "Update Opsgenie connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_opsgenie"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_opsgenie"
+          }
+        }
+      },
+      "update_connector_request_pagerduty": {
+        "title": "Update PagerDuty connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_pagerduty"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_pagerduty"
+          }
+        }
+      },
+      "update_connector_request_resilient": {
+        "title": "Update IBM Resilient connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_resilient"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_resilient"
+          }
+        }
+      },
+      "update_connector_request_serverlog": {
+        "title": "Update server log connector request",
+        "type": "object",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          }
+        }
+      },
+      "update_connector_request_servicenow": {
+        "title": "Update ServiceNow ITSM connector or ServiceNow SecOps request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_servicenow"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_servicenow"
+          }
+        }
+      },
+      "update_connector_request_servicenow_itom": {
+        "title": "Create ServiceNow ITOM connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_servicenow_itom"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_servicenow"
+          }
+        }
+      },
+      "update_connector_request_slack_api": {
+        "title": "Update Slack connector request",
+        "type": "object",
+        "required": [
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_slack_api"
+          }
+        }
+      },
+      "update_connector_request_slack_webhook": {
+        "title": "Update Slack connector request",
+        "type": "object",
+        "required": [
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_slack_webhook"
+          }
+        }
+      },
+      "update_connector_request_swimlane": {
+        "title": "Update Swimlane connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_swimlane"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector.",
+            "example": "my-connector"
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_swimlane"
+          }
+        }
+      },
+      "update_connector_request_teams": {
+        "title": "Update Microsoft Teams connector request",
+        "type": "object",
+        "required": [
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_teams"
+          }
+        }
+      },
+      "update_connector_request_tines": {
+        "title": "Update Tines connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_tines"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_tines"
+          }
+        }
+      },
+      "update_connector_request_torq": {
+        "title": "Update Torq connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_torq"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_torq"
+          }
+        }
+      },
+      "update_connector_request_webhook": {
+        "title": "Update Webhook connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_webhook"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_webhook"
+          }
+        }
+      },
+      "update_connector_request_xmatters": {
+        "title": "Update xMatters connector request",
+        "type": "object",
+        "required": [
+          "config",
+          "name",
+          "secrets"
+        ],
+        "properties": {
+          "config": {
+            "$ref": "#/components/schemas/config_properties_xmatters"
+          },
+          "name": {
+            "type": "string",
+            "description": "The display name for the connector."
+          },
+          "secrets": {
+            "$ref": "#/components/schemas/secrets_properties_xmatters"
+          }
+        }
+      },
+      "update_connector_request": {
+        "title": "Update connector request body properties",
+        "description": "The properties vary depending on the connector type.",
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/update_connector_request_bedrock"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_cases_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_d3security"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_email"
+          },
+          {
+            "$ref": "#/components/schemas/create_connector_request_genai"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_index"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_jira"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_opsgenie"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_pagerduty"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_resilient"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_serverlog"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_servicenow"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_servicenow_itom"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_slack_api"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_slack_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_swimlane"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_teams"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_tines"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_torq"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_webhook"
+          },
+          {
+            "$ref": "#/components/schemas/update_connector_request_xmatters"
+          }
+        ]
+      },
+      "features": {
+        "type": "string",
+        "description": "The feature that uses the connector.\n",
+        "enum": [
+          "alerting",
+          "cases",
+          "generativeAI",
+          "siem",
+          "uptime"
+        ]
+      },
+      "connector_types": {
+        "title": "Connector types",
+        "type": "string",
+        "description": "The type of connector. For example, `.email`, `.index`, `.jira`, `.opsgenie`, or `.server-log`.",
+        "enum": [
+          ".bedrock",
+          ".cases-webhook",
+          ".d3security",
+          ".email",
+          ".gen-ai",
+          ".index",
+          ".jira",
+          ".opsgenie",
+          ".pagerduty",
+          ".resilient",
+          ".servicenow",
+          ".servicenow-itom",
+          ".servicenow-sir",
+          ".server-log",
+          ".slack",
+          ".slack_api",
+          ".swimlane",
+          ".teams",
+          ".tines",
+          ".torq",
+          ".webhook",
+          ".xmatters"
+        ],
+        "example": ".server-log"
+      }
+    },
+    "examples": {
+      "create_email_connector_request": {
+        "summary": "Create an email connector.",
+        "value": {
+          "name": "email-connector-1",
+          "connector_type_id": ".email",
+          "config": {
+            "from": "tester@example.com",
+            "hasAuth": true,
+            "host": "https://example.com",
+            "port": 1025,
+            "secure": false,
+            "service": "other"
+          },
+          "secrets": {
+            "user": "username",
+            "password": "password"
+          }
+        }
+      },
+      "create_index_connector_request": {
+        "summary": "Create an index connector.",
+        "value": {
+          "name": "my-connector",
+          "connector_type_id": ".index",
+          "config": {
+            "index": "test-index"
+          }
+        }
+      },
+      "create_webhook_connector_request": {
+        "summary": "Create a webhook connector with SSL authentication.",
+        "value": {
+          "name": "my-webhook-connector",
+          "connector_type_id": ".webhook",
+          "config": {
+            "method": "post",
+            "url": "https://example.com",
+            "authType": "webhook-authentication-ssl",
+            "certType": "ssl-crt-key"
+          },
+          "secrets": {
+            "crt": "QmFnIEF0dH...",
+            "key": "LS0tLS1CRUdJ...",
+            "password": "my-passphrase"
+          }
+        }
+      },
+      "create_xmatters_connector_request": {
+        "summary": "Create an xMatters connector with URL authentication.",
+        "value": {
+          "name": "my-xmatters-connector",
+          "connector_type_id": ".xmatters",
+          "config": {
+            "usesBasic": false
+          },
+          "secrets": {
+            "secretsUrl": "https://example.com?apiKey=xxxxx"
+          }
+        }
+      },
+      "create_email_connector_response": {
+        "summary": "A new email connector.",
+        "value": {
+          "id": "90a82c60-478f-11ee-a343-f98a117c727f",
+          "connector_type_id": ".email",
+          "name": "email-connector-1",
+          "config": {
+            "from": "tester@example.com",
+            "service": "other",
+            "host": "https://example.com",
+            "port": 1025,
+            "secure": false,
+            "hasAuth": true,
+            "tenantId": null,
+            "clientId": null,
+            "oauthTokenUrl": null
+          },
+          "is_preconfigured": false,
+          "is_deprecated": false,
+          "is_missing_secrets": false,
+          "is_system_action": false
+        }
+      },
+      "create_index_connector_response": {
+        "summary": "A new index connector.",
+        "value": {
+          "id": "c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad",
+          "connector_type_id": ".index",
+          "name": "my-connector",
+          "config": {
+            "index": "test-index",
+            "refresh": false,
+            "executionTimeField": null
+          },
+          "is_preconfigured": false,
+          "is_deprecated": false,
+          "is_missing_secrets": false,
+          "is_system_action": false
+        }
+      },
+      "create_webhook_connector_response": {
+        "summary": "A new webhook connector.",
+        "value": {
+          "id": "900eb010-3b9d-11ee-a642-8ffbb94e38bd",
+          "name": "my-webhook-connector",
+          "config": {
+            "method": "post",
+            "url": "https://example.com",
+            "authType": "webhook-authentication-ssl",
+            "certType": "ssl-crt-key",
+            "verificationMode": "full",
+            "headers": null,
+            "hasAuth": true
+          },
+          "connector_type_id": ".webhook",
+          "is_preconfigured": false,
+          "is_deprecated": false,
+          "is_missing_secrets": false,
+          "is_system_action": false
+        }
+      },
+      "create_xmatters_connector_response": {
+        "summary": "A new xMatters connector.",
+        "value": {
+          "id": "4d2d8da0-4d1f-11ee-9367-577408be4681",
+          "name": "my-xmatters-connector",
+          "config": {
+            "usesBasic": false,
+            "configUrl": null
+          },
+          "connector_type_id": ".xmatters",
+          "is_preconfigured": false,
+          "is_deprecated": false,
+          "is_missing_secrets": false,
+          "is_system_action": false
+        }
+      },
+      "get_connector_response": {
+        "summary": "Get connector details.",
+        "value": {
+          "id": "df770e30-8b8b-11ed-a780-3b746c987a81",
+          "name": "my_server_log_connector",
+          "config": {},
+          "connector_type_id": ".server-log",
+          "is_preconfigured": false,
+          "is_deprecated": false,
+          "is_missing_secrets": false,
+          "is_system_action": false
+        }
+      },
+      "update_index_connector_request": {
+        "summary": "Update an index connector.",
+        "value": {
+          "name": "updated-connector",
+          "config": {
+            "index": "updated-index"
+          }
+        }
+      },
+      "get_connectors_response": {
+        "summary": "A list of connectors",
+        "value": [
+          {
+            "id": "preconfigured-email-connector",
+            "name": "my-preconfigured-email-notification",
+            "connector_type_id": ".email",
+            "is_preconfigured": true,
+            "is_deprecated": false,
+            "referenced_by_count": 0,
+            "is_system_action": false
+          },
+          {
+            "id": "e07d0c80-8b8b-11ed-a780-3b746c987a81",
+            "name": "my-index-connector",
+            "config": {
+              "index": "test-index",
+              "refresh": false,
+              "executionTimeField": null
+            },
+            "connector_type_id": ".index",
+            "is_preconfigured": false,
+            "is_deprecated": false,
+            "referenced_by_count": 2,
+            "is_missing_secrets": false,
+            "is_system_action": false
+          }
+        ]
+      },
+      "get_connector_types_generativeai_response": {
+        "summary": "A list of connector types for the `generativeAI` feature.",
+        "value": [
+          {
+            "id": ".gen-ai",
+            "name": "OpenAI",
+            "enabled": true,
+            "enabled_in_config": true,
+            "enabled_in_license": true,
+            "minimum_license_required": "enterprise",
+            "supported_feature_ids": [
+              "generativeAI"
+            ],
+            "is_system_action_type": false
+          },
+          {
+            "id": ".bedrock",
+            "name": "AWS Bedrock",
+            "enabled": true,
+            "enabled_in_config": true,
+            "enabled_in_license": true,
+            "minimum_license_required": "enterprise",
+            "supported_feature_ids": [
+              "generativeAI"
+            ],
+            "is_system_action_type": false
+          }
+        ]
+      }
+    },
+    "responses": {
+      "401": {
+        "description": "Authorization information is missing or invalid.",
+        "content": {
+          "application/json": {
+            "schema": {
+              "type": "object",
+              "title": "Unauthorized response",
+              "properties": {
+                "error": {
+                  "type": "string",
+                  "example": "Unauthorized",
+                  "enum": [
+                    "Unauthorized"
+                  ]
+                },
+                "message": {
+                  "type": "string"
+                },
+                "statusCode": {
+                  "type": "integer",
+                  "example": 401,
+                  "enum": [
+                    401
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "404": {
+        "description": "Object is not found.",
+        "content": {
+          "application/json": {
+            "schema": {
+              "type": "object",
+              "title": "Not found response",
+              "properties": {
+                "error": {
+                  "type": "string",
+                  "example": "Not Found",
+                  "enum": [
+                    "Not Found"
+                  ]
+                },
+                "message": {
+                  "type": "string",
+                  "example": "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found"
+                },
+                "statusCode": {
+                  "type": "integer",
+                  "example": 404,
+                  "enum": [
+                    404
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/bundled_serverless.yaml b/x-pack/plugins/actions/docs/openapi/bundled_serverless.yaml
new file mode 100644
index 0000000000000..b66a820c1b77d
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/bundled_serverless.yaml
@@ -0,0 +1,2985 @@
+openapi: 3.0.1
+info:
+  title: Connectors
+  description: OpenAPI schema for connectors in Serverless projects
+  version: '0.1'
+  contact:
+    name: Connectors Team
+  license:
+    name: Elastic License 2.0
+    url: https://www.elastic.co/licensing/elastic-license
+servers:
+  - url: http://localhost:5601
+    description: local
+security:
+  - apiKeyAuth: []
+tags:
+  - name: connectors
+    description: Connector APIs enable you to create and manage connectors.
+paths:
+  /api/actions/connector:
+    post:
+      summary: Creates a connector.
+      operationId: createConnector
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/create_connector_request'
+            examples:
+              createEmailConnectorRequest:
+                $ref: '#/components/examples/create_email_connector_request'
+              createIndexConnectorRequest:
+                $ref: '#/components/examples/create_index_connector_request'
+              createWebhookConnectorRequest:
+                $ref: '#/components/examples/create_webhook_connector_request'
+              createXmattersConnectorRequest:
+                $ref: '#/components/examples/create_xmatters_connector_request'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connector_response_properties'
+              examples:
+                createEmailConnectorResponse:
+                  $ref: '#/components/examples/create_email_connector_response'
+                createIndexConnectorResponse:
+                  $ref: '#/components/examples/create_index_connector_response'
+                createWebhookConnectorResponse:
+                  $ref: '#/components/examples/create_webhook_connector_response'
+                createXmattersConnectorResponse:
+                  $ref: '#/components/examples/create_xmatters_connector_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+  /api/actions/connector/{connectorId}:
+    get:
+      summary: Retrieves a connector by ID.
+      operationId: getConnector
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/connector_id'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connector_response_properties'
+              examples:
+                getConnectorResponse:
+                  $ref: '#/components/examples/get_connector_response'
+        '401':
+          $ref: '#/components/responses/401'
+        '404':
+          $ref: '#/components/responses/404'
+      servers:
+        - url: https://localhost:5601
+    delete:
+      summary: Deletes a connector.
+      operationId: deleteConnector
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - $ref: '#/components/parameters/connector_id'
+      responses:
+        '204':
+          description: Indicates a successful call.
+        '401':
+          $ref: '#/components/responses/401'
+        '404':
+          $ref: '#/components/responses/404'
+      servers:
+        - url: https://localhost:5601
+    post:
+      summary: Creates a connector.
+      operationId: createConnectorId
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - in: path
+          name: connectorId
+          description: |
+            A UUID v1 or v4 identifier for the connector. If you omit this parameter, an identifier is randomly generated.
+          required: true
+          schema:
+            type: string
+            example: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/create_connector_request'
+            examples:
+              createIndexConnectorRequest:
+                $ref: '#/components/examples/create_index_connector_request'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connector_response_properties'
+              examples:
+                createIndexConnectorResponse:
+                  $ref: '#/components/examples/create_index_connector_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    put:
+      summary: Updates the attributes for a connector.
+      operationId: updateConnector
+      tags:
+        - connectors
+      parameters:
+        - $ref: '#/components/parameters/kbn_xsrf'
+        - $ref: '#/components/parameters/connector_id'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/update_connector_request'
+            examples:
+              updateIndexConnectorRequest:
+                $ref: '#/components/examples/update_index_connector_request'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connector_response_properties'
+        '400':
+          $ref: '#/components/responses/401'
+        '401':
+          $ref: '#/components/responses/401'
+        '404':
+          $ref: '#/components/responses/404'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+  /api/actions/connectors:
+    get:
+      summary: Retrieves all connectors.
+      operationId: getConnectors
+      tags:
+        - connectors
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/connector_response_properties'
+              examples:
+                getConnectorsResponse:
+                  $ref: '#/components/examples/get_connectors_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+  /api/actions/connector_types:
+    get:
+      summary: Retrieves a list of all connector types.
+      operationId: getConnectorTypes
+      tags:
+        - connectors
+      parameters:
+        - in: query
+          name: feature_id
+          description: A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).
+          schema:
+            $ref: '#/components/schemas/features'
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                title: Get connector types response body properties
+                description: The properties vary for each connector type.
+                type: array
+                items:
+                  type: object
+                  properties:
+                    enabled:
+                      type: boolean
+                      description: Indicates whether the connector type is enabled in Kibana.
+                      example: true
+                    enabled_in_config:
+                      type: boolean
+                      description: Indicates whether the connector type is enabled in the Kibana configuration file.
+                      example: true
+                    enabled_in_license:
+                      type: boolean
+                      description: Indicates whether the connector is enabled in the license.
+                      example: true
+                    id:
+                      $ref: '#/components/schemas/connector_types'
+                    is_system_action_type:
+                      type: boolean
+                      example: false
+                    minimum_license_required:
+                      type: string
+                      description: The license that is required to use the connector type.
+                      example: basic
+                    name:
+                      type: string
+                      description: The name of the connector type.
+                      example: Index
+                    supported_feature_ids:
+                      type: array
+                      description: The features that are supported by the connector type.
+                      items:
+                        $ref: '#/components/schemas/features'
+                      example:
+                        - alerting
+                        - cases
+                        - siem
+              examples:
+                getConnectorTypesServerlessResponse:
+                  $ref: '#/components/examples/get_connector_types_generativeai_response'
+        '401':
+          $ref: '#/components/responses/401'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
+components:
+  securitySchemes:
+    apiKeyAuth:
+      type: apiKey
+      in: header
+      name: ApiKey
+  parameters:
+    kbn_xsrf:
+      schema:
+        type: string
+      in: header
+      name: kbn-xsrf
+      description: Cross-site request forgery protection
+      required: true
+    connector_id:
+      in: path
+      name: connectorId
+      description: An identifier for the connector.
+      required: true
+      schema:
+        type: string
+        example: df770e30-8b8b-11ed-a780-3b746c987a81
+  schemas:
+    config_properties_bedrock:
+      title: Connector request properties for an Amazon Bedrock connector
+      description: Defines properties for connectors when type is `.bedrock`.
+      type: object
+      required:
+        - apiUrl
+      properties:
+        apiUrl:
+          type: string
+          description: The Amazon Bedrock request URL.
+        defaultModel:
+          type: string
+          description: |
+            The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.
+          default: anthropic.claude-v2
+    secrets_properties_bedrock:
+      title: Connector secrets properties for an Amazon Bedrock connector
+      description: Defines secrets for connectors when type is `.bedrock`.
+      type: object
+      required:
+        - accessKey
+        - secret
+      properties:
+        accessKey:
+          type: string
+          description: The AWS access key for authentication.
+        secret:
+          type: string
+          description: The AWS secret for authentication.
+    create_connector_request_bedrock:
+      title: Create Amazon Bedrock connector request
+      description: The Amazon Bedrock connector uses axios to send a POST request to Amazon Bedrock.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_bedrock'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .bedrock
+          example: .bedrock
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_bedrock'
+    config_properties_cases_webhook:
+      title: Connector request properties for Webhook - Case Management connector
+      required:
+        - createIncidentJson
+        - createIncidentResponseKey
+        - createIncidentUrl
+        - getIncidentResponseExternalTitleKey
+        - getIncidentUrl
+        - updateIncidentJson
+        - updateIncidentUrl
+        - viewIncidentUrl
+      description: Defines properties for connectors when type is `.cases-webhook`.
+      type: object
+      properties:
+        createCommentJson:
+          type: string
+          description: |
+            A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.
+          example:
+            body:
+              '[object Object]': null
+        createCommentMethod:
+          type: string
+          description: |
+            The REST API HTTP request method to create a case comment in the third-party system. Valid values are `patch`, `post`, and `put`.
+          default: put
+          enum:
+            - patch
+            - post
+            - put
+        createCommentUrl:
+          type: string
+          description: |
+            The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts setting`, add the hostname to the allowed hosts.
+          example: https://testing-jira.atlassian.net/rest/api/2/issue/{{{external.system.id}}}/comment
+        createIncidentJson:
+          type: string
+          description: |
+            A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
+          example:
+            fields:
+              summary:
+                '[object Object]': null
+              description:
+                '[object Object]': null
+              labels:
+                '[object Object]': null
+        createIncidentMethod:
+          type: string
+          description: |
+            The REST API HTTP request method to create a case in the third-party system. Valid values are `patch`, `post`, and `put`.
+          enum:
+            - patch
+            - post
+            - put
+          default: post
+        createIncidentResponseKey:
+          type: string
+          description: The JSON key in the create case response that contains the external case ID.
+        createIncidentUrl:
+          type: string
+          description: |
+            The REST API URL to create a case in the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.
+        getIncidentResponseExternalTitleKey:
+          type: string
+          description: The JSON key in get case response that contains the external case title.
+        getIncidentUrl:
+          type: string
+          description: |
+            The REST API URL to get the case by ID from the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.
+          example: https://testing-jira.atlassian.net/rest/api/2/issue/{{{external.system.id}}}
+        hasAuth:
+          type: boolean
+          description: If true, a username and password for login type authentication must be provided.
+          default: true
+        headers:
+          type: string
+          description: |
+            A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.
+        updateIncidentJson:
+          type: string
+          description: |
+            The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
+          example:
+            fields:
+              summary:
+                '[object Object]': null
+              description:
+                '[object Object]': null
+              labels:
+                '[object Object]': null
+        updateIncidentMethod:
+          type: string
+          description: |
+            The REST API HTTP request method to update the case in the third-party system. Valid values are `patch`, `post`, and `put`.
+          default: put
+          enum:
+            - patch
+            - post
+            - put
+        updateIncidentUrl:
+          type: string
+          description: |
+            The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.
+          example: https://testing-jira.atlassian.net/rest/api/2/issue/{{{external.system.ID}}}
+        viewIncidentUrl:
+          type: string
+          description: |
+            The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.
+          example: https://testing-jira.atlassian.net/browse/{{{external.system.title}}}
+    secrets_properties_cases_webhook:
+      title: Connector secrets properties for Webhook - Case Management connector
+      type: object
+      properties:
+        password:
+          type: string
+          description: The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.
+        user:
+          type: string
+          description: The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.
+    create_connector_request_cases_webhook:
+      title: Create Webhook - Case Managment connector request
+      description: |
+        The Webhook - Case Management connector uses axios to send POST, PUT, and GET requests to a case management RESTful API web service.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_cases_webhook'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .cases-webhook
+          example: .cases-webhook
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_cases_webhook'
+    config_properties_d3security:
+      title: Connector request properties for a D3 Security connector
+      description: Defines properties for connectors when type is `.d3security`.
+      type: object
+      required:
+        - url
+      properties:
+        url:
+          type: string
+          description: |
+            The D3 Security API request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.
+    secrets_properties_d3security:
+      title: Connector secrets properties for a D3 Security connector
+      description: Defines secrets for connectors when type is `.d3security`.
+      required:
+        - token
+      type: object
+      properties:
+        token:
+          type: string
+          description: The D3 Security token.
+    create_connector_request_d3security:
+      title: Create D3 Security connector request
+      description: |
+        The connector uses axios to send a POST request to a D3 Security endpoint.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_d3security'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .d3security
+          example: .d3security
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_d3security'
+    config_properties_email:
+      title: Connector request properties for an email connector
+      description: Defines properties for connectors when type is `.email`.
+      required:
+        - from
+      type: object
+      properties:
+        clientId:
+          description: |
+            The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.
+          type: string
+          nullable: true
+        from:
+          description: |
+            The from address for all emails sent by the connector. It must be specified in `user@host-name` format.
+          type: string
+        hasAuth:
+          description: |
+            Specifies whether a user and password are required inside the secrets configuration.
+          default: true
+          type: boolean
+        host:
+          description: |
+            The host name of the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined. 
+          type: string
+        oauthTokenUrl:
+          type: string
+          nullable: true
+        port:
+          description: |
+            The port to connect to on the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined. 
+          type: integer
+        secure:
+          description: |
+            Specifies whether the connection to the service provider will use TLS. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.
+          type: boolean
+        service:
+          description: |
+            The name of the email service.
+          type: string
+          enum:
+            - elastic_cloud
+            - exchange_server
+            - gmail
+            - other
+            - outlook365
+            - ses
+        tenantId:
+          description: |
+            The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.
+          type: string
+          nullable: true
+    secrets_properties_email:
+      title: Connector secrets properties for an email connector
+      description: Defines secrets for connectors when type is `.email`.
+      type: object
+      properties:
+        clientSecret:
+          type: string
+          description: |
+            The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If `service` is `exchange_server`, this property is required.
+        password:
+          type: string
+          description: |
+            The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.
+        user:
+          type: string
+          description: |
+            The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.
+    create_connector_request_email:
+      title: Create email connector request
+      description: |
+        The email connector uses the SMTP protocol to send mail messages, using an integration of Nodemailer. An exception is Microsoft Exchange, which uses HTTP protocol for sending emails, Send mail. Email message text is sent as both plain text and html text.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_email'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .email
+          example: .email
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_email'
+    config_properties_genai:
+      title: Connector request properties for an OpenAI connector
+      description: Defines properties for connectors when type is `.gen-ai`.
+      oneOf:
+        - type: object
+          required:
+            - apiProvider
+            - apiUrl
+          properties:
+            apiProvider:
+              type: string
+              description: The OpenAI API provider.
+              enum:
+                - Azure OpenAI
+            apiUrl:
+              type: string
+              description: The OpenAI API endpoint.
+        - type: object
+          required:
+            - apiProvider
+            - apiUrl
+          properties:
+            apiProvider:
+              type: string
+              description: The OpenAI API provider.
+              enum:
+                - OpenAI
+            apiUrl:
+              type: string
+              description: The OpenAI API endpoint.
+            defaultModel:
+              type: string
+              description: The default model to use for requests.
+      discriminator:
+        propertyName: apiProvider
+    secrets_properties_genai:
+      title: Connector secrets properties for an OpenAI connector
+      description: Defines secrets for connectors when type is `.gen-ai`.
+      type: object
+      properties:
+        apiKey:
+          type: string
+          description: The OpenAI API key.
+    create_connector_request_genai:
+      title: Create OpenAI connector request
+      description: |
+        The OpenAI connector uses axios to send a POST request to either OpenAI or Azure OpenAPI.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_genai'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .gen-ai
+          example: .gen-ai
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_genai'
+    config_properties_index:
+      title: Connector request properties for an index connector
+      required:
+        - index
+      description: Defines properties for connectors when type is `.index`.
+      type: object
+      properties:
+        executionTimeField:
+          description: A field that indicates when the document was indexed.
+          default: null
+          type: string
+          nullable: true
+        index:
+          description: The Elasticsearch index to be written to.
+          type: string
+        refresh:
+          description: |
+            The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.
+          default: false
+          type: boolean
+    create_connector_request_index:
+      title: Create index connector request
+      description: The index connector indexes a document into Elasticsearch.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_index'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .index
+          example: .index
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+    config_properties_jira:
+      title: Connector request properties for a Jira connector
+      required:
+        - apiUrl
+        - projectKey
+      description: Defines properties for connectors when type is `.jira`.
+      type: object
+      properties:
+        apiUrl:
+          description: The Jira instance URL.
+          type: string
+        projectKey:
+          description: The Jira project key.
+          type: string
+    secrets_properties_jira:
+      title: Connector secrets properties for a Jira connector
+      required:
+        - apiToken
+        - email
+      description: Defines secrets for connectors when type is `.jira`.
+      type: object
+      properties:
+        apiToken:
+          description: The Jira API authentication token for HTTP basic authentication.
+          type: string
+        email:
+          description: The account email for HTTP Basic authentication.
+          type: string
+    create_connector_request_jira:
+      title: Create Jira connector request
+      description: The Jira connector uses the REST API v2 to create Jira issues.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_jira'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .jira
+          example: .jira
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_jira'
+    config_properties_opsgenie:
+      title: Connector request properties for an Opsgenie connector
+      required:
+        - apiUrl
+      description: Defines properties for connectors when type is `.opsgenie`.
+      type: object
+      properties:
+        apiUrl:
+          description: |
+            The Opsgenie URL. For example, `https://api.opsgenie.com` or `https://api.eu.opsgenie.com`. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.
+          type: string
+    secrets_properties_opsgenie:
+      title: Connector secrets properties for an Opsgenie connector
+      required:
+        - apiKey
+      description: Defines secrets for connectors when type is `.opsgenie`.
+      type: object
+      properties:
+        apiKey:
+          description: The Opsgenie API authentication key for HTTP Basic authentication.
+          type: string
+    create_connector_request_opsgenie:
+      title: Create Opsgenie connector request
+      description: The Opsgenie connector uses the Opsgenie alert API.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_opsgenie'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .opsgenie
+          example: .opsgenie
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_opsgenie'
+    config_properties_pagerduty:
+      title: Connector request properties for a PagerDuty connector
+      description: Defines properties for connectors when type is `.pagerduty`.
+      type: object
+      properties:
+        apiUrl:
+          description: The PagerDuty event URL.
+          type: string
+          nullable: true
+          example: https://events.pagerduty.com/v2/enqueue
+    secrets_properties_pagerduty:
+      title: Connector secrets properties for a PagerDuty connector
+      description: Defines secrets for connectors when type is `.pagerduty`.
+      type: object
+      required:
+        - routingKey
+      properties:
+        routingKey:
+          description: |
+            A 32 character PagerDuty Integration Key for an integration on a service.
+          type: string
+    create_connector_request_pagerduty:
+      title: Create PagerDuty connector request
+      description: |
+        The PagerDuty connector uses the v2 Events API to trigger, acknowledge, and resolve PagerDuty alerts.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_pagerduty'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .pagerduty
+          example: .pagerduty
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_pagerduty'
+    config_properties_resilient:
+      title: Connector request properties for a IBM Resilient connector
+      required:
+        - apiUrl
+        - orgId
+      description: Defines properties for connectors when type is `.resilient`.
+      type: object
+      properties:
+        apiUrl:
+          description: The IBM Resilient instance URL.
+          type: string
+        orgId:
+          description: The IBM Resilient organization ID.
+          type: string
+    secrets_properties_resilient:
+      title: Connector secrets properties for IBM Resilient connector
+      required:
+        - apiKeyId
+        - apiKeySecret
+      description: Defines secrets for connectors when type is `.resilient`.
+      type: object
+      properties:
+        apiKeyId:
+          type: string
+          description: The authentication key ID for HTTP Basic authentication.
+        apiKeySecret:
+          type: string
+          description: The authentication key secret for HTTP Basic authentication.
+    create_connector_request_resilient:
+      title: Create IBM Resilient connector request
+      description: The IBM Resilient connector uses the RESILIENT REST v2 to create IBM Resilient incidents.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_resilient'
+        connector_type_id:
+          description: The type of connector.
+          type: string
+          example: .resilient
+          enum:
+            - .resilient
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_resilient'
+    create_connector_request_serverlog:
+      title: Create server log connector request
+      description: This connector writes an entry to the Kibana server log.
+      type: object
+      required:
+        - connector_type_id
+        - name
+      properties:
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .server-log
+          example: .server-log
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+    config_properties_servicenow:
+      title: Connector request properties for a ServiceNow ITSM connector
+      required:
+        - apiUrl
+      description: Defines properties for connectors when type is `.servicenow`.
+      type: object
+      properties:
+        apiUrl:
+          type: string
+          description: The ServiceNow instance URL.
+        clientId:
+          description: |
+            The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.
+          type: string
+        isOAuth:
+          description: |
+            The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).
+          default: false
+          type: boolean
+        jwtKeyId:
+          description: |
+            The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.
+          type: string
+        userIdentifierValue:
+          description: |
+            The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.
+          type: string
+        usesTableApi:
+          description: |
+            Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors.  NOTE: If this property is set to `false`, the Elastic application should be installed in ServiceNow.
+          default: true
+          type: boolean
+    secrets_properties_servicenow:
+      title: Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors
+      description: Defines secrets for connectors when type is `.servicenow`, `.servicenow-sir`, or `.servicenow-itom`.
+      type: object
+      properties:
+        clientSecret:
+          type: string
+          description: The client secret assigned to your OAuth application. This property is required when `isOAuth` is `true`.
+        password:
+          type: string
+          description: The password for HTTP basic authentication. This property is required when `isOAuth` is `false`.
+        privateKey:
+          type: string
+          description: The RSA private key that you created for use in ServiceNow. This property is required when `isOAuth` is `true`.
+        privateKeyPassword:
+          type: string
+          description: The password for the RSA private key. This property is required when `isOAuth` is `true` and you set a password on your private key.
+        username:
+          type: string
+          description: The username for HTTP basic authentication. This property is required when `isOAuth` is `false`.
+    create_connector_request_servicenow:
+      title: Create ServiceNow ITSM connector request
+      description: |
+        The ServiceNow ITSM connector uses the import set API to create ServiceNow incidents. You can use the connector for rule actions and cases.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_servicenow'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .servicenow
+          example: .servicenow
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_servicenow'
+    config_properties_servicenow_itom:
+      title: Connector request properties for a ServiceNow ITSM connector
+      required:
+        - apiUrl
+      description: Defines properties for connectors when type is `.servicenow`.
+      type: object
+      properties:
+        apiUrl:
+          type: string
+          description: The ServiceNow instance URL.
+        clientId:
+          description: |
+            The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.
+          type: string
+        isOAuth:
+          description: |
+            The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).
+          default: false
+          type: boolean
+        jwtKeyId:
+          description: |
+            The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.
+          type: string
+        userIdentifierValue:
+          description: |
+            The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.
+          type: string
+    create_connector_request_servicenow_itom:
+      title: Create ServiceNow ITOM connector request
+      description: |
+        The ServiceNow ITOM connector uses the event API to create ServiceNow events. You can use the connector for rule actions.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_servicenow_itom'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .servicenow-itom
+          example: .servicenow-itom
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_servicenow'
+    create_connector_request_servicenow_sir:
+      title: Create ServiceNow SecOps connector request
+      description: |
+        The ServiceNow SecOps connector uses the import set API to create ServiceNow security incidents. You can use the connector for rule actions and cases.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_servicenow'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .servicenow-sir
+          example: .servicenow-sir
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_servicenow'
+    secrets_properties_slack_api:
+      title: Connector secrets properties for a Web API Slack connector
+      description: Defines secrets for connectors when type is `.slack`.
+      required:
+        - token
+      type: object
+      properties:
+        token:
+          type: string
+          description: Slack bot user OAuth token.
+    create_connector_request_slack_api:
+      title: Create Slack connector request
+      description: The Slack connector uses Slack Incoming Webhooks.
+      type: object
+      required:
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .slack_api
+          example: .slack_api
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_slack_api'
+    secrets_properties_slack_webhook:
+      title: Connector secrets properties for a Webhook Slack connector
+      description: Defines secrets for connectors when type is `.slack`.
+      required:
+        - webhookUrl
+      type: object
+      properties:
+        webhookUrl:
+          type: string
+          description: Slack webhook url.
+    create_connector_request_slack_webhook:
+      title: Create Slack connector request
+      description: The Slack connector uses Slack Incoming Webhooks.
+      type: object
+      required:
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .slack
+          example: .slack
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_slack_webhook'
+    config_properties_swimlane:
+      title: Connector request properties for a Swimlane connector
+      required:
+        - apiUrl
+        - appId
+        - connectorType
+      description: Defines properties for connectors when type is `.swimlane`.
+      type: object
+      properties:
+        apiUrl:
+          description: The Swimlane instance URL.
+          type: string
+        appId:
+          description: The Swimlane application ID.
+          type: string
+        connectorType:
+          description: The type of connector. Valid values are `all`, `alerts`, and `cases`.
+          type: string
+          enum:
+            - all
+            - alerts
+            - cases
+        mappings:
+          title: Connector mappings properties for a Swimlane connector
+          description: The field mapping.
+          type: object
+          properties:
+            alertIdConfig:
+              title: Alert identifier mapping
+              description: Mapping for the alert ID.
+              type: object
+              required:
+                - fieldType
+                - id
+                - key
+                - name
+              properties:
+                fieldType:
+                  type: string
+                  description: The type of field in Swimlane.
+                id:
+                  type: string
+                  description: The identifier for the field in Swimlane.
+                key:
+                  type: string
+                  description: The key for the field in Swimlane.
+                name:
+                  type: string
+                  description: The name of the field in Swimlane.
+            caseIdConfig:
+              title: Case identifier mapping
+              description: Mapping for the case ID.
+              type: object
+              required:
+                - fieldType
+                - id
+                - key
+                - name
+              properties:
+                fieldType:
+                  type: string
+                  description: The type of field in Swimlane.
+                id:
+                  type: string
+                  description: The identifier for the field in Swimlane.
+                key:
+                  type: string
+                  description: The key for the field in Swimlane.
+                name:
+                  type: string
+                  description: The name of the field in Swimlane.
+            caseNameConfig:
+              title: Case name mapping
+              description: Mapping for the case name.
+              type: object
+              required:
+                - fieldType
+                - id
+                - key
+                - name
+              properties:
+                fieldType:
+                  type: string
+                  description: The type of field in Swimlane.
+                id:
+                  type: string
+                  description: The identifier for the field in Swimlane.
+                key:
+                  type: string
+                  description: The key for the field in Swimlane.
+                name:
+                  type: string
+                  description: The name of the field in Swimlane.
+            commentsConfig:
+              title: Case comment mapping
+              description: Mapping for the case comments.
+              type: object
+              required:
+                - fieldType
+                - id
+                - key
+                - name
+              properties:
+                fieldType:
+                  type: string
+                  description: The type of field in Swimlane.
+                id:
+                  type: string
+                  description: The identifier for the field in Swimlane.
+                key:
+                  type: string
+                  description: The key for the field in Swimlane.
+                name:
+                  type: string
+                  description: The name of the field in Swimlane.
+            descriptionConfig:
+              title: Case description mapping
+              description: Mapping for the case description.
+              type: object
+              required:
+                - fieldType
+                - id
+                - key
+                - name
+              properties:
+                fieldType:
+                  type: string
+                  description: The type of field in Swimlane.
+                id:
+                  type: string
+                  description: The identifier for the field in Swimlane.
+                key:
+                  type: string
+                  description: The key for the field in Swimlane.
+                name:
+                  type: string
+                  description: The name of the field in Swimlane.
+            ruleNameConfig:
+              title: Rule name mapping
+              description: Mapping for the name of the alert's rule.
+              type: object
+              required:
+                - fieldType
+                - id
+                - key
+                - name
+              properties:
+                fieldType:
+                  type: string
+                  description: The type of field in Swimlane.
+                id:
+                  type: string
+                  description: The identifier for the field in Swimlane.
+                key:
+                  type: string
+                  description: The key for the field in Swimlane.
+                name:
+                  type: string
+                  description: The name of the field in Swimlane.
+            severityConfig:
+              title: Severity mapping
+              description: Mapping for the severity.
+              type: object
+              required:
+                - fieldType
+                - id
+                - key
+                - name
+              properties:
+                fieldType:
+                  type: string
+                  description: The type of field in Swimlane.
+                id:
+                  type: string
+                  description: The identifier for the field in Swimlane.
+                key:
+                  type: string
+                  description: The key for the field in Swimlane.
+                name:
+                  type: string
+                  description: The name of the field in Swimlane.
+    secrets_properties_swimlane:
+      title: Connector secrets properties for a Swimlane connector
+      description: Defines secrets for connectors when type is `.swimlane`.
+      type: object
+      properties:
+        apiToken:
+          description: Swimlane API authentication token.
+          type: string
+    create_connector_request_swimlane:
+      title: Create Swimlane connector request
+      description: The Swimlane connector uses the Swimlane REST API to create Swimlane records.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_swimlane'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .swimlane
+          example: .swimlane
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_swimlane'
+    secrets_properties_teams:
+      title: Connector secrets properties for a Microsoft Teams connector
+      description: Defines secrets for connectors when type is `.teams`.
+      type: object
+      required:
+        - webhookUrl
+      properties:
+        webhookUrl:
+          type: string
+          description: |
+            The URL of the incoming webhook. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.
+    create_connector_request_teams:
+      title: Create Microsoft Teams connector request
+      description: The Microsoft Teams connector uses Incoming Webhooks.
+      type: object
+      required:
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .teams
+          example: .teams
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_teams'
+    config_properties_tines:
+      title: Connector request properties for a Tines connector
+      description: Defines properties for connectors when type is `.tines`.
+      type: object
+      required:
+        - url
+      properties:
+        url:
+          description: |
+            The Tines tenant URL. If you are using the `xpack.actions.allowedHosts` setting, make sure this hostname is added to the allowed hosts.
+          type: string
+    secrets_properties_tines:
+      title: Connector secrets properties for a Tines connector
+      description: Defines secrets for connectors when type is `.tines`.
+      type: object
+      required:
+        - email
+        - token
+      properties:
+        email:
+          description: The email used to sign in to Tines.
+          type: string
+        token:
+          description: The Tines API token.
+          type: string
+    create_connector_request_tines:
+      title: Create Tines connector request
+      description: |
+        The Tines connector uses Tines Webhook actions to send events via POST request.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_tines'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .tines
+          example: .tines
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_tines'
+    config_properties_torq:
+      title: Connector request properties for a Torq connector
+      description: Defines properties for connectors when type is `.torq`.
+      type: object
+      required:
+        - webhookIntegrationUrl
+      properties:
+        webhookIntegrationUrl:
+          description: The endpoint URL of the Elastic Security integration in Torq.
+          type: string
+    secrets_properties_torq:
+      title: Connector secrets properties for a Torq connector
+      description: Defines secrets for connectors when type is `.torq`.
+      type: object
+      required:
+        - token
+      properties:
+        token:
+          description: The secret of the webhook authentication header.
+          type: string
+    create_connector_request_torq:
+      title: Create Torq connector request
+      description: |
+        The Torq connector uses a Torq webhook to trigger workflows with Kibana actions.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_torq'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .torq
+          example: .torq
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_torq'
+    config_properties_webhook:
+      title: Connector request properties for a Webhook connector
+      description: Defines properties for connectors when type is `.webhook`.
+      type: object
+      properties:
+        authType:
+          type: string
+          enum:
+            - webhook-authentication-basic
+            - webhook-authentication-ssl
+            - 'null'
+          description: |
+            The type of authentication to use: basic, SSL, or none.
+        ca:
+          type: string
+          description: |
+            A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.
+        certType:
+          type: string
+          description: |
+            If the `authType` is `webhook-authentication-ssl`, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.
+          enum:
+            - ssl-crt-key
+            - ssl-pfx
+        hasAuth:
+          type: boolean
+          description: |
+            If `true`, a user name and password must be provided for login type authentication.
+        headers:
+          type: object
+          nullable: true
+          description: A set of key-value pairs sent as headers with the request.
+        method:
+          type: string
+          default: post
+          enum:
+            - post
+            - put
+          description: |
+            The HTTP request method, either `post` or `put`.
+        url:
+          type: string
+          description: |
+            The request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.
+        verificationMode:
+          type: string
+          enum:
+            - certificate
+            - full
+            - none
+          default: full
+          description: |
+            Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation.
+    secrets_properties_webhook:
+      title: Connector secrets properties for a Webhook connector
+      description: Defines secrets for connectors when type is `.webhook`.
+      type: object
+      properties:
+        crt:
+          type: string
+          description: If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the CRT or CERT file.
+        key:
+          type: string
+          description: If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the KEY file.
+        pfx:
+          type: string
+          description: If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-pfx`, it is a base64 encoded version of the PFX or P12 file.
+        password:
+          type: string
+          description: |
+            The password for HTTP basic authentication or the passphrase for the SSL certificate files. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.
+        user:
+          type: string
+          description: |
+            The username for HTTP basic authentication. If `hasAuth` is set to `true`  and `authType` is `webhook-authentication-basic`, this property is required.
+    create_connector_request_webhook:
+      title: Create Webhook connector request
+      description: |
+        The Webhook connector uses axios to send a POST or PUT request to a web service.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_webhook'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .webhook
+          example: .webhook
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_webhook'
+    config_properties_xmatters:
+      title: Connector request properties for an xMatters connector
+      description: Defines properties for connectors when type is `.xmatters`.
+      type: object
+      properties:
+        configUrl:
+          description: |
+            The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when `usesBasic` is `true`.
+          type: string
+          nullable: true
+        usesBasic:
+          description: Specifies whether the connector uses HTTP basic authentication (`true`) or URL authentication (`false`).
+          type: boolean
+          default: true
+    secrets_properties_xmatters:
+      title: Connector secrets properties for an xMatters connector
+      description: Defines secrets for connectors when type is `.xmatters`.
+      type: object
+      properties:
+        password:
+          description: |
+            A user name for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.
+          type: string
+        secretsUrl:
+          description: |
+            The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when `usesBasic` is `false`.
+          type: string
+        user:
+          description: |
+            A password for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.
+          type: string
+    create_connector_request_xmatters:
+      title: Create xMatters connector request
+      description: |
+        The xMatters connector uses the xMatters Workflow for Elastic to send actionable alerts to on-call xMatters resources.
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_xmatters'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .xmatters
+          example: .xmatters
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_xmatters'
+    create_connector_request:
+      title: Create connector request body properties
+      description: The properties vary depending on the connector type.
+      oneOf:
+        - $ref: '#/components/schemas/create_connector_request_bedrock'
+        - $ref: '#/components/schemas/create_connector_request_cases_webhook'
+        - $ref: '#/components/schemas/create_connector_request_d3security'
+        - $ref: '#/components/schemas/create_connector_request_email'
+        - $ref: '#/components/schemas/create_connector_request_genai'
+        - $ref: '#/components/schemas/create_connector_request_index'
+        - $ref: '#/components/schemas/create_connector_request_jira'
+        - $ref: '#/components/schemas/create_connector_request_opsgenie'
+        - $ref: '#/components/schemas/create_connector_request_pagerduty'
+        - $ref: '#/components/schemas/create_connector_request_resilient'
+        - $ref: '#/components/schemas/create_connector_request_serverlog'
+        - $ref: '#/components/schemas/create_connector_request_servicenow'
+        - $ref: '#/components/schemas/create_connector_request_servicenow_itom'
+        - $ref: '#/components/schemas/create_connector_request_servicenow_sir'
+        - $ref: '#/components/schemas/create_connector_request_slack_api'
+        - $ref: '#/components/schemas/create_connector_request_slack_webhook'
+        - $ref: '#/components/schemas/create_connector_request_swimlane'
+        - $ref: '#/components/schemas/create_connector_request_teams'
+        - $ref: '#/components/schemas/create_connector_request_tines'
+        - $ref: '#/components/schemas/create_connector_request_torq'
+        - $ref: '#/components/schemas/create_connector_request_webhook'
+        - $ref: '#/components/schemas/create_connector_request_xmatters'
+      discriminator:
+        propertyName: connector_type_id
+    is_deprecated:
+      type: boolean
+      description: Indicates whether the connector type is deprecated.
+      example: false
+    is_missing_secrets:
+      type: boolean
+      description: Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.
+      example: false
+    is_preconfigured:
+      type: boolean
+      description: |
+        Indicates whether it is a preconfigured connector. If true, the `config` and `is_missing_secrets` properties are omitted from the response. 
+      example: false
+    is_system_action:
+      type: boolean
+      description: Indicates whether the connector is used for system actions.
+      example: false
+    connector_response_properties_bedrock:
+      title: Connector response properties for an Amazon Bedrock connector
+      type: object
+      required:
+        - config
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_bedrock'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .bedrock
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+    referenced_by_count:
+      type: integer
+      description: |
+        Indicates the number of saved objects that reference the connector. If `is_preconfigured` is true, this value is not calculated. This property is returned only by the get all connectors API.
+      example: 2
+    connector_response_properties_cases_webhook:
+      title: Connector request properties for a Webhook - Case Management connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_cases_webhook'
+        connector_type_id:
+          description: The type of connector.
+          type: string
+          enum:
+            - .cases-webhook
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_d3security:
+      title: Connector response properties for a D3 Security connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_d3security'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .d3security
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_email:
+      title: Connector response properties for an email connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_email'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .email
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_index:
+      title: Connector response properties for an index connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_index'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .index
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_jira:
+      title: Connector response properties for a Jira connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_jira'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .jira
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_opsgenie:
+      title: Connector response properties for an Opsgenie connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_opsgenie'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .opsgenie
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_pagerduty:
+      title: Connector response properties for a PagerDuty connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_pagerduty'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .pagerduty
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_resilient:
+      title: Connector response properties for a IBM Resilient connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_resilient'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .resilient
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_serverlog:
+      title: Connector response properties for a server log connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          type: object
+          nullable: true
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .server-log
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_servicenow:
+      title: Connector response properties for a ServiceNow ITSM connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_servicenow'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .servicenow
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_servicenow_itom:
+      title: Connector response properties for a ServiceNow ITOM connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_servicenow_itom'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .servicenow-itom
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_servicenow_sir:
+      title: Connector response properties for a ServiceNow SecOps connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_servicenow'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .servicenow-sir
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_slack_api:
+      title: Connector response properties for a Slack connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .slack_api
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_slack_webhook:
+      title: Connector response properties for a Slack connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .slack
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_swimlane:
+      title: Connector response properties for a Swimlane connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_swimlane'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .swimlane
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_teams:
+      title: Connector response properties for a Microsoft Teams connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          type: object
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .teams
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_tines:
+      title: Connector response properties for a Tines connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_tines'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .tines
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_torq:
+      title: Connector response properties for a Torq connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_torq'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .torq
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_webhook:
+      title: Connector response properties for a Webhook connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_webhook'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .webhook
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties_xmatters:
+      title: Connector response properties for an xMatters connector
+      type: object
+      required:
+        - connector_type_id
+        - id
+        - is_deprecated
+        - is_preconfigured
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_xmatters'
+        connector_type_id:
+          type: string
+          description: The type of connector.
+          enum:
+            - .xmatters
+        id:
+          type: string
+          description: The identifier for the connector.
+        is_deprecated:
+          $ref: '#/components/schemas/is_deprecated'
+        is_missing_secrets:
+          $ref: '#/components/schemas/is_missing_secrets'
+        is_preconfigured:
+          $ref: '#/components/schemas/is_preconfigured'
+        is_system_action:
+          $ref: '#/components/schemas/is_system_action'
+        name:
+          type: string
+          description: The display name for the connector.
+        referenced_by_count:
+          $ref: '#/components/schemas/referenced_by_count'
+    connector_response_properties:
+      title: Connector response properties
+      description: The properties vary depending on the connector type.
+      oneOf:
+        - $ref: '#/components/schemas/connector_response_properties_bedrock'
+        - $ref: '#/components/schemas/connector_response_properties_cases_webhook'
+        - $ref: '#/components/schemas/connector_response_properties_d3security'
+        - $ref: '#/components/schemas/connector_response_properties_email'
+        - $ref: '#/components/schemas/connector_response_properties_index'
+        - $ref: '#/components/schemas/connector_response_properties_jira'
+        - $ref: '#/components/schemas/connector_response_properties_opsgenie'
+        - $ref: '#/components/schemas/connector_response_properties_pagerduty'
+        - $ref: '#/components/schemas/connector_response_properties_resilient'
+        - $ref: '#/components/schemas/connector_response_properties_serverlog'
+        - $ref: '#/components/schemas/connector_response_properties_servicenow'
+        - $ref: '#/components/schemas/connector_response_properties_servicenow_itom'
+        - $ref: '#/components/schemas/connector_response_properties_servicenow_sir'
+        - $ref: '#/components/schemas/connector_response_properties_slack_api'
+        - $ref: '#/components/schemas/connector_response_properties_slack_webhook'
+        - $ref: '#/components/schemas/connector_response_properties_swimlane'
+        - $ref: '#/components/schemas/connector_response_properties_teams'
+        - $ref: '#/components/schemas/connector_response_properties_tines'
+        - $ref: '#/components/schemas/connector_response_properties_torq'
+        - $ref: '#/components/schemas/connector_response_properties_webhook'
+        - $ref: '#/components/schemas/connector_response_properties_xmatters'
+      discriminator:
+        propertyName: connector_type_id
+    update_connector_request_bedrock:
+      title: Update Amazon Bedrock connector request
+      type: object
+      required:
+        - config
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_bedrock'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_bedrock'
+    update_connector_request_cases_webhook:
+      title: Update Webhook - Case Managment connector request
+      type: object
+      required:
+        - config
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_cases_webhook'
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_cases_webhook'
+    update_connector_request_d3security:
+      title: Update D3 Security connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_d3security'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_d3security'
+    update_connector_request_email:
+      title: Update email connector request
+      type: object
+      required:
+        - config
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_email'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_email'
+    update_connector_request_index:
+      title: Update index connector request
+      type: object
+      required:
+        - config
+        - name
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_index'
+        name:
+          type: string
+          description: The display name for the connector.
+    update_connector_request_jira:
+      title: Update Jira connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_jira'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_jira'
+    update_connector_request_opsgenie:
+      title: Update Opsgenie connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_opsgenie'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_opsgenie'
+    update_connector_request_pagerduty:
+      title: Update PagerDuty connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_pagerduty'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_pagerduty'
+    update_connector_request_resilient:
+      title: Update IBM Resilient connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_resilient'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_resilient'
+    update_connector_request_serverlog:
+      title: Update server log connector request
+      type: object
+      required:
+        - name
+      properties:
+        name:
+          type: string
+          description: The display name for the connector.
+    update_connector_request_servicenow:
+      title: Update ServiceNow ITSM connector or ServiceNow SecOps request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_servicenow'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_servicenow'
+    update_connector_request_servicenow_itom:
+      title: Create ServiceNow ITOM connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_servicenow_itom'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_servicenow'
+    update_connector_request_slack_api:
+      title: Update Slack connector request
+      type: object
+      required:
+        - name
+        - secrets
+      properties:
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_slack_api'
+    update_connector_request_slack_webhook:
+      title: Update Slack connector request
+      type: object
+      required:
+        - name
+        - secrets
+      properties:
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_slack_webhook'
+    update_connector_request_swimlane:
+      title: Update Swimlane connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_swimlane'
+        name:
+          type: string
+          description: The display name for the connector.
+          example: my-connector
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_swimlane'
+    update_connector_request_teams:
+      title: Update Microsoft Teams connector request
+      type: object
+      required:
+        - name
+        - secrets
+      properties:
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_teams'
+    update_connector_request_tines:
+      title: Update Tines connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_tines'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_tines'
+    update_connector_request_torq:
+      title: Update Torq connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_torq'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_torq'
+    update_connector_request_webhook:
+      title: Update Webhook connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_webhook'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_webhook'
+    update_connector_request_xmatters:
+      title: Update xMatters connector request
+      type: object
+      required:
+        - config
+        - name
+        - secrets
+      properties:
+        config:
+          $ref: '#/components/schemas/config_properties_xmatters'
+        name:
+          type: string
+          description: The display name for the connector.
+        secrets:
+          $ref: '#/components/schemas/secrets_properties_xmatters'
+    update_connector_request:
+      title: Update connector request body properties
+      description: The properties vary depending on the connector type.
+      oneOf:
+        - $ref: '#/components/schemas/update_connector_request_bedrock'
+        - $ref: '#/components/schemas/update_connector_request_cases_webhook'
+        - $ref: '#/components/schemas/update_connector_request_d3security'
+        - $ref: '#/components/schemas/update_connector_request_email'
+        - $ref: '#/components/schemas/create_connector_request_genai'
+        - $ref: '#/components/schemas/update_connector_request_index'
+        - $ref: '#/components/schemas/update_connector_request_jira'
+        - $ref: '#/components/schemas/update_connector_request_opsgenie'
+        - $ref: '#/components/schemas/update_connector_request_pagerduty'
+        - $ref: '#/components/schemas/update_connector_request_resilient'
+        - $ref: '#/components/schemas/update_connector_request_serverlog'
+        - $ref: '#/components/schemas/update_connector_request_servicenow'
+        - $ref: '#/components/schemas/update_connector_request_servicenow_itom'
+        - $ref: '#/components/schemas/update_connector_request_slack_api'
+        - $ref: '#/components/schemas/update_connector_request_slack_webhook'
+        - $ref: '#/components/schemas/update_connector_request_swimlane'
+        - $ref: '#/components/schemas/update_connector_request_teams'
+        - $ref: '#/components/schemas/update_connector_request_tines'
+        - $ref: '#/components/schemas/update_connector_request_torq'
+        - $ref: '#/components/schemas/update_connector_request_webhook'
+        - $ref: '#/components/schemas/update_connector_request_xmatters'
+    features:
+      type: string
+      description: |
+        The feature that uses the connector.
+      enum:
+        - alerting
+        - cases
+        - generativeAI
+        - siem
+        - uptime
+    connector_types:
+      title: Connector types
+      type: string
+      description: The type of connector. For example, `.email`, `.index`, `.jira`, `.opsgenie`, or `.server-log`.
+      enum:
+        - .bedrock
+        - .cases-webhook
+        - .d3security
+        - .email
+        - .gen-ai
+        - .index
+        - .jira
+        - .opsgenie
+        - .pagerduty
+        - .resilient
+        - .servicenow
+        - .servicenow-itom
+        - .servicenow-sir
+        - .server-log
+        - .slack
+        - .slack_api
+        - .swimlane
+        - .teams
+        - .tines
+        - .torq
+        - .webhook
+        - .xmatters
+      example: .server-log
+  examples:
+    create_email_connector_request:
+      summary: Create an email connector.
+      value:
+        name: email-connector-1
+        connector_type_id: .email
+        config:
+          from: tester@example.com
+          hasAuth: true
+          host: https://example.com
+          port: 1025
+          secure: false
+          service: other
+        secrets:
+          user: username
+          password: password
+    create_index_connector_request:
+      summary: Create an index connector.
+      value:
+        name: my-connector
+        connector_type_id: .index
+        config:
+          index: test-index
+    create_webhook_connector_request:
+      summary: Create a webhook connector with SSL authentication.
+      value:
+        name: my-webhook-connector
+        connector_type_id: .webhook
+        config:
+          method: post
+          url: https://example.com
+          authType: webhook-authentication-ssl
+          certType: ssl-crt-key
+        secrets:
+          crt: QmFnIEF0dH...
+          key: LS0tLS1CRUdJ...
+          password: my-passphrase
+    create_xmatters_connector_request:
+      summary: Create an xMatters connector with URL authentication.
+      value:
+        name: my-xmatters-connector
+        connector_type_id: .xmatters
+        config:
+          usesBasic: false
+        secrets:
+          secretsUrl: https://example.com?apiKey=xxxxx
+    create_email_connector_response:
+      summary: A new email connector.
+      value:
+        id: 90a82c60-478f-11ee-a343-f98a117c727f
+        connector_type_id: .email
+        name: email-connector-1
+        config:
+          from: tester@example.com
+          service: other
+          host: https://example.com
+          port: 1025
+          secure: false
+          hasAuth: true
+          tenantId: null
+          clientId: null
+          oauthTokenUrl: null
+        is_preconfigured: false
+        is_deprecated: false
+        is_missing_secrets: false
+        is_system_action: false
+    create_index_connector_response:
+      summary: A new index connector.
+      value:
+        id: c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad
+        connector_type_id: .index
+        name: my-connector
+        config:
+          index: test-index
+          refresh: false
+          executionTimeField: null
+        is_preconfigured: false
+        is_deprecated: false
+        is_missing_secrets: false
+        is_system_action: false
+    create_webhook_connector_response:
+      summary: A new webhook connector.
+      value:
+        id: 900eb010-3b9d-11ee-a642-8ffbb94e38bd
+        name: my-webhook-connector
+        config:
+          method: post
+          url: https://example.com
+          authType: webhook-authentication-ssl
+          certType: ssl-crt-key
+          verificationMode: full
+          headers: null
+          hasAuth: true
+        connector_type_id: .webhook
+        is_preconfigured: false
+        is_deprecated: false
+        is_missing_secrets: false
+        is_system_action: false
+    create_xmatters_connector_response:
+      summary: A new xMatters connector.
+      value:
+        id: 4d2d8da0-4d1f-11ee-9367-577408be4681
+        name: my-xmatters-connector
+        config:
+          usesBasic: false
+          configUrl: null
+        connector_type_id: .xmatters
+        is_preconfigured: false
+        is_deprecated: false
+        is_missing_secrets: false
+        is_system_action: false
+    get_connector_response:
+      summary: Get connector details.
+      value:
+        id: df770e30-8b8b-11ed-a780-3b746c987a81
+        name: my_server_log_connector
+        config: {}
+        connector_type_id: .server-log
+        is_preconfigured: false
+        is_deprecated: false
+        is_missing_secrets: false
+        is_system_action: false
+    update_index_connector_request:
+      summary: Update an index connector.
+      value:
+        name: updated-connector
+        config:
+          index: updated-index
+    get_connectors_response:
+      summary: A list of connectors
+      value:
+        - id: preconfigured-email-connector
+          name: my-preconfigured-email-notification
+          connector_type_id: .email
+          is_preconfigured: true
+          is_deprecated: false
+          referenced_by_count: 0
+          is_system_action: false
+        - id: e07d0c80-8b8b-11ed-a780-3b746c987a81
+          name: my-index-connector
+          config:
+            index: test-index
+            refresh: false
+            executionTimeField: null
+          connector_type_id: .index
+          is_preconfigured: false
+          is_deprecated: false
+          referenced_by_count: 2
+          is_missing_secrets: false
+          is_system_action: false
+    get_connector_types_generativeai_response:
+      summary: A list of connector types for the `generativeAI` feature.
+      value:
+        - id: .gen-ai
+          name: OpenAI
+          enabled: true
+          enabled_in_config: true
+          enabled_in_license: true
+          minimum_license_required: enterprise
+          supported_feature_ids:
+            - generativeAI
+          is_system_action_type: false
+        - id: .bedrock
+          name: AWS Bedrock
+          enabled: true
+          enabled_in_config: true
+          enabled_in_license: true
+          minimum_license_required: enterprise
+          supported_feature_ids:
+            - generativeAI
+          is_system_action_type: false
+  responses:
+    '401':
+      description: Authorization information is missing or invalid.
+      content:
+        application/json:
+          schema:
+            type: object
+            title: Unauthorized response
+            properties:
+              error:
+                type: string
+                example: Unauthorized
+                enum:
+                  - Unauthorized
+              message:
+                type: string
+              statusCode:
+                type: integer
+                example: 401
+                enum:
+                  - 401
+    '404':
+      description: Object is not found.
+      content:
+        application/json:
+          schema:
+            type: object
+            title: Not found response
+            properties:
+              error:
+                type: string
+                example: Not Found
+                enum:
+                  - Not Found
+              message:
+                type: string
+                example: Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found
+              statusCode:
+                type: integer
+                example: 404
+                enum:
+                  - 404
diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/get_connector_response.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/get_connector_response.yaml
index 6de6a030140e6..0c5ff80fe5884 100644
--- a/x-pack/plugins/actions/docs/openapi/components/examples/get_connector_response.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/examples/get_connector_response.yaml
@@ -1,4 +1,4 @@
-summary: A list of connector types
+summary: Get connector details.
 value:
   id: df770e30-8b8b-11ed-a780-3b746c987a81
   name: my_server_log_connector
diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/get_connector_types_generativeai_response.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/get_connector_types_generativeai_response.yaml
new file mode 100644
index 0000000000000..96eff6e72f247
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/examples/get_connector_types_generativeai_response.yaml
@@ -0,0 +1,20 @@
+summary: A list of connector types for the `generativeAI` feature.
+value:
+  - id: .gen-ai
+    name: OpenAI
+    enabled: true
+    enabled_in_config: true
+    enabled_in_license: true
+    minimum_license_required: enterprise
+    supported_feature_ids:
+      - generativeAI
+    is_system_action_type: false
+  - id: .bedrock
+    name: AWS Bedrock
+    enabled: true
+    enabled_in_config: true
+    enabled_in_license: true
+    minimum_license_required: enterprise
+    supported_feature_ids:
+      - generativeAI
+    is_system_action_type: false
diff --git a/x-pack/plugins/actions/docs/openapi/components/responses/400.yaml b/x-pack/plugins/actions/docs/openapi/components/responses/400.yaml
new file mode 100644
index 0000000000000..263623dd1fb4c
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/responses/400.yaml
@@ -0,0 +1,15 @@
+description: Indicates a bad request.
+content:
+  application/json:
+    schema:
+      type: object
+      properties:
+        error: 
+          type: string
+          example: Bad Request
+        message:
+          type: string
+          example: "error validating action type config: [index]: expected value of type [string] but got [undefined]"
+        statusCode:
+          type: integer
+          example: 400
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties.yaml
index edef270fd75ae..4b4213b769e3b 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties.yaml
@@ -1,6 +1,7 @@
 title: Connector response properties
 description: The properties vary depending on the connector type.        
 oneOf:
+  - $ref: 'connector_response_properties_bedrock.yaml'
   - $ref: 'connector_response_properties_cases_webhook.yaml'
   - $ref: 'connector_response_properties_d3security.yaml'
   - $ref: 'connector_response_properties_email.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_cases_webhook.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_cases_webhook.yaml
index 70e9a48910c80..29b746e4d1f67 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_cases_webhook.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_cases_webhook.yaml
@@ -1,7 +1,6 @@
 title: Connector request properties for a Webhook - Case Management connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_d3security.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_d3security.yaml
index 694b7c011b84a..e089b079b9077 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_d3security.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_d3security.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a D3 Security connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_email.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_email.yaml
index b84dff4f53106..cfe6e97fc61a9 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_email.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_email.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for an email connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_genai.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_genai.yaml
index 928147ed87a69..0d1bbb93f854d 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_genai.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_genai.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for an OpenAI connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_index.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_index.yaml
index 5e76416f25210..8e5fe0ba9b892 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_index.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_index.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for an index connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -28,4 +27,6 @@ properties:
     $ref: 'is_system_action.yaml'
   name:
     type: string
-    description: The display name for the connector.
\ No newline at end of file
+    description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_jira.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_jira.yaml
index f61381af96396..b822d82ba10f9 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_jira.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_jira.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a Jira connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_opsgenie.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_opsgenie.yaml
index f44f79f8e7013..9ac5d91b25c80 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_opsgenie.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_opsgenie.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for an Opsgenie connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_pagerduty.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_pagerduty.yaml
index 0002e684c2f5e..f8616900b01d0 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_pagerduty.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_pagerduty.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a PagerDuty connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_resilient.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_resilient.yaml
index fc2a239d29a4e..489e5ab27abfc 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_resilient.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_resilient.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a IBM Resilient connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_serverlog.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_serverlog.yaml
index bd41b62a114c7..a397e668102a6 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_serverlog.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_serverlog.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a server log connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -30,3 +29,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow.yaml
index 104e7174467a4..98ac4d3daf31d 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a ServiceNow ITSM connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow_itom.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow_itom.yaml
index 5651629365bbd..27cfe9d0dca6a 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow_itom.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow_itom.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a ServiceNow ITOM connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow_sir.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow_sir.yaml
index 4b24b3c0e7a62..9d5a2b7ab2e2e 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow_sir.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_servicenow_sir.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a ServiceNow SecOps connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_slack_api.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_slack_api.yaml
index 76510f2511dd2..56c4f488a35af 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_slack_api.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_slack_api.yaml
@@ -26,3 +26,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_slack_webhook.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_slack_webhook.yaml
index 7b0de9d2c27ca..a9dfd3dc9e857 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_slack_webhook.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_slack_webhook.yaml
@@ -26,3 +26,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_swimlane.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_swimlane.yaml
index ea645598de5b7..4c239f21a5db5 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_swimlane.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_swimlane.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a Swimlane connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_teams.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_teams.yaml
index 3e0dc777efa98..939f4014763d9 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_teams.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_teams.yaml
@@ -28,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_tines.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_tines.yaml
index 1468becee8551..5fcd24511580f 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_tines.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_tines.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a Tines connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_torq.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_torq.yaml
index 135d5e9db6cb4..b22b6f0a872fc 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_torq.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_torq.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a Torq connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_webhook.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_webhook.yaml
index 8d0dfdac5fbe6..3469f52c5965d 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_webhook.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_webhook.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for a Webhook connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,6 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
+
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_xmatters.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_xmatters.yaml
index 3f9e35eba8d6a..ead2e18149522 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_xmatters.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/connector_response_properties_xmatters.yaml
@@ -1,7 +1,6 @@
 title: Connector response properties for an xMatters connector
 type: object
 required:
-  - config
   - connector_type_id
   - id
   - is_deprecated
@@ -29,3 +28,5 @@ properties:
   name:
     type: string
     description: The display name for the connector.
+  referenced_by_count:
+    $ref: 'referenced_by_count.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/create_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/create_connector_request.yaml
new file mode 100644
index 0000000000000..3bcf6cc0c3ccb
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/create_connector_request.yaml
@@ -0,0 +1,28 @@
+title: Create connector request body properties
+description: The properties vary depending on the connector type.
+oneOf:
+  - $ref: 'create_connector_request_bedrock.yaml'
+  - $ref: 'create_connector_request_cases_webhook.yaml'
+  - $ref: 'create_connector_request_d3security.yaml'
+  - $ref: 'create_connector_request_email.yaml'
+  - $ref: 'create_connector_request_genai.yaml'
+  - $ref: 'create_connector_request_index.yaml'
+  - $ref: 'create_connector_request_jira.yaml'
+  - $ref: 'create_connector_request_opsgenie.yaml'
+  - $ref: 'create_connector_request_pagerduty.yaml'
+  - $ref: 'create_connector_request_resilient.yaml'
+  - $ref: 'create_connector_request_serverlog.yaml'
+  - $ref: 'create_connector_request_servicenow.yaml'
+  - $ref: 'create_connector_request_servicenow_itom.yaml'
+  - $ref: 'create_connector_request_servicenow_sir.yaml'
+  - $ref: 'create_connector_request_slack_api.yaml'
+  - $ref: 'create_connector_request_slack_webhook.yaml'
+  - $ref: 'create_connector_request_swimlane.yaml'
+  - $ref: 'create_connector_request_teams.yaml'
+  - $ref: 'create_connector_request_tines.yaml'
+  - $ref: 'create_connector_request_torq.yaml'
+  - $ref: 'create_connector_request_webhook.yaml'
+  - $ref: 'create_connector_request_xmatters.yaml'
+discriminator:
+  propertyName: connector_type_id
+        
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/features.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/features.yaml
index 059e91cd79c7e..e75b745957552 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/features.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/features.yaml
@@ -1,8 +1,9 @@
 type: string
 description: >
-  The feature that uses the connector. Valid values are `alerting`, `cases`, `uptime`, and `siem`.
+  The feature that uses the connector.
 enum:
   - alerting 
   - cases
-  - uptime
-  - siem
\ No newline at end of file
+  - generativeAI
+  - siem
+  - uptime
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/is_preconfigured.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/is_preconfigured.yaml
index 11991d878721a..e38741c83718e 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/is_preconfigured.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/is_preconfigured.yaml
@@ -1,3 +1,5 @@
 type: boolean
-description: Indicates whether it is a preconfigured connector. If true, the `config` and `is_missing_secrets` properties are omitted from the response. 
+description: >
+  Indicates whether it is a preconfigured connector.
+  If true, the `config` and `is_missing_secrets` properties are omitted from the response. 
 example: false
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/referenced_by_count.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/referenced_by_count.yaml
new file mode 100644
index 0000000000000..61579fa3dc6ce
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/referenced_by_count.yaml
@@ -0,0 +1,6 @@
+type: integer
+description: >
+  Indicates the number of saved objects that reference the connector.
+  If `is_preconfigured` is true, this value is not calculated.
+  This property is returned only by the get all connectors API.
+example: 2
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml
new file mode 100644
index 0000000000000..a313de571b501
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml
@@ -0,0 +1,26 @@
+title: Run connector request body properties
+description: The properties vary depending on the connector type.
+type: object
+required: 
+  - params
+properties:
+  params:
+    oneOf:
+      - $ref: 'run_connector_params_documents.yaml'
+      - $ref: 'run_connector_params_level_message.yaml'
+      - title: Subaction parameters
+        description: Test an action that involves a subaction.
+        oneOf:
+          - $ref: 'run_connector_subaction_addevent.yaml'
+          - $ref: 'run_connector_subaction_closealert.yaml'
+          - $ref: 'run_connector_subaction_createalert.yaml'
+          - $ref: 'run_connector_subaction_fieldsbyissuetype.yaml'
+          - $ref: 'run_connector_subaction_getchoices.yaml'
+          - $ref: 'run_connector_subaction_getfields.yaml'
+          - $ref: 'run_connector_subaction_getincident.yaml'
+          - $ref: 'run_connector_subaction_issue.yaml'
+          - $ref: 'run_connector_subaction_issues.yaml'
+          - $ref: 'run_connector_subaction_issuetypes.yaml'
+          - $ref: 'run_connector_subaction_pushtoservice.yaml'
+        discriminator:
+          propertyName: subAction
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/update_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/update_connector_request.yaml
new file mode 100644
index 0000000000000..269cd79847277
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/update_connector_request.yaml
@@ -0,0 +1,24 @@
+title: Update connector request body properties
+description: The properties vary depending on the connector type.
+oneOf:
+  - $ref: 'update_connector_request_bedrock.yaml'
+  - $ref: 'update_connector_request_cases_webhook.yaml'
+  - $ref: 'update_connector_request_d3security.yaml'
+  - $ref: 'update_connector_request_email.yaml'
+  - $ref: 'create_connector_request_genai.yaml'
+  - $ref: 'update_connector_request_index.yaml'  
+  - $ref: 'update_connector_request_jira.yaml'
+  - $ref: 'update_connector_request_opsgenie.yaml'
+  - $ref: 'update_connector_request_pagerduty.yaml' 
+  - $ref: 'update_connector_request_resilient.yaml'
+  - $ref: 'update_connector_request_serverlog.yaml'
+  - $ref: 'update_connector_request_servicenow.yaml'
+  - $ref: 'update_connector_request_servicenow_itom.yaml'
+  - $ref: 'update_connector_request_slack_api.yaml'
+  - $ref: 'update_connector_request_slack_webhook.yaml'
+  - $ref: 'update_connector_request_swimlane.yaml' 
+  - $ref: 'update_connector_request_teams.yaml'
+  - $ref: 'update_connector_request_tines.yaml'
+  - $ref: 'update_connector_request_torq.yaml'
+  - $ref: 'update_connector_request_webhook.yaml'
+  - $ref: 'update_connector_request_xmatters.yaml'
\ No newline at end of file
diff --git a/x-pack/plugins/actions/docs/openapi/entrypoint.yaml b/x-pack/plugins/actions/docs/openapi/entrypoint.yaml
index 04e844607f827..1f85d4a44c37b 100644
--- a/x-pack/plugins/actions/docs/openapi/entrypoint.yaml
+++ b/x-pack/plugins/actions/docs/openapi/entrypoint.yaml
@@ -15,24 +15,34 @@ servers:
   - url: 'http://localhost:5601'
     description: local
 paths:
-   '/s/{spaceId}/api/actions/connector':
+  '/api/actions/connector':
+    $ref: 'paths/api@actions@connector.yaml'
+  '/api/actions/connector/{connectorId}':
+    $ref: 'paths/api@actions@connector@{connectorid}.yaml'
+  '/api/actions/connector/{connectorId}/_execute':
+    $ref: paths/api@actions@connector@{connectorid}@_execute.yaml
+  '/api/actions/connectors':
+    $ref: paths/api@actions@connectors.yaml
+  '/api/actions/connector_types':
+    $ref: paths/api@actions@connector_types.yaml
+  '/s/{spaceId}/api/actions/connector':
     $ref: 'paths/s@{spaceid}@api@actions@connector.yaml'
-   '/s/{spaceId}/api/actions/connector/{connectorId}':
+  '/s/{spaceId}/api/actions/connector/{connectorId}':
     $ref: 'paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml'
-   '/s/{spaceId}/api/actions/connectors':
+  '/s/{spaceId}/api/actions/connectors':
     $ref: paths/s@{spaceid}@api@actions@connectors.yaml
-   '/s/{spaceId}/api/actions/connector_types':
+  '/s/{spaceId}/api/actions/connector_types':
     $ref: paths/s@{spaceid}@api@actions@connector_types.yaml
-   '/s/{spaceId}/api/actions/connector/{connectorId}/_execute':
+  '/s/{spaceId}/api/actions/connector/{connectorId}/_execute':
     $ref: paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml
 # Deprecated endpoints:
-   '/s/{spaceId}/api/actions/action/{actionId}':
+  '/s/{spaceId}/api/actions/action/{actionId}':
     $ref: 'paths/s@{spaceid}@api@actions@action@{actionid}.yaml'
-   '/s/{spaceId}/api/actions':
+  '/s/{spaceId}/api/actions':
     $ref: 'paths/s@{spaceid}@api@actions.yaml'
-   '/s/{spaceId}/api/actions/list_action_types':
+  '/s/{spaceId}/api/actions/list_action_types':
     $ref: 'paths/s@{spaceid}@api@actions@list_action_types.yaml'
-   '/s/{spaceId}/api/actions/action/{actionId}/_execute':
+  '/s/{spaceId}/api/actions/action/{actionId}/_execute':
     $ref: 'paths/s@{spaceid}@api@actions@action@{actionid}@_execute.yaml'
 components:
   securitySchemes:
diff --git a/x-pack/plugins/actions/docs/openapi/entrypoint_serverless.yaml b/x-pack/plugins/actions/docs/openapi/entrypoint_serverless.yaml
new file mode 100644
index 0000000000000..1cfccf790903a
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/entrypoint_serverless.yaml
@@ -0,0 +1,33 @@
+openapi: 3.0.1
+info:
+  title: Connectors
+  description: OpenAPI schema for connectors in Serverless projects
+  version: '0.1'
+  contact:
+    name: Connectors Team
+  license:
+    name: Elastic License 2.0
+    url: https://www.elastic.co/licensing/elastic-license
+tags:
+  - name: connectors
+    description: Connector APIs enable you to create and manage connectors.
+servers:
+  - url: 'http://localhost:5601'
+    description: local
+paths:
+  '/api/actions/connector':
+    $ref: 'paths/api@actions@connector.yaml'
+  '/api/actions/connector/{connectorId}':
+    $ref: 'paths/api@actions@connector@{connectorid}.yaml'
+  '/api/actions/connectors':
+    $ref: paths/api@actions@connectors.yaml
+  '/api/actions/connector_types':
+    $ref: paths/api@actions@connector_types.yaml
+components:
+  securitySchemes:
+    apiKeyAuth:
+      type: apiKey
+      in: header
+      name: ApiKey
+security:
+  - apiKeyAuth: []
diff --git a/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector.yaml b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector.yaml
new file mode 100644
index 0000000000000..9c5e69a53e24f
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector.yaml
@@ -0,0 +1,44 @@
+post:
+  summary: Creates a connector.
+  operationId: createConnector
+  tags:
+    - connectors
+  parameters:
+    - $ref: '../components/headers/kbn_xsrf.yaml'
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          $ref: '../components/schemas/create_connector_request.yaml'
+        examples:
+          createEmailConnectorRequest:
+            $ref: '../components/examples/create_email_connector_request.yaml'
+          createIndexConnectorRequest:
+            $ref: '../components/examples/create_index_connector_request.yaml'
+          createWebhookConnectorRequest:
+            $ref: '../components/examples/create_webhook_connector_request.yaml'
+          createXmattersConnectorRequest:
+            $ref: '../components/examples/create_xmatters_connector_request.yaml'
+  responses:
+    '200':
+      description: Indicates a successful call.
+      content:
+         application/json:
+          schema:
+            $ref: '../components/schemas/connector_response_properties.yaml'
+          examples:
+            createEmailConnectorResponse:
+              $ref: '../components/examples/create_email_connector_response.yaml'
+            createIndexConnectorResponse:
+              $ref: '../components/examples/create_index_connector_response.yaml'
+            createWebhookConnectorResponse:
+              $ref: '../components/examples/create_webhook_connector_response.yaml'
+            createXmattersConnectorResponse:
+              $ref: '../components/examples/create_xmatters_connector_response.yaml'
+    '401':
+      $ref: '../components/responses/401.yaml'
+  servers:
+    - url: https://localhost:5601
+servers:
+  - url: https://localhost:5601
diff --git a/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}.yaml b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}.yaml
new file mode 100644
index 0000000000000..f9f483f747635
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}.yaml
@@ -0,0 +1,116 @@
+get:
+  summary: Retrieves a connector by ID.
+  operationId: getConnector
+  tags:
+    - connectors
+  parameters:
+    - $ref: '../components/parameters/connector_id.yaml'
+  responses:
+    '200':
+      description: Indicates a successful call.
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/connector_response_properties.yaml'
+          examples:
+            getConnectorResponse:
+              $ref: '../components/examples/get_connector_response.yaml'
+    '401':
+      $ref: '../components/responses/401.yaml'
+    '404':
+      $ref: '../components/responses/404.yaml'
+  servers:
+    - url: https://localhost:5601
+
+delete:
+  summary: Deletes a connector.
+  operationId: deleteConnector
+  tags:
+    - connectors
+  parameters:
+    - $ref: '../components/headers/kbn_xsrf.yaml'
+    - $ref: '../components/parameters/connector_id.yaml'
+  responses:
+    '204':
+      description: Indicates a successful call.
+    '401':
+      $ref: '../components/responses/401.yaml'
+    '404':
+      $ref: '../components/responses/404.yaml'
+  servers:
+    - url: https://localhost:5601
+
+post:
+  summary: Creates a connector.
+  operationId: createConnectorId
+  tags:
+    - connectors
+  parameters:
+    - $ref: '../components/headers/kbn_xsrf.yaml'
+    - in: path
+      name: connectorId
+      description: >
+        A UUID v1 or v4 identifier for the connector.
+        If you omit this parameter, an identifier is randomly generated.
+      required: true
+      schema:
+        type: string
+        example: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          $ref: '../components/schemas/create_connector_request.yaml'
+        examples:
+          createIndexConnectorRequest:
+            $ref: '../components/examples/create_index_connector_request.yaml'
+  responses:
+    '200':
+      description: Indicates a successful call.
+      content:
+         application/json:
+          schema:
+            $ref: '../components/schemas/connector_response_properties.yaml'
+          examples:
+            createIndexConnectorResponse:
+              $ref: '../components/examples/create_index_connector_response.yaml'
+    '401':
+      $ref: '../components/responses/401.yaml'
+  servers:
+    - url: https://localhost:5601
+
+put:
+  summary: Updates the attributes for a connector.
+  operationId: updateConnector
+  tags:
+    - connectors
+  parameters:
+    - $ref: '../components/headers/kbn_xsrf.yaml'
+    - $ref: '../components/parameters/connector_id.yaml'
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          $ref: '../components/schemas/update_connector_request.yaml'
+        examples:
+          updateIndexConnectorRequest:
+            $ref: '../components/examples/update_index_connector_request.yaml'
+  responses:
+    '200':
+      description: Indicates a successful call.
+      content:
+         application/json:
+          schema:
+            $ref: '../components/schemas/connector_response_properties.yaml'
+    '400':
+      $ref: '../components/responses/401.yaml'
+    '401':
+      $ref: '../components/responses/401.yaml'
+    '404':
+      $ref: '../components/responses/404.yaml'
+  servers:
+    - url: https://localhost:5601
+servers:
+  - url: https://localhost:5601
diff --git a/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}@_execute.yaml b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}@_execute.yaml
new file mode 100644
index 0000000000000..a876584ca4e8e
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector@{connectorid}@_execute.yaml
@@ -0,0 +1,75 @@
+post:
+  summary: Runs a connector.
+  operationId: runConnector
+  description: >
+    You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
+    You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
+    If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges.
+  tags:
+    - connectors
+  parameters:
+    - $ref: '../components/headers/kbn_xsrf.yaml'
+    - $ref: '../components/parameters/connector_id.yaml'
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          $ref: '../components/schemas/run_connector_request.yaml'
+        examples:
+          runIndexConnectorRequest:
+            $ref: '../components/examples/run_index_connector_request.yaml'
+          runJiraConnectorRequest:
+            $ref: '../components/examples/run_jira_connector_request.yaml'
+          runServerLogConnectorRequest:
+            $ref: '../components/examples/run_server_log_connector_request.yaml'
+          runServiceNowITOMConnectorRequest:
+            $ref: '../components/examples/run_servicenow_itom_connector_request.yaml'
+          runSwimlaneConnectorRequest:
+            $ref: '../components/examples/run_swimlane_connector_request.yaml'
+  responses:
+    '200':
+      description: Indicates a successful call.
+      content:
+        application/json:
+          schema:
+            type: object
+            required:
+              - connector_id
+              - status
+            properties:
+              connector_id:
+                type: string
+                description: The identifier for the connector.
+              data:
+                oneOf:
+                  - type: object
+                    description: Information returned from the action.
+                    additionalProperties: true
+                  - type: array
+                    description: An array of information returned from the action.
+                    items:
+                      type: object
+              status:
+                type: string
+                description: The status of the action.
+                enum:
+                  - error
+                  - ok
+          examples:
+            runIndexConnectorResponse:
+              $ref: '../components/examples/run_index_connector_response.yaml'
+            runJiraConnectorResponse:
+              $ref: '../components/examples/run_jira_connector_response.yaml'
+            runServerLogConnectorResponse:
+              $ref: '../components/examples/run_server_log_connector_response.yaml'
+            runServiceNowITOMConnectorResponse:
+              $ref: '../components/examples/run_servicenow_itom_connector_response.yaml'
+            runSwimlaneConnectorResponse:
+              $ref: '../components/examples/run_swimlane_connector_response.yaml'
+    '401':
+      $ref: '../components/responses/401.yaml'
+  servers:
+    - url: https://localhost:5601
+servers:
+  - url: https://localhost:5601
diff --git a/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector_types.yaml b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector_types.yaml
new file mode 100644
index 0000000000000..30247d47b24c9
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connector_types.yaml
@@ -0,0 +1,66 @@
+get:
+  summary: Retrieves a list of all connector types.
+  operationId: getConnectorTypes
+  tags:
+    - connectors
+  parameters:
+    - in: query
+      name: feature_id
+      description: A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).
+      schema:
+        $ref: '../components/schemas/features.yaml'
+  responses:
+    '200':
+      description: Indicates a successful call.
+      content:
+        application/json:
+          schema:
+            title: Get connector types response body properties
+            description: The properties vary for each connector type.
+            type: array
+            items:
+              type: object
+              properties:
+                enabled:
+                  type: boolean
+                  description: Indicates whether the connector type is enabled in Kibana.
+                  example: true
+                enabled_in_config:
+                  type: boolean
+                  description: Indicates whether the connector type is enabled in the Kibana configuration file.
+                  example: true
+                enabled_in_license:
+                  type: boolean
+                  description: Indicates whether the connector is enabled in the license.
+                  example: true
+                id:
+                  $ref: '../components/schemas/connector_types.yaml'
+                is_system_action_type:
+                  type: boolean
+                  example: false
+                minimum_license_required:
+                  type: string
+                  description: The license that is required to use the connector type.
+                  example: basic
+                name:
+                  type: string
+                  description: The name of the connector type.
+                  example: Index
+                supported_feature_ids:
+                  type: array
+                  description: The features that are supported by the connector type.
+                  items:
+                    $ref: '../components/schemas/features.yaml'
+                  example:
+                    - alerting
+                    - cases
+                    - siem
+          examples:
+            getConnectorTypesServerlessResponse:
+              $ref: '../components/examples/get_connector_types_generativeai_response.yaml'
+    '401':
+      $ref: '../components/responses/401.yaml'
+  servers:
+    - url: https://localhost:5601
+servers:
+  - url: https://localhost:5601
diff --git a/x-pack/plugins/actions/docs/openapi/paths/api@actions@connectors.yaml b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connectors.yaml
new file mode 100644
index 0000000000000..b350251dde206
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/paths/api@actions@connectors.yaml
@@ -0,0 +1,23 @@
+get:
+  summary: Retrieves all connectors.
+  operationId: getConnectors
+  tags:
+    - connectors
+  responses:
+    '200':
+      description: Indicates a successful call.
+      content:
+        application/json:
+          schema:
+            type: array
+            items:
+              $ref: '../components/schemas/connector_response_properties.yaml'
+          examples:
+            getConnectorsResponse:
+              $ref: '../components/examples/get_connectors_response.yaml'
+    '401':
+      $ref: '../components/responses/401.yaml'
+  servers:
+    - url: https://localhost:5601
+servers:
+  - url: https://localhost:5601
diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector.yaml
index 64712858fa8a0..86e8cc1d0bfe0 100644
--- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector.yaml
+++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector.yaml
@@ -1,6 +1,6 @@
 post:
   summary: Creates a connector.
-  operationId: createConnector
+  operationId: createConnectorWithSpaceId
   description: >
     You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
   tags:
@@ -13,33 +13,7 @@ post:
     content:
       application/json:
         schema:
-          title: Create connector request body properties
-          description: The properties vary depending on the connector type.
-          oneOf:
-            - $ref: '../components/schemas/create_connector_request_bedrock.yaml'
-            - $ref: '../components/schemas/create_connector_request_cases_webhook.yaml'
-            - $ref: '../components/schemas/create_connector_request_d3security.yaml'
-            - $ref: '../components/schemas/create_connector_request_email.yaml'
-            - $ref: '../components/schemas/create_connector_request_genai.yaml'
-            - $ref: '../components/schemas/create_connector_request_index.yaml'
-            - $ref: '../components/schemas/create_connector_request_jira.yaml'
-            - $ref: '../components/schemas/create_connector_request_opsgenie.yaml'
-            - $ref: '../components/schemas/create_connector_request_pagerduty.yaml'
-            - $ref: '../components/schemas/create_connector_request_resilient.yaml'
-            - $ref: '../components/schemas/create_connector_request_serverlog.yaml'
-            - $ref: '../components/schemas/create_connector_request_servicenow.yaml'
-            - $ref: '../components/schemas/create_connector_request_servicenow_itom.yaml'
-            - $ref: '../components/schemas/create_connector_request_servicenow_sir.yaml'
-            - $ref: '../components/schemas/create_connector_request_slack_api.yaml'
-            - $ref: '../components/schemas/create_connector_request_slack_webhook.yaml'
-            - $ref: '../components/schemas/create_connector_request_swimlane.yaml'
-            - $ref: '../components/schemas/create_connector_request_teams.yaml'
-            - $ref: '../components/schemas/create_connector_request_tines.yaml'
-            - $ref: '../components/schemas/create_connector_request_torq.yaml'
-            - $ref: '../components/schemas/create_connector_request_webhook.yaml'
-            - $ref: '../components/schemas/create_connector_request_xmatters.yaml'
-          discriminator:
-            propertyName: connector_type_id
+          $ref: '../components/schemas/create_connector_request.yaml'
         examples:
           createEmailConnectorRequest:
             $ref: '../components/examples/create_email_connector_request.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml
index 7c1d402efaca4..0edbd0a0ed2d1 100644
--- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml
+++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml
@@ -1,6 +1,6 @@
 get:
   summary: Retrieves a connector by ID.
-  operationId: getConnector
+  operationId: getConnectorWithSpaceId
   description: >
     You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
   tags:
@@ -21,27 +21,13 @@ get:
     '401':
       $ref: '../components/responses/401.yaml'
     '404':
-      description: Object is not found.
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              error:
-                type: string
-                example: Not Found
-              message:
-                type: string
-                example: "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found"
-              statusCode:
-                type: integer
-                example: 404
+      $ref: '../components/responses/404.yaml'
   servers:
     - url: https://localhost:5601
 
 delete:
   summary: Deletes a connector.
-  operationId: deleteConnector
+  operationId: deleteConnectorWithSpaceId
   description: >
     You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
     WARNING: When you delete a connector, it cannot be recovered.
@@ -57,27 +43,13 @@ delete:
     '401':
       $ref: '../components/responses/401.yaml'
     '404':
-      description: Object is not found.
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              error:
-                type: string
-                example: Not Found
-              message:
-                type: string
-                example: "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found"
-              statusCode:
-                type: integer
-                example: 404
+      $ref: '../components/responses/404.yaml'
   servers:
     - url: https://localhost:5601
 
 post:
   summary: Creates a connector.
-  operationId: createConnectorId
+  operationId: createConnectorIdWithSpaceId
   description: >
     You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
   tags:
@@ -97,33 +69,7 @@ post:
     content:
       application/json:
         schema:
-          title: Create connector request body properties
-          description: The properties vary depending on the connector type.
-          oneOf:
-            - $ref: '../components/schemas/create_connector_request_bedrock.yaml'
-            - $ref: '../components/schemas/create_connector_request_cases_webhook.yaml'
-            - $ref: '../components/schemas/create_connector_request_d3security.yaml'
-            - $ref: '../components/schemas/create_connector_request_email.yaml'
-            - $ref: '../components/schemas/create_connector_request_genai.yaml'
-            - $ref: '../components/schemas/create_connector_request_index.yaml'
-            - $ref: '../components/schemas/create_connector_request_jira.yaml'
-            - $ref: '../components/schemas/create_connector_request_opsgenie.yaml'
-            - $ref: '../components/schemas/create_connector_request_pagerduty.yaml'
-            - $ref: '../components/schemas/create_connector_request_resilient.yaml'
-            - $ref: '../components/schemas/create_connector_request_serverlog.yaml'
-            - $ref: '../components/schemas/create_connector_request_servicenow.yaml'
-            - $ref: '../components/schemas/create_connector_request_servicenow_itom.yaml'
-            - $ref: '../components/schemas/create_connector_request_servicenow_sir.yaml'
-            - $ref: '../components/schemas/create_connector_request_slack_api.yaml'
-            - $ref: '../components/schemas/create_connector_request_slack_webhook.yaml'
-            - $ref: '../components/schemas/create_connector_request_swimlane.yaml'
-            - $ref: '../components/schemas/create_connector_request_teams.yaml'
-            - $ref: '../components/schemas/create_connector_request_tines.yaml'
-            - $ref: '../components/schemas/create_connector_request_torq.yaml'
-            - $ref: '../components/schemas/create_connector_request_webhook.yaml'
-            - $ref: '../components/schemas/create_connector_request_xmatters.yaml'
-          discriminator:
-            propertyName: connector_type_id
+          $ref: '../components/schemas/create_connector_request.yaml'
         examples:
           createIndexConnectorRequest:
             $ref: '../components/examples/create_index_connector_request.yaml'
@@ -144,7 +90,7 @@ post:
 
 put:
   summary: Updates the attributes for a connector.
-  operationId: updateConnector
+  operationId: updateConnectorWithSpaceId
   description: >
     You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
   tags:
@@ -158,30 +104,7 @@ put:
     content:
       application/json:
         schema:
-          title: Update connector request body properties
-          description: The properties vary depending on the connector type.
-          oneOf:
-            - $ref: '../components/schemas/create_connector_request_bedrock.yaml'
-            - $ref: '../components/schemas/update_connector_request_cases_webhook.yaml'
-            - $ref: '../components/schemas/update_connector_request_d3security.yaml'
-            - $ref: '../components/schemas/update_connector_request_email.yaml'
-            - $ref: '../components/schemas/create_connector_request_genai.yaml'
-            - $ref: '../components/schemas/update_connector_request_index.yaml'  
-            - $ref: '../components/schemas/update_connector_request_jira.yaml'
-            - $ref: '../components/schemas/update_connector_request_opsgenie.yaml'
-            - $ref: '../components/schemas/update_connector_request_pagerduty.yaml' 
-            - $ref: '../components/schemas/update_connector_request_resilient.yaml'
-            - $ref: '../components/schemas/update_connector_request_serverlog.yaml'
-            - $ref: '../components/schemas/update_connector_request_servicenow.yaml'
-            - $ref: '../components/schemas/update_connector_request_servicenow_itom.yaml'
-            - $ref: '../components/schemas/update_connector_request_slack_api.yaml'
-            - $ref: '../components/schemas/update_connector_request_slack_webhook.yaml'
-            - $ref: '../components/schemas/update_connector_request_swimlane.yaml' 
-            - $ref: '../components/schemas/update_connector_request_teams.yaml'
-            - $ref: '../components/schemas/update_connector_request_tines.yaml'
-            - $ref: '../components/schemas/update_connector_request_torq.yaml'
-            - $ref: '../components/schemas/update_connector_request_webhook.yaml'
-            - $ref: '../components/schemas/update_connector_request_xmatters.yaml'
+          $ref: '../components/schemas/update_connector_request.yaml'
         examples:
           updateIndexConnectorRequest:
             $ref: '../components/examples/update_index_connector_request.yaml'
@@ -193,21 +116,7 @@ put:
           schema:
             $ref: '../components/schemas/connector_response_properties.yaml'
     '400':
-      description: Indicates a bad request.
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              error: 
-                type: string
-                example: Bad Request
-              message:
-                type: string
-                example: "error validating action type config: [index]: expected value of type [string] but got [undefined]"
-              statusCode:
-                type: integer
-                example: 400
+      $ref: '../components/responses/401.yaml'
     '401':
       $ref: '../components/responses/401.yaml'
     '404':
diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml
index 9301b563bd958..f94419bcae81d 100644
--- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml
+++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml
@@ -1,6 +1,6 @@
 post:
   summary: Runs a connector.
-  operationId: runConnector
+  operationId: runConnectorWithSpaceId
   description: >
     You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
     You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
@@ -16,32 +16,7 @@ post:
     content:
       application/json:
         schema:
-          title: Run connector request body properties
-          description: The properties vary depending on the connector type.
-          type: object
-          required: 
-            - params
-          properties:
-            params:
-              oneOf:
-                - $ref: '../components/schemas/run_connector_params_documents.yaml'
-                - $ref: '../components/schemas/run_connector_params_level_message.yaml'
-                - title: Subaction parameters
-                  description: Test an action that involves a subaction.
-                  oneOf:
-                    - $ref: '../components/schemas/run_connector_subaction_addevent.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_closealert.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_createalert.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_fieldsbyissuetype.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_getchoices.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_getfields.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_getincident.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_issue.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_issues.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_issuetypes.yaml'
-                    - $ref: '../components/schemas/run_connector_subaction_pushtoservice.yaml'
-                  discriminator:
-                    propertyName: subAction     
+          $ref: '../components/schemas/run_connector_request.yaml' 
         examples:
           runIndexConnectorRequest:
             $ref: '../components/examples/run_index_connector_request.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector_types.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector_types.yaml
index c100102306747..1dfdfe775a292 100644
--- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector_types.yaml
+++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector_types.yaml
@@ -1,6 +1,6 @@
 get:
   summary: Retrieves a list of all connector types.
-  operationId: getConnectorTypes
+  operationId: getConnectorTypesWithSpaceId
   description: >
     You do not need any Kibana feature privileges to run this API.
   tags:
diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connectors.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connectors.yaml
index caec98d7bf5e3..7f5d5944ba520 100644
--- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connectors.yaml
+++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connectors.yaml
@@ -1,6 +1,6 @@
 get:
   summary: Retrieves all connectors.
-  operationId: getConnectors
+  operationId: getConnectorsWithSpaceId
   description: >
     You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
   tags:
@@ -15,45 +15,7 @@ get:
           schema:
             type: array
             items:
-              title: Get connectors response body properties
-              description: The properties vary for each connector type.
-              type: object
-              required:
-                - connector_type_id
-                - id
-                - is_deprecated
-                - is_preconfigured
-                - name
-                - referenced_by_count
-              properties:
-                connector_type_id:
-                  $ref: '../components/schemas/connector_types.yaml'
-                config:
-                  type: object
-                  description: The configuration for the connector. Configuration properties vary depending on the connector type.
-                  additionalProperties: true
-                  nullable: true
-                id:
-                  type: string
-                  description: The identifier for the connector.
-                  example: b0766e10-d190-11ec-b04c-776c77d14fca
-                is_deprecated:
-                  $ref: '../components/schemas/is_deprecated.yaml'
-                is_missing_secrets:
-                  $ref: '../components/schemas/is_missing_secrets.yaml'  
-                is_preconfigured:
-                  $ref: '../components/schemas/is_preconfigured.yaml'
-                is_system_action:
-                  $ref: '../components/schemas/is_system_action.yaml'
-                name:
-                  type: string
-                  description: The display name for the connector.
-                  example: my-connector
-                referenced_by_count:
-                  type: integer
-                  description: Indicates the number of saved objects that reference the connector. If `is_preconfigured` is true, this value is not calculated.
-                  example: 2
-                  default: 0
+              $ref: '../components/schemas/connector_response_properties.yaml'
           examples:
             getConnectorsResponse:
               $ref: '../components/examples/get_connectors_response.yaml'
diff --git a/x-pack/plugins/actions/server/lib/action_executor.test.ts b/x-pack/plugins/actions/server/lib/action_executor.test.ts
index a966605bd3a4f..9b2fd5e987f6c 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.test.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.test.ts
@@ -20,6 +20,8 @@ import {
   asSavedObjectExecutionSource,
 } from './action_execution_source';
 import { securityMock } from '@kbn/security-plugin/server/mocks';
+import { finished } from 'stream/promises';
+import { PassThrough } from 'stream';
 
 const actionExecutor = new ActionExecutor({ isESOCanEncrypt: true });
 const services = actionsMock.createServices();
@@ -1837,6 +1839,102 @@ test('writes usage data to event log for OpenAI events', async () => {
   });
 });
 
+test('writes usage data to event log for streaming OpenAI events', async () => {
+  const executorMock = setupActionExecutorMock('.gen-ai', {
+    params: { schema: schema.any() },
+    config: { schema: schema.any() },
+    secrets: { schema: schema.any() },
+  });
+
+  const stream = new PassThrough();
+
+  executorMock.mockResolvedValue({
+    actionId: '1',
+    status: 'ok',
+    // @ts-ignore
+    data: stream,
+  });
+
+  await actionExecutor.execute({
+    ...executeParams,
+    params: {
+      subActionParams: {
+        body: JSON.stringify({
+          messages: [
+            {
+              role: 'system',
+              content: 'System message',
+            },
+            {
+              role: 'user',
+              content: 'User message',
+            },
+          ],
+        }),
+      },
+    },
+  });
+
+  expect(eventLogger.logEvent).toHaveBeenCalledTimes(1);
+  stream.write(
+    `data: ${JSON.stringify({
+      object: 'chat.completion.chunk',
+      choices: [{ delta: { content: 'Single' } }],
+    })}\n`
+  );
+  stream.write(`data: [DONE]`);
+
+  stream.end();
+
+  await finished(stream);
+
+  await new Promise(process.nextTick);
+
+  expect(eventLogger.logEvent).toHaveBeenCalledTimes(2);
+  expect(eventLogger.logEvent).toHaveBeenNthCalledWith(2, {
+    event: {
+      action: 'execute',
+      kind: 'action',
+      outcome: 'success',
+    },
+    kibana: {
+      action: {
+        execution: {
+          uuid: '2',
+          gen_ai: {
+            usage: {
+              completion_tokens: 5,
+              prompt_tokens: 30,
+              total_tokens: 35,
+            },
+          },
+        },
+        name: 'action-1',
+        id: '1',
+      },
+      alert: {
+        rule: {
+          execution: {
+            uuid: '123abc',
+          },
+        },
+      },
+      saved_objects: [
+        {
+          id: '1',
+          namespace: 'some-namespace',
+          rel: 'primary',
+          type: 'action',
+          type_id: '.gen-ai',
+        },
+      ],
+      space_ids: ['some-namespace'],
+    },
+    message: 'action executed: .gen-ai:1: action-1',
+    user: { name: 'coolguy', id: '123' },
+  });
+});
+
 test('does not fetches actionInfo if passed as param', async () => {
   const actionType: jest.Mocked<ActionType> = {
     id: 'test',
@@ -1898,13 +1996,16 @@ test('does not fetches actionInfo if passed as param', async () => {
   );
 });
 
-function setupActionExecutorMock(actionTypeId = 'test') {
+function setupActionExecutorMock(
+  actionTypeId = 'test',
+  validationOverride?: ActionType['validate']
+) {
   const actionType: jest.Mocked<ActionType> = {
     id: 'test',
     name: 'Test',
     minimumLicenseRequired: 'basic',
     supportedFeatureIds: ['alerting'],
-    validate: {
+    validate: validationOverride || {
       config: { schema: schema.object({ bar: schema.boolean() }) },
       secrets: { schema: schema.object({ baz: schema.boolean() }) },
       params: { schema: schema.object({ foo: schema.boolean() }) },
diff --git a/x-pack/plugins/actions/server/lib/action_executor.ts b/x-pack/plugins/actions/server/lib/action_executor.ts
index d3d57de4cda4e..9cd70d4c7bf91 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.ts
@@ -13,6 +13,7 @@ import { EncryptedSavedObjectsClient } from '@kbn/encrypted-saved-objects-plugin
 import { SpacesServiceStart } from '@kbn/spaces-plugin/server';
 import { IEventLogger, SAVED_OBJECT_REL_PRIMARY } from '@kbn/event-log-plugin/server';
 import { SecurityPluginStart } from '@kbn/security-plugin/server';
+import { PassThrough, Readable } from 'stream';
 import {
   validateParams,
   validateConfig,
@@ -37,6 +38,7 @@ import { RelatedSavedObjects } from './related_saved_objects';
 import { createActionEventLogRecordObject } from './create_action_event_log_record_object';
 import { ActionExecutionError, ActionExecutionErrorReason } from './errors/action_execution_error';
 import type { ActionsAuthorization } from '../authorization/actions_authorization';
+import { getTokenCountFromOpenAIStream } from './get_token_count_from_openai_stream';
 
 // 1,000,000 nanoseconds in 1 millisecond
 const Millis2Nanos = 1000 * 1000;
@@ -276,8 +278,6 @@ export class ActionExecutor {
           }
         }
 
-        eventLogger.stopTiming(event);
-
         // allow null-ish return to indicate success
         const result = rawResult || {
           actionId,
@@ -286,6 +286,48 @@ export class ActionExecutor {
 
         event.event = event.event || {};
 
+        const { error, ...resultWithoutError } = result;
+
+        function completeEventLogging() {
+          eventLogger.stopTiming(event);
+
+          const currentUser = security?.authc.getCurrentUser(request);
+
+          event.user = event.user || {};
+          event.user.name = currentUser?.username;
+          event.user.id = currentUser?.profile_uid;
+
+          if (result.status === 'ok') {
+            span?.setOutcome('success');
+            event.event!.outcome = 'success';
+            event.message = `action executed: ${actionLabel}`;
+          } else if (result.status === 'error') {
+            span?.setOutcome('failure');
+            event.event!.outcome = 'failure';
+            event.message = `action execution failure: ${actionLabel}`;
+            event.error = event.error || {};
+            event.error.message = actionErrorToMessage(result);
+            if (result.error) {
+              logger.error(result.error, {
+                tags: [actionTypeId, actionId, 'action-run-failed'],
+                error: { stack_trace: result.error.stack },
+              });
+            }
+            logger.warn(`action execution failure: ${actionLabel}: ${event.error.message}`);
+          } else {
+            span?.setOutcome('failure');
+            event.event!.outcome = 'failure';
+            event.message = `action execution returned unexpected result: ${actionLabel}: "${result.status}"`;
+            event.error = event.error || {};
+            event.error.message = 'action execution returned unexpected result';
+            logger.warn(
+              `action execution failure: ${actionLabel}: returned unexpected result "${result.status}"`
+            );
+          }
+
+          eventLogger.logEvent(event);
+        }
+
         // start openai extension
         // add event.kibana.action.execution.openai to event log when OpenAI Connector is executed
         if (result.status === 'ok' && actionTypeId === '.gen-ai') {
@@ -310,45 +352,34 @@ export class ActionExecutor {
               },
             },
           };
-        }
-        // end openai extension
 
-        const currentUser = security?.authc.getCurrentUser(request);
-
-        event.user = event.user || {};
-        event.user.name = currentUser?.username;
-        event.user.id = currentUser?.profile_uid;
-
-        if (result.status === 'ok') {
-          span?.setOutcome('success');
-          event.event.outcome = 'success';
-          event.message = `action executed: ${actionLabel}`;
-        } else if (result.status === 'error') {
-          span?.setOutcome('failure');
-          event.event.outcome = 'failure';
-          event.message = `action execution failure: ${actionLabel}`;
-          event.error = event.error || {};
-          event.error.message = actionErrorToMessage(result);
-          if (result.error) {
-            logger.error(result.error, {
-              tags: [actionTypeId, actionId, 'action-run-failed'],
-              error: { stack_trace: result.error.stack },
-            });
+          if (result.data instanceof Readable) {
+            getTokenCountFromOpenAIStream({
+              responseStream: result.data.pipe(new PassThrough()),
+              body: (validatedParams as { subActionParams: { body: string } }).subActionParams.body,
+            })
+              .then(({ total, prompt, completion }) => {
+                event.kibana!.action!.execution!.gen_ai!.usage = {
+                  total_tokens: total,
+                  prompt_tokens: prompt,
+                  completion_tokens: completion,
+                };
+              })
+              .catch((err) => {
+                logger.error('Failed to calculate tokens from streaming response');
+                logger.error(err);
+              })
+              .finally(() => {
+                completeEventLogging();
+              });
+
+            return resultWithoutError;
           }
-          logger.warn(`action execution failure: ${actionLabel}: ${event.error.message}`);
-        } else {
-          span?.setOutcome('failure');
-          event.event.outcome = 'failure';
-          event.message = `action execution returned unexpected result: ${actionLabel}: "${result.status}"`;
-          event.error = event.error || {};
-          event.error.message = 'action execution returned unexpected result';
-          logger.warn(
-            `action execution failure: ${actionLabel}: returned unexpected result "${result.status}"`
-          );
         }
+        // end openai extension
+
+        completeEventLogging();
 
-        eventLogger.logEvent(event);
-        const { error, ...resultWithoutError } = result;
         return resultWithoutError;
       }
     );
diff --git a/x-pack/plugins/actions/server/lib/get_token_count_from_openai_stream.test.ts b/x-pack/plugins/actions/server/lib/get_token_count_from_openai_stream.test.ts
new file mode 100644
index 0000000000000..080b7cb5f972f
--- /dev/null
+++ b/x-pack/plugins/actions/server/lib/get_token_count_from_openai_stream.test.ts
@@ -0,0 +1,138 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { Transform } from 'stream';
+import { getTokenCountFromOpenAIStream } from './get_token_count_from_openai_stream';
+
+interface StreamMock {
+  write: (data: string) => void;
+  fail: () => void;
+  complete: () => void;
+  transform: Transform;
+}
+
+function createStreamMock(): StreamMock {
+  const transform: Transform = new Transform({});
+
+  return {
+    write: (data: string) => {
+      transform.push(`${data}\n`);
+    },
+    fail: () => {
+      transform.emit('error', new Error('Stream failed'));
+      transform.end();
+    },
+    transform,
+    complete: () => {
+      transform.end();
+    },
+  };
+}
+
+describe('getTokenCountFromOpenAIStream', () => {
+  let tokens: Awaited<ReturnType<typeof getTokenCountFromOpenAIStream>>;
+  let stream: StreamMock;
+  const body = {
+    messages: [
+      {
+        role: 'system',
+        content: 'This is a system message',
+      },
+      {
+        role: 'user',
+        content: 'This is a user message',
+      },
+    ],
+  };
+
+  const chunk = {
+    object: 'chat.completion.chunk',
+    choices: [
+      {
+        delta: {
+          content: 'Single',
+        },
+      },
+    ],
+  };
+
+  const PROMPT_TOKEN_COUNT = 36;
+  const COMPLETION_TOKEN_COUNT = 5;
+
+  beforeEach(() => {
+    stream = createStreamMock();
+    stream.write(`data: ${JSON.stringify(chunk)}`);
+  });
+
+  describe('when a stream completes', () => {
+    beforeEach(async () => {
+      stream.write('data: [DONE]');
+      stream.complete();
+    });
+
+    describe('without function tokens', () => {
+      beforeEach(async () => {
+        tokens = await getTokenCountFromOpenAIStream({
+          responseStream: stream.transform,
+          body: JSON.stringify(body),
+        });
+      });
+
+      it('counts the prompt tokens', () => {
+        expect(tokens.prompt).toBe(PROMPT_TOKEN_COUNT);
+        expect(tokens.completion).toBe(COMPLETION_TOKEN_COUNT);
+        expect(tokens.total).toBe(PROMPT_TOKEN_COUNT + COMPLETION_TOKEN_COUNT);
+      });
+    });
+
+    describe('with function tokens', () => {
+      beforeEach(async () => {
+        tokens = await getTokenCountFromOpenAIStream({
+          responseStream: stream.transform,
+          body: JSON.stringify({
+            ...body,
+            functions: [
+              {
+                name: 'my_function',
+                description: 'My function description',
+                parameters: {
+                  type: 'object',
+                  properties: {
+                    my_property: {
+                      type: 'boolean',
+                      description: 'My function property',
+                    },
+                  },
+                },
+              },
+            ],
+          }),
+        });
+      });
+
+      it('counts the function tokens', () => {
+        expect(tokens.prompt).toBeGreaterThan(PROMPT_TOKEN_COUNT);
+      });
+    });
+  });
+
+  describe('when a stream fails', () => {
+    it('resolves the promise with the correct prompt tokens', async () => {
+      const tokenPromise = getTokenCountFromOpenAIStream({
+        responseStream: stream.transform,
+        body: JSON.stringify(body),
+      });
+
+      stream.fail();
+
+      await expect(tokenPromise).resolves.toEqual({
+        prompt: PROMPT_TOKEN_COUNT,
+        total: PROMPT_TOKEN_COUNT + COMPLETION_TOKEN_COUNT,
+        completion: COMPLETION_TOKEN_COUNT,
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/actions/server/lib/get_token_count_from_openai_stream.ts b/x-pack/plugins/actions/server/lib/get_token_count_from_openai_stream.ts
new file mode 100644
index 0000000000000..74c89f716171e
--- /dev/null
+++ b/x-pack/plugins/actions/server/lib/get_token_count_from_openai_stream.ts
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { encode } from 'gpt-tokenizer';
+import { isEmpty, omitBy } from 'lodash';
+import { Readable } from 'stream';
+import { finished } from 'stream/promises';
+import { CreateChatCompletionRequest } from 'openai';
+
+export async function getTokenCountFromOpenAIStream({
+  responseStream,
+  body,
+}: {
+  responseStream: Readable;
+  body: string;
+}): Promise<{
+  total: number;
+  prompt: number;
+  completion: number;
+}> {
+  const chatCompletionRequest = JSON.parse(body) as CreateChatCompletionRequest;
+
+  // per https://github.com/openai/openai-cookbook/blob/main/examples/How_to_count_tokens_with_tiktoken.ipynb
+  const tokensFromMessages = encode(
+    chatCompletionRequest.messages
+      .map(
+        (msg) =>
+          `<|start|>${msg.role}\n${msg.content}\n${
+            msg.name
+              ? msg.name
+              : msg.function_call
+              ? msg.function_call.name + '\n' + msg.function_call.arguments
+              : ''
+          }<|end|>`
+      )
+      .join('\n')
+  ).length;
+
+  // this is an approximation. OpenAI cuts off a function schema
+  // at a certain level of nesting, so their token count might
+  // be lower than what we are calculating here.
+
+  const tokensFromFunctions = chatCompletionRequest.functions
+    ? encode(
+        chatCompletionRequest.functions
+          ?.map(
+            (fn) =>
+              `<|start|>${fn.name}\n${fn.description}\n${JSON.stringify(fn.parameters)}<|end|>`
+          )
+          .join('\n')
+      ).length
+    : 0;
+
+  const promptTokens = tokensFromMessages + tokensFromFunctions;
+
+  let responseBody: string = '';
+
+  responseStream.on('data', (chunk: string) => {
+    responseBody += chunk.toString();
+  });
+
+  try {
+    await finished(responseStream);
+  } catch {
+    // no need to handle this explicitly
+  }
+
+  const response = responseBody
+    .split('\n')
+    .filter((line) => {
+      return line.startsWith('data: ') && !line.endsWith('[DONE]');
+    })
+    .map((line) => {
+      return JSON.parse(line.replace('data: ', ''));
+    })
+    .filter(
+      (
+        line
+      ): line is {
+        choices: Array<{
+          delta: { content?: string; function_call?: { name?: string; arguments: string } };
+        }>;
+      } => {
+        return 'object' in line && line.object === 'chat.completion.chunk';
+      }
+    )
+    .reduce(
+      (prev, line) => {
+        const msg = line.choices[0].delta!;
+        prev.content += msg.content || '';
+        prev.function_call.name += msg.function_call?.name || '';
+        prev.function_call.arguments += msg.function_call?.arguments || '';
+        return prev;
+      },
+      { content: '', function_call: { name: '', arguments: '' } }
+    );
+
+  const completionTokens = encode(
+    JSON.stringify(
+      omitBy(
+        {
+          content: response.content || undefined,
+          function_call: response.function_call.name ? response.function_call : undefined,
+        },
+        isEmpty
+      )
+    )
+  ).length;
+
+  return {
+    prompt: promptTokens,
+    completion: completionTokens,
+    total: promptTokens + completionTokens,
+  };
+}
diff --git a/x-pack/plugins/actions/server/sub_action_framework/sub_action_connector.ts b/x-pack/plugins/actions/server/sub_action_framework/sub_action_connector.ts
index e421083fd6177..7d3c6e51e844e 100644
--- a/x-pack/plugins/actions/server/sub_action_framework/sub_action_connector.ts
+++ b/x-pack/plugins/actions/server/sub_action_framework/sub_action_connector.ts
@@ -20,6 +20,7 @@ import { SavedObjectsClientContract } from '@kbn/core-saved-objects-api-server';
 import { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import { finished } from 'stream/promises';
 import { IncomingMessage } from 'http';
+import { PassThrough } from 'stream';
 import { assertURL } from './helpers/validators';
 import { ActionsConfigurationUtilities } from '../actions_config';
 import { SubAction, SubActionRequestParams } from './types';
@@ -158,11 +159,13 @@ export abstract class SubActionConnector<Config, Secrets> {
           try {
             const incomingMessage = error.response.data as IncomingMessage;
 
-            incomingMessage.on('data', (chunk) => {
+            const pt = incomingMessage.pipe(new PassThrough());
+
+            pt.on('data', (chunk) => {
               responseBody += chunk.toString();
             });
 
-            await finished(incomingMessage);
+            await finished(pt);
 
             error.response.data = JSON.parse(responseBody);
           } catch {
diff --git a/x-pack/plugins/alerting/server/alerts_client/alerts_client.test.ts b/x-pack/plugins/alerting/server/alerts_client/alerts_client.test.ts
index dc98c34b20a39..9526f87e260d6 100644
--- a/x-pack/plugins/alerting/server/alerts_client/alerts_client.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/alerts_client.test.ts
@@ -63,6 +63,7 @@ import {
 import { getDataStreamAdapter } from '../alerts_service/lib/data_stream_adapter';
 
 const date = '2023-03-28T22:27:28.159Z';
+const startedAtDate = '2023-03-28T13:00:00.000Z';
 const maxAlerts = 1000;
 let logger: ReturnType<typeof loggingSystemMock['createLogger']>;
 const clusterClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
@@ -254,6 +255,15 @@ const getRecoveredIndexedAlertDoc = (overrides = {}) => ({
   ...overrides,
 });
 
+const defaultExecutionOpts = {
+  maxAlerts,
+  ruleLabel: `test: rule-name`,
+  flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+  activeAlertsFromState: {},
+  recoveredAlertsFromState: {},
+  startedAt: null,
+};
+
 describe('Alerts Client', () => {
   let alertsClientParams: AlertsClientParams;
   let processAndLogAlertsOpts: ProcessAndLogAlertsOpts;
@@ -305,15 +315,10 @@ describe('Alerts Client', () => {
 
           const alertsClient = new AlertsClient(alertsClientParams);
 
-          const opts = {
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          };
-          await alertsClient.initializeExecution(opts);
-          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(opts);
+          await alertsClient.initializeExecution(defaultExecutionOpts);
+          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(
+            defaultExecutionOpts
+          );
 
           // no alerts to query for
           expect(clusterClient.search).not.toHaveBeenCalled();
@@ -338,15 +343,10 @@ describe('Alerts Client', () => {
             },
           });
 
-          const opts = {
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          };
-          await alertsClient.initializeExecution(opts);
-          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(opts);
+          await alertsClient.initializeExecution(defaultExecutionOpts);
+          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(
+            defaultExecutionOpts
+          );
           expect(mockLegacyAlertsClient.getTrackedAlerts).not.toHaveBeenCalled();
           spy.mockRestore();
         });
@@ -362,15 +362,10 @@ describe('Alerts Client', () => {
 
           const alertsClient = new AlertsClient(alertsClientParams);
 
-          const opts = {
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          };
-          await alertsClient.initializeExecution(opts);
-          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(opts);
+          await alertsClient.initializeExecution(defaultExecutionOpts);
+          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(
+            defaultExecutionOpts
+          );
 
           expect(clusterClient.search).toHaveBeenCalledWith({
             body: {
@@ -417,15 +412,10 @@ describe('Alerts Client', () => {
 
           const alertsClient = new AlertsClient(alertsClientParams);
 
-          const opts = {
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          };
-          await alertsClient.initializeExecution(opts);
-          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(opts);
+          await alertsClient.initializeExecution(defaultExecutionOpts);
+          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(
+            defaultExecutionOpts
+          );
 
           expect(clusterClient.search).toHaveBeenCalledTimes(2);
 
@@ -446,15 +436,10 @@ describe('Alerts Client', () => {
 
           const alertsClient = new AlertsClient(alertsClientParams);
 
-          const opts = {
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          };
-          await alertsClient.initializeExecution(opts);
-          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(opts);
+          await alertsClient.initializeExecution(defaultExecutionOpts);
+          expect(mockLegacyAlertsClient.initializeExecution).toHaveBeenCalledWith(
+            defaultExecutionOpts
+          );
 
           expect(clusterClient.search).toHaveBeenCalledWith({
             body: {
@@ -489,13 +474,7 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report 2 new alerts
           const alertExecutorService = alertsClient.factory();
@@ -552,13 +531,10 @@ describe('Alerts Client', () => {
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Report 1 new alert and 1 active alert
@@ -621,13 +597,10 @@ describe('Alerts Client', () => {
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Report 1 new alert and 1 active alert
@@ -740,13 +713,10 @@ describe('Alerts Client', () => {
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': activeAlert,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Report 1 new alert and 1 active alert
@@ -814,14 +784,11 @@ describe('Alerts Client', () => {
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
               '2': trackedAlert2Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Report 1 new alert and 1 active alert, recover 1 alert
@@ -909,14 +876,11 @@ describe('Alerts Client', () => {
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
               '2': trackedAlert2Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Report 1 new alert and 1 active alert, recover 1 alert
@@ -1032,18 +996,118 @@ describe('Alerts Client', () => {
           });
         });
 
-        test('should not try to index if no alerts', async () => {
+        test('should use startedAt time if provided', async () => {
+          clusterClient.search.mockResolvedValue({
+            took: 10,
+            timed_out: false,
+            _shards: { failed: 0, successful: 1, total: 1, skipped: 0 },
+            hits: {
+              total: { relation: 'eq', value: 2 },
+              hits: [
+                {
+                  _id: 'abc',
+                  _index: '.internal.alerts-test.alerts-default-000001',
+                  _seq_no: 41,
+                  _primary_term: 665,
+                  _source: fetchedAlert1,
+                },
+                {
+                  _id: 'def',
+                  _index: '.internal.alerts-test.alerts-default-000002',
+                  _seq_no: 42,
+                  _primary_term: 666,
+                  _source: fetchedAlert2,
+                },
+              ],
+            },
+          });
           const alertsClient = new AlertsClient<{}, {}, {}, 'default', 'recovered'>(
             alertsClientParams
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
+            ...defaultExecutionOpts,
+            activeAlertsFromState: {
+              '1': trackedAlert1Raw,
+              '2': trackedAlert2Raw,
+            },
+            startedAt: new Date(startedAtDate),
+          });
+
+          // Report 1 new alert and 1 active alert, recover 1 alert
+          const alertExecutorService = alertsClient.factory();
+          alertExecutorService.create('2').scheduleActions('default');
+          alertExecutorService.create('3').scheduleActions('default');
+
+          alertsClient.processAndLogAlerts(processAndLogAlertsOpts);
+
+          await alertsClient.persistAlerts();
+
+          const { alertsToReturn } = alertsClient.getAlertsToSerialize();
+          const uuid3 = alertsToReturn['3'].meta?.uuid;
+
+          expect(clusterClient.bulk).toHaveBeenCalledWith({
+            index: '.alerts-test.alerts-default',
+            refresh: true,
+            require_alias: !useDataStreamForAlerts,
+            body: [
+              {
+                index: {
+                  _id: 'def',
+                  _index: '.internal.alerts-test.alerts-default-000002',
+                  if_seq_no: 42,
+                  if_primary_term: 666,
+                  require_alias: false,
+                },
+              },
+              // ongoing alert doc
+              getOngoingIndexedAlertDoc({
+                [TIMESTAMP]: startedAtDate,
+                [ALERT_UUID]: 'def',
+                [ALERT_INSTANCE_ID]: '2',
+                [ALERT_FLAPPING_HISTORY]: [true, false, false, false],
+                [ALERT_DURATION]: 37951841000,
+                [ALERT_START]: '2023-03-28T02:27:28.159Z',
+                [ALERT_TIME_RANGE]: { gte: '2023-03-28T02:27:28.159Z' },
+              }),
+              {
+                create: { _id: uuid3, ...(useDataStreamForAlerts ? {} : { require_alias: true }) },
+              },
+              // new alert doc
+              getNewIndexedAlertDoc({
+                [TIMESTAMP]: startedAtDate,
+                [ALERT_UUID]: uuid3,
+                [ALERT_INSTANCE_ID]: '3',
+                [ALERT_START]: startedAtDate,
+                [ALERT_TIME_RANGE]: { gte: startedAtDate },
+              }),
+              {
+                index: {
+                  _id: 'abc',
+                  _index: '.internal.alerts-test.alerts-default-000001',
+                  if_seq_no: 41,
+                  if_primary_term: 665,
+                  require_alias: false,
+                },
+              },
+              // recovered alert doc
+              getRecoveredIndexedAlertDoc({
+                [TIMESTAMP]: startedAtDate,
+                [ALERT_DURATION]: 1951841000,
+                [ALERT_UUID]: 'abc',
+                [ALERT_END]: startedAtDate,
+                [ALERT_TIME_RANGE]: { gte: '2023-03-28T12:27:28.159Z', lte: startedAtDate },
+              }),
+            ],
           });
+        });
+
+        test('should not try to index if no alerts', async () => {
+          const alertsClient = new AlertsClient<{}, {}, {}, 'default', 'recovered'>(
+            alertsClientParams
+          );
+
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report no alerts
 
@@ -1087,13 +1151,7 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report 2 new alerts
           const alertExecutorService = alertsClient.factory();
@@ -1140,14 +1198,11 @@ describe('Alerts Client', () => {
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
               '2': trackedAlert2Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Report 2 active alerts
@@ -1198,13 +1253,7 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report 2 new alerts
           const alertExecutorService = alertsClient.factory();
@@ -1624,13 +1673,7 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report 2 new alerts
           const { uuid: uuid1, start: start1 } = alertsClient.report({
@@ -1662,6 +1705,63 @@ describe('Alerts Client', () => {
           expect(start2).toBeNull();
         });
 
+        test('should use startedAt time if provided', async () => {
+          const mockGetUuidCurrent = jest
+            .fn()
+            .mockReturnValueOnce('uuid1')
+            .mockReturnValueOnce('uuid2');
+          const mockGetStartCurrent = jest.fn().mockReturnValue(null);
+          const mockScheduleActionsCurrent = jest.fn().mockImplementation(() => ({
+            replaceState: mockReplaceState,
+            getUuid: mockGetUuidCurrent,
+            getStart: mockGetStartCurrent,
+          }));
+          const mockCreateCurrent = jest.fn().mockImplementation(() => ({
+            scheduleActions: mockScheduleActionsCurrent,
+          }));
+          mockLegacyAlertsClient.factory.mockImplementation(() => ({ create: mockCreateCurrent }));
+          const spy = jest
+            .spyOn(LegacyAlertsClientModule, 'LegacyAlertsClient')
+            .mockImplementation(() => mockLegacyAlertsClient);
+          const alertsClient = new AlertsClient<{}, {}, {}, 'default', 'recovered'>(
+            alertsClientParams
+          );
+
+          await alertsClient.initializeExecution({
+            ...defaultExecutionOpts,
+            startedAt: new Date(startedAtDate),
+          });
+
+          // Report 2 new alerts
+          const { uuid: uuid1, start: start1 } = alertsClient.report({
+            id: '1',
+            actionGroup: 'default',
+            state: {},
+            context: {},
+          });
+          const { uuid: uuid2, start: start2 } = alertsClient.report({
+            id: '2',
+            actionGroup: 'default',
+            state: {},
+            context: {},
+          });
+
+          expect(mockCreateCurrent).toHaveBeenCalledTimes(2);
+          expect(mockCreateCurrent).toHaveBeenNthCalledWith(1, '1');
+          expect(mockCreateCurrent).toHaveBeenNthCalledWith(2, '2');
+          expect(mockScheduleActionsCurrent).toHaveBeenCalledTimes(2);
+          expect(mockScheduleActionsCurrent).toHaveBeenNthCalledWith(1, 'default', {});
+          expect(mockScheduleActionsCurrent).toHaveBeenNthCalledWith(2, 'default', {});
+
+          expect(mockReplaceState).not.toHaveBeenCalled();
+          spy.mockRestore();
+
+          expect(uuid1).toEqual('uuid1');
+          expect(uuid2).toEqual('uuid2');
+          expect(start1).toEqual(startedAtDate);
+          expect(start2).toEqual(startedAtDate);
+        });
+
         test('should set context if defined', async () => {
           mockLegacyAlertsClient.factory.mockImplementation(() => ({ create: mockCreate }));
           const spy = jest
@@ -1671,13 +1771,7 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report 2 new alerts
           alertsClient.report({
@@ -1708,13 +1802,7 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report 2 new alerts
           alertsClient.report({
@@ -1751,13 +1839,7 @@ describe('Alerts Client', () => {
             'recovered'
           >(alertsClientParams);
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report 2 new alerts
           alertsClient.report({
@@ -1881,14 +1963,11 @@ describe('Alerts Client', () => {
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
               '2': trackedAlert2Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Set context on 2 recovered alerts
@@ -1911,14 +1990,11 @@ describe('Alerts Client', () => {
           );
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
               '2': trackedAlert2Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Set context on 2 recovered alerts
@@ -1948,13 +2024,7 @@ describe('Alerts Client', () => {
             'recovered'
           >(alertsClientParams);
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           // Report new alert
           alertsClient.report({
@@ -2050,13 +2120,10 @@ describe('Alerts Client', () => {
           >(alertsClientParams);
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Report ongoing alert
@@ -2155,13 +2222,10 @@ describe('Alerts Client', () => {
           >(alertsClientParams);
 
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // Don't report any alerts so existing alert recovers
@@ -2234,13 +2298,7 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
 
-          await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-            activeAlertsFromState: {},
-            recoveredAlertsFromState: {},
-          });
+          await alertsClient.initializeExecution(defaultExecutionOpts);
 
           const publicAlertsClient = alertsClient.client();
 
@@ -2275,13 +2333,10 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // report no alerts to allow existing alert to recover
@@ -2310,13 +2365,10 @@ describe('Alerts Client', () => {
             alertsClientParams
           );
           await alertsClient.initializeExecution({
-            maxAlerts,
-            ruleLabel: `test: rule-name`,
-            flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+            ...defaultExecutionOpts,
             activeAlertsFromState: {
               '1': trackedAlert1Raw,
             },
-            recoveredAlertsFromState: {},
           });
 
           // report no alerts to allow existing alert to recover
diff --git a/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts b/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts
index 1b3fe16442d9e..a01ea78612e8e 100644
--- a/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts
@@ -86,6 +86,7 @@ export class AlertsClient<
     primaryTerm: Record<string, number | undefined>;
   };
 
+  private startedAtString: string | null = null;
   private rule: AlertRule;
   private ruleType: UntypedNormalizedRuleType;
 
@@ -114,6 +115,7 @@ export class AlertsClient<
   }
 
   public async initializeExecution(opts: InitializeExecutionOpts) {
+    this.startedAtString = opts.startedAt ? opts.startedAt.toISOString() : null;
     await this.legacyAlertsClient.initializeExecution(opts);
 
     if (!this.ruleType.alerts?.shouldWrite) {
@@ -227,7 +229,7 @@ export class AlertsClient<
 
     return {
       uuid: legacyAlert.getUuid(),
-      start: legacyAlert.getStart(),
+      start: legacyAlert.getStart() ?? this.startedAtString,
     };
   }
 
@@ -280,7 +282,7 @@ export class AlertsClient<
       );
       return;
     }
-    const currentTime = new Date().toISOString();
+    const currentTime = this.startedAtString ?? new Date().toISOString();
     const esClient = await this.options.elasticsearchClientPromise;
 
     const { alertsToReturn, recoveredAlertsToReturn } =
diff --git a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
index 8eb436a4f7b35..446ecfd79c8b8 100644
--- a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
@@ -118,6 +118,18 @@ const testAlert2 = {
   },
 };
 
+const defaultExecutionOpts = {
+  maxAlerts: 1000,
+  ruleLabel: `test: rule-name`,
+  flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+  activeAlertsFromState: {
+    '1': testAlert1,
+    '2': testAlert2,
+  },
+  recoveredAlertsFromState: {},
+  startedAt: null,
+};
+
 describe('Legacy Alerts Client', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -130,16 +142,7 @@ describe('Legacy Alerts Client', () => {
       ruleType,
     });
 
-    await alertsClient.initializeExecution({
-      maxAlerts: 1000,
-      ruleLabel: `test: my-test-rule`,
-      flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-      activeAlertsFromState: {
-        '1': testAlert1,
-        '2': testAlert2,
-      },
-      recoveredAlertsFromState: {},
-    });
+    await alertsClient.initializeExecution(defaultExecutionOpts);
 
     expect(createAlertFactory).toHaveBeenCalledWith({
       alerts: {
@@ -159,16 +162,7 @@ describe('Legacy Alerts Client', () => {
       ruleType,
     });
 
-    await alertsClient.initializeExecution({
-      maxAlerts: 1000,
-      ruleLabel: `test: my-test-rule`,
-      flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-      activeAlertsFromState: {
-        '1': testAlert1,
-        '2': testAlert2,
-      },
-      recoveredAlertsFromState: {},
-    });
+    await alertsClient.initializeExecution(defaultExecutionOpts);
 
     alertsClient.factory();
     expect(getPublicAlertFactory).toHaveBeenCalledWith(mockCreateAlertFactory);
@@ -180,16 +174,7 @@ describe('Legacy Alerts Client', () => {
       ruleType,
     });
 
-    await alertsClient.initializeExecution({
-      maxAlerts: 1000,
-      ruleLabel: `test: my-test-rule`,
-      flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-      activeAlertsFromState: {
-        '1': testAlert1,
-        '2': testAlert2,
-      },
-      recoveredAlertsFromState: {},
-    });
+    await alertsClient.initializeExecution(defaultExecutionOpts);
 
     alertsClient.getAlert('1');
     expect(mockCreateAlertFactory.get).toHaveBeenCalledWith('1');
@@ -201,16 +186,7 @@ describe('Legacy Alerts Client', () => {
       ruleType,
     });
 
-    await alertsClient.initializeExecution({
-      maxAlerts: 1000,
-      ruleLabel: `test: my-test-rule`,
-      flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-      activeAlertsFromState: {
-        '1': testAlert1,
-        '2': testAlert2,
-      },
-      recoveredAlertsFromState: {},
-    });
+    await alertsClient.initializeExecution(defaultExecutionOpts);
 
     alertsClient.checkLimitUsage();
     expect(mockCreateAlertFactory.alertLimit.checkLimitUsage).toHaveBeenCalled();
@@ -222,16 +198,7 @@ describe('Legacy Alerts Client', () => {
       ruleType,
     });
 
-    await alertsClient.initializeExecution({
-      maxAlerts: 1000,
-      ruleLabel: `test: my-test-rule`,
-      flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-      activeAlertsFromState: {
-        '1': testAlert1,
-        '2': testAlert2,
-      },
-      recoveredAlertsFromState: {},
-    });
+    await alertsClient.initializeExecution(defaultExecutionOpts);
 
     alertsClient.hasReachedAlertLimit();
     expect(mockCreateAlertFactory.hasReachedAlertLimit).toHaveBeenCalled();
@@ -269,16 +236,7 @@ describe('Legacy Alerts Client', () => {
       ruleType,
     });
 
-    await alertsClient.initializeExecution({
-      maxAlerts: 1000,
-      ruleLabel: `ruleLogPrefix`,
-      flappingSettings: DEFAULT_FLAPPING_SETTINGS,
-      activeAlertsFromState: {
-        '1': testAlert1,
-        '2': testAlert2,
-      },
-      recoveredAlertsFromState: {},
-    });
+    await alertsClient.initializeExecution(defaultExecutionOpts);
 
     alertsClient.processAndLogAlerts({
       eventLogger: alertingEventLogger,
@@ -304,6 +262,7 @@ describe('Legacy Alerts Client', () => {
       autoRecoverAlerts: true,
       flappingSettings: DEFAULT_FLAPPING_SETTINGS,
       maintenanceWindowIds: ['window-id1', 'window-id2'],
+      startedAt: null,
     });
 
     expect(trimRecoveredAlerts).toHaveBeenCalledWith(logger, {}, 1000);
@@ -334,7 +293,7 @@ describe('Legacy Alerts Client', () => {
         '2': new Alert<AlertInstanceContext, AlertInstanceContext>('2', testAlert2),
       },
       recoveredAlerts: {},
-      ruleLogPrefix: 'ruleLogPrefix',
+      ruleLogPrefix: 'test: rule-name',
       ruleRunMetricsStore,
       canSetRecoveryContext: false,
       shouldPersistAlerts: true,
diff --git a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
index 26f7171a39686..b05d7aecf90ff 100644
--- a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
@@ -49,6 +49,7 @@ export class LegacyAlertsClient<
   private maxAlerts: number = DEFAULT_MAX_ALERTS;
   private flappingSettings: RulesSettingsFlappingProperties = DEFAULT_FLAPPING_SETTINGS;
   private ruleLogPrefix: string = '';
+  private startedAtString: string | null = null;
 
   // Alerts from the previous execution that are deserialized from the task state
   private trackedAlerts: TrackedAlerts<State, Context> = {
@@ -86,6 +87,7 @@ export class LegacyAlertsClient<
   public async initializeExecution({
     maxAlerts,
     ruleLabel,
+    startedAt,
     flappingSettings,
     activeAlertsFromState,
     recoveredAlertsFromState,
@@ -93,6 +95,7 @@ export class LegacyAlertsClient<
     this.maxAlerts = maxAlerts;
     this.flappingSettings = flappingSettings;
     this.ruleLogPrefix = ruleLabel;
+    this.startedAtString = startedAt ? startedAt.toISOString() : null;
 
     for (const id of keys(activeAlertsFromState)) {
       this.trackedAlerts.active[id] = new Alert<State, Context>(id, activeAlertsFromState[id]);
@@ -153,6 +156,7 @@ export class LegacyAlertsClient<
       autoRecoverAlerts: this.options.ruleType.autoRecoverAlerts ?? true,
       flappingSettings,
       maintenanceWindowIds,
+      startedAt: this.startedAtString,
     });
 
     const { trimmedAlertsRecovered, earlyRecoveredAlerts } = trimRecoveredAlerts(
diff --git a/x-pack/plugins/alerting/server/alerts_client/types.ts b/x-pack/plugins/alerting/server/alerts_client/types.ts
index 2f8c54238baee..4b84b55d106cf 100644
--- a/x-pack/plugins/alerting/server/alerts_client/types.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/types.ts
@@ -106,6 +106,7 @@ export interface ProcessAndLogAlertsOpts {
 export interface InitializeExecutionOpts {
   maxAlerts: number;
   ruleLabel: string;
+  startedAt: Date | null;
   flappingSettings: RulesSettingsFlappingProperties;
   activeAlertsFromState: Record<string, RawAlertInstance>;
   recoveredAlertsFromState: Record<string, RawAlertInstance>;
diff --git a/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts b/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts
index 5002ecaf7e757..e6a8a2c38ea66 100644
--- a/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts
@@ -900,6 +900,18 @@ describe('Alerts Service', () => {
           );
         });
 
+        test('should allow same context with different "shouldWrite" option', async () => {
+          alertsService.register(TestRegistrationContext);
+          alertsService.register({
+            ...TestRegistrationContext,
+            shouldWrite: false,
+          });
+
+          expect(logger.debug).toHaveBeenCalledWith(
+            `Resources for context "test" have already been registered.`
+          );
+        });
+
         test('should not update index template if simulating template throws error', async () => {
           clusterClient.indices.simulateTemplate.mockRejectedValueOnce(new Error('fail'));
 
diff --git a/x-pack/plugins/alerting/server/alerts_service/alerts_service.ts b/x-pack/plugins/alerting/server/alerts_service/alerts_service.ts
index c90d11d50f56a..18c3e536159ec 100644
--- a/x-pack/plugins/alerting/server/alerts_service/alerts_service.ts
+++ b/x-pack/plugins/alerting/server/alerts_service/alerts_service.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { isEmpty, isEqual } from 'lodash';
+import { isEmpty, isEqual, omit } from 'lodash';
 import { Logger, ElasticsearchClient } from '@kbn/core/server';
 import { Observable } from 'rxjs';
 import { alertFieldMap, ecsFieldMap, legacyAlertFieldMap } from '@kbn/alerts-as-data-utils';
@@ -275,7 +275,7 @@ export class AlertsService implements IAlertsService {
     // check whether this context has been registered before
     if (this.registeredContexts.has(context)) {
       const registeredOptions = this.registeredContexts.get(context);
-      if (!isEqual(opts, registeredOptions)) {
+      if (!isEqual(omit(opts, 'shouldWrite'), omit(registeredOptions, 'shouldWrite'))) {
         throw new Error(`${context} has already been registered with different options`);
       }
       this.options.logger.debug(`Resources for context "${context}" have already been registered.`);
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.test.ts
index 5eee3f4513b9e..38a04fbd76c76 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.test.ts
@@ -1458,40 +1458,6 @@ describe('bulkEdit()', () => {
         'Error updating rule: could not add snooze - Rule cannot have more than 5 snooze schedules'
       );
     });
-
-    test('should ignore siem rules when bulk editing snooze', async () => {
-      mockCreatePointInTimeFinderAsInternalUser({
-        saved_objects: [
-          {
-            ...existingDecryptedRule,
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            attributes: { ...existingDecryptedRule.attributes, consumer: 'siem' } as any,
-          },
-        ],
-      });
-
-      unsecuredSavedObjectsClient.bulkCreate.mockResolvedValue(getMockAttribute());
-
-      const snoozePayload = getSnoozeSchedule();
-
-      await rulesClient.bulkEdit({
-        filter: '',
-        operations: [
-          {
-            operation: 'set',
-            field: 'snoozeSchedule',
-            value: snoozePayload,
-          },
-        ],
-      });
-
-      expect(unsecuredSavedObjectsClient.bulkCreate).toHaveBeenCalledTimes(1);
-      expect(
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        (unsecuredSavedObjectsClient.bulkCreate.mock.calls[0][0][0].attributes as any)
-          .snoozeSchedule
-      ).toEqual([]);
-    });
   });
 
   describe('apiKey operations', () => {
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.ts
index 5bc625f5592b3..294945ad82037 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.ts
@@ -8,7 +8,6 @@
 import pMap from 'p-map';
 import Boom from '@hapi/boom';
 import { cloneDeep } from 'lodash';
-import { AlertConsumers } from '@kbn/rule-data-utils';
 import { KueryNode, nodeBuilder } from '@kbn/es-query';
 import {
   SavedObjectsBulkUpdateObject,
@@ -670,15 +669,6 @@ async function getUpdatedAttributesFromOperations<Params extends RuleParams>({
         break;
       }
       case 'snoozeSchedule': {
-        // Silently skip adding snooze or snooze schedules on security
-        // rules until we implement snoozing of their rules
-        if (updatedRule.consumer === AlertConsumers.SIEM) {
-          // While the rule is technically not updated, we are still marking
-          // the rule as updated in case of snoozing, until support
-          // for snoozing is added.
-          isAttributesUpdateSkipped = false;
-          break;
-        }
         if (operation.operation === 'set') {
           const snoozeAttributes = getBulkSnooze<Params>(
             updatedRule,
diff --git a/x-pack/plugins/alerting/server/lib/process_alerts.test.ts b/x-pack/plugins/alerting/server/lib/process_alerts.test.ts
index 4a5779d1bc9fd..0b33607a34dd2 100644
--- a/x-pack/plugins/alerting/server/lib/process_alerts.test.ts
+++ b/x-pack/plugins/alerting/server/lib/process_alerts.test.ts
@@ -117,6 +117,58 @@ describe('processAlerts', () => {
       expect(newAlert2State.end).not.toBeDefined();
     });
 
+    test('sets start time with startedAt in new alert state if provided', () => {
+      const newAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('1');
+      const newAlert2 = new Alert<AlertInstanceState, AlertInstanceContext>('2');
+      const existingAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('3');
+      const existingAlert2 = new Alert<AlertInstanceState, AlertInstanceContext>('4');
+
+      const existingAlerts = {
+        '3': existingAlert1,
+        '4': existingAlert2,
+      };
+
+      const updatedAlerts = {
+        ...cloneDeep(existingAlerts),
+        '1': newAlert1,
+        '2': newAlert2,
+      };
+
+      updatedAlerts['1'].scheduleActions('default' as never, { foo: '1' });
+      updatedAlerts['2'].scheduleActions('default' as never, { foo: '1' });
+      updatedAlerts['3'].scheduleActions('default' as never, { foo: '1' });
+      updatedAlerts['4'].scheduleActions('default' as never, { foo: '2' });
+
+      expect(newAlert1.getState()).toStrictEqual({});
+      expect(newAlert2.getState()).toStrictEqual({});
+
+      const { newAlerts } = processAlerts({
+        alerts: updatedAlerts,
+        existingAlerts,
+        previouslyRecoveredAlerts: {},
+        hasReachedAlertLimit: false,
+        alertLimit: 10,
+        autoRecoverAlerts: true,
+        flappingSettings: DISABLE_FLAPPING_SETTINGS,
+        maintenanceWindowIds: [],
+        startedAt: '2023-10-03T20:03:08.716Z',
+      });
+
+      expect(newAlerts).toEqual({ '1': newAlert1, '2': newAlert2 });
+
+      const newAlert1State = newAlerts['1'].getState();
+      const newAlert2State = newAlerts['2'].getState();
+
+      expect(newAlert1State.start).toEqual('2023-10-03T20:03:08.716Z');
+      expect(newAlert2State.start).toEqual('2023-10-03T20:03:08.716Z');
+
+      expect(newAlert1State.duration).toEqual('0');
+      expect(newAlert2State.duration).toEqual('0');
+
+      expect(newAlert1State.end).not.toBeDefined();
+      expect(newAlert2State.end).not.toBeDefined();
+    });
+
     test('sets maintenance window IDs in new alert state', () => {
       const newAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('1');
       const newAlert2 = new Alert<AlertInstanceState, AlertInstanceContext>('2');
@@ -481,6 +533,64 @@ describe('processAlerts', () => {
       expect(previouslyRecoveredAlert2State.end).not.toBeDefined();
     });
 
+    test('sets start time with startedAt in active alert state if alert was previously recovered', () => {
+      const previouslyRecoveredAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('1');
+      const previouslyRecoveredAlert2 = new Alert<AlertInstanceState, AlertInstanceContext>('2');
+      const existingAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('3');
+      const existingAlert2 = new Alert<AlertInstanceState, AlertInstanceContext>('4');
+
+      const existingAlerts = {
+        '3': existingAlert1,
+        '4': existingAlert2,
+      };
+
+      const previouslyRecoveredAlerts = {
+        '1': previouslyRecoveredAlert1,
+        '2': previouslyRecoveredAlert2,
+      };
+
+      const updatedAlerts = {
+        ...cloneDeep(existingAlerts),
+        ...cloneDeep(previouslyRecoveredAlerts),
+      };
+
+      updatedAlerts['1'].scheduleActions('default' as never, { foo: '1' });
+      updatedAlerts['2'].scheduleActions('default' as never, { foo: '1' });
+      updatedAlerts['3'].scheduleActions('default' as never, { foo: '1' });
+      updatedAlerts['4'].scheduleActions('default' as never, { foo: '2' });
+
+      expect(updatedAlerts['1'].getState()).toStrictEqual({});
+      expect(updatedAlerts['2'].getState()).toStrictEqual({});
+
+      const { activeAlerts } = processAlerts({
+        alerts: updatedAlerts,
+        existingAlerts,
+        previouslyRecoveredAlerts,
+        hasReachedAlertLimit: false,
+        alertLimit: 10,
+        autoRecoverAlerts: true,
+        flappingSettings: DEFAULT_FLAPPING_SETTINGS,
+        maintenanceWindowIds: [],
+        startedAt: '2023-10-03T20:03:08.716Z',
+      });
+
+      expect(
+        Object.keys(activeAlerts).map((id) => ({ [id]: activeAlerts[id].getFlappingHistory() }))
+      ).toEqual([{ '1': [true] }, { '2': [true] }, { '3': [false] }, { '4': [false] }]);
+
+      const previouslyRecoveredAlert1State = activeAlerts['1'].getState();
+      const previouslyRecoveredAlert2State = activeAlerts['2'].getState();
+
+      expect(previouslyRecoveredAlert1State.start).toEqual('2023-10-03T20:03:08.716Z');
+      expect(previouslyRecoveredAlert2State.start).toEqual('2023-10-03T20:03:08.716Z');
+
+      expect(previouslyRecoveredAlert1State.duration).toEqual('0');
+      expect(previouslyRecoveredAlert2State.duration).toEqual('0');
+
+      expect(previouslyRecoveredAlert1State.end).not.toBeDefined();
+      expect(previouslyRecoveredAlert2State.end).not.toBeDefined();
+    });
+
     test('should not set maintenance window IDs for active alerts', () => {
       const newAlert = new Alert<AlertInstanceState, AlertInstanceContext>('1');
       const existingAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('2');
@@ -614,6 +724,50 @@ describe('processAlerts', () => {
       expect(recoveredAlert2State.end).toEqual('1970-01-01T00:00:00.000Z');
     });
 
+    test('updates duration in recovered alerts if start is available and adds end time to startedAt if provided', () => {
+      const activeAlert = new Alert<AlertInstanceState, AlertInstanceContext>('1');
+      const recoveredAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('2');
+      const recoveredAlert2 = new Alert<AlertInstanceState, AlertInstanceContext>('3');
+
+      const existingAlerts = {
+        '1': activeAlert,
+        '2': recoveredAlert1,
+        '3': recoveredAlert2,
+      };
+      existingAlerts['2'].replaceState({ start: '1969-12-30T00:00:00.000Z', duration: 33000 });
+      existingAlerts['3'].replaceState({ start: '1969-12-31T07:34:00.000Z', duration: 23532 });
+
+      const updatedAlerts = cloneDeep(existingAlerts);
+
+      updatedAlerts['1'].scheduleActions('default' as never, { foo: '1' });
+
+      const { recoveredAlerts } = processAlerts({
+        alerts: updatedAlerts,
+        existingAlerts,
+        previouslyRecoveredAlerts: {},
+        hasReachedAlertLimit: false,
+        alertLimit: 10,
+        autoRecoverAlerts: true,
+        flappingSettings: DISABLE_FLAPPING_SETTINGS,
+        maintenanceWindowIds: [],
+        startedAt: '2023-10-03T20:03:08.716Z',
+      });
+
+      expect(recoveredAlerts).toEqual({ '2': updatedAlerts['2'], '3': updatedAlerts['3'] });
+
+      const recoveredAlert1State = recoveredAlerts['2'].getState();
+      const recoveredAlert2State = recoveredAlerts['3'].getState();
+
+      expect(recoveredAlert1State.start).toEqual('1969-12-30T00:00:00.000Z');
+      expect(recoveredAlert2State.start).toEqual('1969-12-31T07:34:00.000Z');
+
+      expect(recoveredAlert1State.duration).toEqual('1696536188716000000');
+      expect(recoveredAlert2State.duration).toEqual('1696422548716000000');
+
+      expect(recoveredAlert1State.end).toEqual('2023-10-03T20:03:08.716Z');
+      expect(recoveredAlert2State.end).toEqual('2023-10-03T20:03:08.716Z');
+    });
+
     test('does not update duration or set end in recovered alerts if start is not available', () => {
       const activeAlert = new Alert<AlertInstanceState, AlertInstanceContext>('1');
       const recoveredAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('2');
diff --git a/x-pack/plugins/alerting/server/lib/process_alerts.ts b/x-pack/plugins/alerting/server/lib/process_alerts.ts
index 328b6b1708f1e..628beebbe772e 100644
--- a/x-pack/plugins/alerting/server/lib/process_alerts.ts
+++ b/x-pack/plugins/alerting/server/lib/process_alerts.ts
@@ -22,6 +22,7 @@ interface ProcessAlertsOpts<
   hasReachedAlertLimit: boolean;
   alertLimit: number;
   autoRecoverAlerts: boolean;
+  startedAt?: string | null;
   flappingSettings: RulesSettingsFlappingProperties;
   maintenanceWindowIds: string[];
 }
@@ -52,6 +53,7 @@ export function processAlerts<
   autoRecoverAlerts,
   flappingSettings,
   maintenanceWindowIds,
+  startedAt,
 }: ProcessAlertsOpts<State, Context>): ProcessAlertsResult<
   State,
   Context,
@@ -65,7 +67,8 @@ export function processAlerts<
         previouslyRecoveredAlerts,
         alertLimit,
         flappingSettings,
-        maintenanceWindowIds
+        maintenanceWindowIds,
+        startedAt
       )
     : processAlertsHelper(
         alerts,
@@ -73,7 +76,8 @@ export function processAlerts<
         previouslyRecoveredAlerts,
         autoRecoverAlerts,
         flappingSettings,
-        maintenanceWindowIds
+        maintenanceWindowIds,
+        startedAt
       );
 }
 
@@ -88,12 +92,13 @@ function processAlertsHelper<
   previouslyRecoveredAlerts: Record<string, Alert<State, Context>>,
   autoRecoverAlerts: boolean,
   flappingSettings: RulesSettingsFlappingProperties,
-  maintenanceWindowIds: string[]
+  maintenanceWindowIds: string[],
+  startedAt?: string | null
 ): ProcessAlertsResult<State, Context, ActionGroupIds, RecoveryActionGroupId> {
   const existingAlertIds = new Set(Object.keys(existingAlerts));
   const previouslyRecoveredAlertsIds = new Set(Object.keys(previouslyRecoveredAlerts));
 
-  const currentTime = new Date().toISOString();
+  const currentTime = startedAt ?? new Date().toISOString();
   const newAlerts: Record<string, Alert<State, Context, ActionGroupIds>> = {};
   const activeAlerts: Record<string, Alert<State, Context, ActionGroupIds>> = {};
   const currentRecoveredAlerts: Record<string, Alert<State, Context, RecoveryActionGroupId>> = {};
@@ -183,7 +188,8 @@ function processAlertsLimitReached<
   previouslyRecoveredAlerts: Record<string, Alert<State, Context>>,
   alertLimit: number,
   flappingSettings: RulesSettingsFlappingProperties,
-  maintenanceWindowIds: string[]
+  maintenanceWindowIds: string[],
+  startedAt?: string | null
 ): ProcessAlertsResult<State, Context, ActionGroupIds, RecoveryActionGroupId> {
   const existingAlertIds = new Set(Object.keys(existingAlerts));
   const previouslyRecoveredAlertsIds = new Set(Object.keys(previouslyRecoveredAlerts));
@@ -193,7 +199,7 @@ function processAlertsLimitReached<
   // - pass through all existing alerts as active
   // - add any new alerts, up to the max allowed
 
-  const currentTime = new Date().toISOString();
+  const currentTime = startedAt ?? new Date().toISOString();
   const newAlerts: Record<string, Alert<State, Context, ActionGroupIds>> = {};
 
   // all existing alerts stay active
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
index 939dfe9406f69..4dd391cc4f801 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -379,6 +379,7 @@ export class TaskRunner<
       maxAlerts: this.maxAlerts,
       ruleLabel,
       flappingSettings,
+      startedAt: this.taskInstance.startedAt!,
       activeAlertsFromState: alertRawInstances,
       recoveredAlertsFromState: alertRecoveredRawInstances,
     });
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner_alerts_client.test.ts b/x-pack/plugins/alerting/server/task_runner/task_runner_alerts_client.test.ts
index fd11e5c8f0f8a..d38736bb84905 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner_alerts_client.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner_alerts_client.test.ts
@@ -767,6 +767,7 @@ describe('Task Runner', () => {
         maxAlerts: 1000,
         recoveredAlertsFromState: {},
         ruleLabel: "test:1: 'rule-name'",
+        startedAt: new Date(DATE_1970),
       });
       expect(alertsClientNotToUse.initializeExecution).not.toHaveBeenCalled();
 
diff --git a/x-pack/plugins/data_visualizer/public/application/data_drift/data_drift_page.tsx b/x-pack/plugins/data_visualizer/public/application/data_drift/data_drift_page.tsx
index 2411c9096be70..2c45fd37a6858 100644
--- a/x-pack/plugins/data_visualizer/public/application/data_drift/data_drift_page.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/data_drift/data_drift_page.tsx
@@ -359,7 +359,6 @@ export const DataDriftPage: FC<Props> = ({ initialSettings }) => {
                 label={comparisonIndexPatternLabel}
                 randomSampler={randomSamplerProd}
                 reload={forceRefresh}
-                brushSelectionUpdateHandler={brushSelectionUpdate}
                 documentCountStats={documentStatsProd.documentCountStats}
                 documentCountStatsSplit={documentStatsProd.documentCountStatsCompare}
                 isBrushCleared={isBrushCleared}
diff --git a/x-pack/plugins/data_visualizer/public/application/data_drift/document_count_with_dual_brush.tsx b/x-pack/plugins/data_visualizer/public/application/data_drift/document_count_with_dual_brush.tsx
index 0d83879c37486..210d364ce7aa6 100644
--- a/x-pack/plugins/data_visualizer/public/application/data_drift/document_count_with_dual_brush.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/data_drift/document_count_with_dual_brush.tsx
@@ -32,7 +32,7 @@ export interface DocumentCountContentProps
     | 'interval'
     | 'chartPointsSplitLabel'
   > {
-  brushSelectionUpdateHandler: BrushSelectionUpdateHandler;
+  brushSelectionUpdateHandler?: BrushSelectionUpdateHandler;
   documentCountStats?: DocumentCountStats;
   documentCountStatsSplit?: DocumentCountStats;
   documentCountStatsSplitLabel?: string;
diff --git a/x-pack/plugins/data_visualizer/public/application/data_drift/use_data_drift_result.ts b/x-pack/plugins/data_visualizer/public/application/data_drift/use_data_drift_result.ts
index 8b22e1d94db33..4588595ffcc4f 100644
--- a/x-pack/plugins/data_visualizer/public/application/data_drift/use_data_drift_result.ts
+++ b/x-pack/plugins/data_visualizer/public/application/data_drift/use_data_drift_result.ts
@@ -29,6 +29,7 @@ import { isDefined } from '@kbn/ml-is-defined';
 import { computeChi2PValue, type Histogram } from '@kbn/ml-chi2test';
 import { mapAndFlattenFilters } from '@kbn/data-plugin/public';
 
+import type { AggregationsRangeBucketKeys } from '@elastic/elasticsearch/lib/api/types';
 import { createMergedEsQuery } from '../index_data_visualizer/utils/saved_search_utils';
 import { useDataVisualizerKibana } from '../kibana_context';
 
@@ -378,6 +379,7 @@ const fetchComparisonDriftedData = async ({
   fields,
   baselineResponseAggs,
   baseRequest,
+  baselineRequest,
   randomSamplerWrapper,
   signal,
 }: {
@@ -387,10 +389,19 @@ const fetchComparisonDriftedData = async ({
   randomSamplerWrapper: RandomSamplerWrapper;
   signal: AbortSignal;
   baselineResponseAggs: object;
+  baselineRequest: EsRequestParams;
 }) => {
   const driftedRequest = { ...baseRequest };
+
   const driftedRequestAggs: Record<string, estypes.AggregationsAggregationContainer> = {};
 
+  // Since aggregation is not able to split the values into distinct 5% intervals,
+  // this breaks our assumption of uniform distributed fractions in the`ks_test`.
+  // So, to fix this in the general case, we need to run an additional ranges agg to get the doc count for the ranges
+  // that we get from the percentiles aggregation
+  // and use it in the bucket_count_ks_test
+  const rangesRequestAggs: Record<string, estypes.AggregationsAggregationContainer> = {};
+
   for (const { field, type } of fields) {
     if (
       isPopulatedObject(baselineResponseAggs, [`${field}_percentiles`]) &&
@@ -410,19 +421,16 @@ const fetchComparisonDriftedData = async ({
           ranges.push({ from: percentiles[idx - 1], to: val });
         }
       });
-      // add range and bucket_count_ks_test to the request
-      driftedRequestAggs[`${field}_ranges`] = {
+      const rangeAggs = {
         range: {
           field,
           ranges,
         },
       };
-      driftedRequestAggs[`${field}_ks_test`] = {
-        bucket_count_ks_test: {
-          buckets_path: `${field}_ranges>_count`,
-          alternative: ['two_sided'],
-        },
-      };
+      // add range and bucket_count_ks_test to the request
+      rangesRequestAggs[`${field}_ranges`] = rangeAggs;
+      driftedRequestAggs[`${field}_ranges`] = rangeAggs;
+
       // add stats aggregation to the request
       driftedRequestAggs[`${field}_stats`] = {
         stats: {
@@ -441,6 +449,48 @@ const fetchComparisonDriftedData = async ({
     }
   }
 
+  // Compute fractions based on results of ranges
+  const rangesResp = await dataSearch(
+    {
+      ...baselineRequest,
+      body: { ...baselineRequest.body, aggs: randomSamplerWrapper.wrap(rangesRequestAggs) },
+    },
+    signal
+  );
+
+  const fieldsWithNoOverlap = new Set<string>();
+  for (const { field } of fields) {
+    if (rangesResp.aggregations[`${field}_ranges`]) {
+      const buckets = rangesResp.aggregations[`${field}_ranges`]
+        .buckets as AggregationsRangeBucketKeys[];
+
+      if (buckets) {
+        const totalSumOfAllBuckets = buckets.reduce((acc, bucket) => acc + bucket.doc_count, 0);
+
+        const fractions = buckets.map((bucket) => ({
+          ...bucket,
+          fraction: bucket.doc_count / totalSumOfAllBuckets,
+        }));
+
+        if (totalSumOfAllBuckets > 0) {
+          driftedRequestAggs[`${field}_ks_test`] = {
+            bucket_count_ks_test: {
+              buckets_path: `${field}_ranges>_count`,
+              alternative: ['two_sided'],
+              ...(totalSumOfAllBuckets > 0
+                ? { fractions: fractions.map((bucket) => Number(bucket.fraction.toFixed(3))) }
+                : {}),
+            },
+          };
+        } else {
+          // If all doc_counts are 0, that means there's no overlap whatsoever
+          // in which case we don't need to make the ks test agg, because it defaults to astronomically small value
+          fieldsWithNoOverlap.add(field);
+        }
+      }
+    }
+  }
+
   const driftedResp = await dataSearch(
     {
       ...driftedRequest,
@@ -448,6 +498,17 @@ const fetchComparisonDriftedData = async ({
     },
     signal
   );
+
+  fieldsWithNoOverlap.forEach((field) => {
+    if (driftedResp.aggregations) {
+      driftedResp.aggregations[`${field}_ks_test`] = {
+        // Setting -Infinity to represent astronomically small number
+        // which would be represented as < 0.000001 in table
+        two_sided: -Infinity,
+      };
+    }
+  });
+
   return driftedResp;
 };
 
@@ -678,7 +739,7 @@ export const useFetchDataComparisonResult = (
 
         setResult({ data: undefined, status: FETCH_STATUS.LOADING, error: undefined });
 
-        // Place holder for when there might be difference data views in the future
+        // Placeholder for when there might be difference data views in the future
         const referenceIndex = initialSettings
           ? initialSettings.reference
           : currentDataView?.getIndexPattern();
@@ -802,6 +863,7 @@ export const useFetchDataComparisonResult = (
               fetchComparisonDriftedData({
                 dataSearch,
                 baseRequest: driftedRequest,
+                baselineRequest,
                 baselineResponseAggs,
                 fields: chunkedFields,
                 randomSamplerWrapper: prodRandomSamplerWrapper,
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/common/constants.ts b/x-pack/plugins/ecs_data_quality_dashboard/common/constants.ts
index 51455c071b519..52c734797f726 100755
--- a/x-pack/plugins/ecs_data_quality_dashboard/common/constants.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/common/constants.ts
@@ -13,3 +13,4 @@ export const GET_INDEX_STATS = `${BASE_PATH}/stats/{pattern}`;
 export const GET_INDEX_MAPPINGS = `${BASE_PATH}/mappings/{pattern}`;
 export const GET_UNALLOWED_FIELD_VALUES = `${BASE_PATH}/unallowed_field_values`;
 export const GET_ILM_EXPLAIN = `${BASE_PATH}/ilm_explain/{pattern}`;
+export const INTERNAL_API_VERSION = '1';
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts
index 7ac44e1beedf1..913c226517ce3 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/__mocks__/server.ts
@@ -5,35 +5,73 @@
  * 2.0.
  */
 import { httpServiceMock } from '@kbn/core/server/mocks';
-import type { RequestHandler, RouteConfig, KibanaRequest } from '@kbn/core/server';
+import type { IRouter, RouteMethod, RequestHandler, KibanaRequest } from '@kbn/core/server';
 import type { RequestHandlerContext } from '@kbn/core-http-request-handler-context-server';
+import type { RouterMock } from '@kbn/core-http-router-server-mocks';
+import type { AddVersionOpts, VersionedRouteConfig } from '@kbn/core-http-server';
 
 import { requestMock } from './request';
 import { responseMock as responseFactoryMock } from './response';
 import { requestContextMock } from './request_context';
 import { responseAdapter } from './test_adapters';
+import { INTERNAL_API_VERSION } from '../../common/constants';
 
 interface Route {
-  config: RouteConfig<unknown, unknown, unknown, 'get' | 'post' | 'delete' | 'patch' | 'put'>;
+  config: AddVersionOpts<unknown, unknown, unknown>;
   handler: RequestHandler;
 }
 
-const getRoute = (routerMock: MockServer['router']): Route => {
-  const routeCalls = [
-    ...routerMock.get.mock.calls,
-    ...routerMock.post.mock.calls,
-    ...routerMock.put.mock.calls,
-    ...routerMock.patch.mock.calls,
-    ...routerMock.delete.mock.calls,
+interface RegisteredVersionedRoute {
+  routeConfig: VersionedRouteConfig<RouterMethod>;
+  versionConfig: AddVersionOpts<unknown, unknown, unknown>;
+  routeHandler: RequestHandler;
+}
+
+type RouterMethod = Extract<keyof IRouter, RouteMethod>;
+
+export const getRegisteredVersionedRouteMock = (
+  routerMock: RouterMock,
+  method: RouterMethod,
+  path: string,
+  version: string
+): RegisteredVersionedRoute => {
+  const route = routerMock.versioned.getRoute(method, path);
+  const routeVersion = route.versions[version];
+
+  if (!routeVersion) {
+    throw new Error(`Handler for [${method}][${path}] with version [${version}] no found!`);
+  }
+
+  return {
+    routeConfig: route.config,
+    versionConfig: routeVersion.config,
+    routeHandler: routeVersion.handler,
+  };
+};
+
+const getRoute = (routerMock: MockServer['router'], request: KibanaRequest): Route => {
+  const versionedRouteCalls = [
+    ...routerMock.versioned.get.mock.calls,
+    ...routerMock.versioned.post.mock.calls,
+    ...routerMock.versioned.put.mock.calls,
+    ...routerMock.versioned.patch.mock.calls,
+    ...routerMock.versioned.delete.mock.calls,
   ];
 
-  const [route] = routeCalls;
-  if (!route) {
+  const [versionedRoute] = versionedRouteCalls;
+
+  if (!versionedRoute) {
     throw new Error('No route registered!');
   }
 
-  const [config, handler] = route;
-  return { config, handler };
+  const { routeHandler, versionConfig } = getRegisteredVersionedRouteMock(
+    routerMock,
+    request.route.method,
+    request.route.path,
+    INTERNAL_API_VERSION
+  );
+
+  return { config: versionConfig, handler: routeHandler };
 };
 
 const buildResultMock = () => ({ ok: jest.fn((x) => x), badRequest: jest.fn((x) => x) });
@@ -53,17 +91,19 @@ class MockServer {
 
   public async inject(request: KibanaRequest, context: RequestHandlerContext = this.contextMock) {
     const validatedRequest = this.validateRequest(request);
+
     const [rejection] = this.resultMock.badRequest.mock.calls;
     if (rejection) {
       throw new Error(`Request was rejected with message: '${rejection}'`);
     }
 
-    await this.getRoute().handler(context, validatedRequest, this.responseMock);
+    await this.getRoute(validatedRequest).handler(context, validatedRequest, this.responseMock);
+
     return responseAdapter(this.responseMock);
   }
 
-  private getRoute(): Route {
-    return getRoute(this.router);
+  private getRoute(request: KibanaRequest): Route {
+    return getRoute(this.router, request);
   }
 
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -72,7 +112,8 @@ class MockServer {
   }
 
   private validateRequest(request: KibanaRequest): KibanaRequest {
-    const validations = this.getRoute().config.validate;
+    const config = this.getRoute(request).config;
+    const validations = config.validate && config.validate?.request;
     if (!validations) {
       return request;
     }
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/plugin.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/plugin.ts
index d93766d2f3a7e..0c1cf336dc10d 100755
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/plugin.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/plugin.ts
@@ -29,10 +29,10 @@ export class EcsDataQualityDashboardPlugin
     const router = core.http.createRouter(); // this would be deleted when plugin is removed
 
     // Register server side APIs
-    getIndexMappingsRoute(router);
-    getIndexStatsRoute(router);
-    getUnallowedFieldValuesRoute(router);
-    getILMExplainRoute(router);
+    getIndexMappingsRoute(router, this.logger);
+    getIndexStatsRoute(router, this.logger);
+    getUnallowedFieldValuesRoute(router, this.logger);
+    getILMExplainRoute(router, this.logger);
     return {};
   }
 
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.test.ts
index 737ddf781f1a9..329defab80c2b 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.test.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.test.ts
@@ -12,6 +12,7 @@ import { serverMock } from '../__mocks__/server';
 import { requestMock } from '../__mocks__/request';
 import { requestContextMock } from '../__mocks__/request_context';
 import { getILMExplainRoute } from './get_ilm_explain';
+import { loggerMock, MockedLogger } from '@kbn/logging-mocks';
 
 jest.mock('../lib', () => ({
   fetchILMExplain: jest.fn(),
@@ -20,6 +21,8 @@ jest.mock('../lib', () => ({
 describe('getILMExplainRoute route', () => {
   let server: ReturnType<typeof serverMock.create>;
   let { context } = requestContextMock.createTools();
+  let logger: MockedLogger;
+
   const req = requestMock.create({
     method: 'get',
     path: GET_ILM_EXPLAIN,
@@ -32,9 +35,10 @@ describe('getILMExplainRoute route', () => {
     jest.clearAllMocks();
 
     server = serverMock.create();
+    logger = loggerMock.create();
     ({ context } = requestContextMock.createTools());
 
-    getILMExplainRoute(server.router);
+    getILMExplainRoute(server.router, logger);
   });
 
   test('Returns index ilm information', async () => {
@@ -91,11 +95,13 @@ describe('getILMExplainRoute route', () => {
 
 describe('request validation', () => {
   let server: ReturnType<typeof serverMock.create>;
+  let logger: MockedLogger;
 
   beforeEach(() => {
     server = serverMock.create();
+    logger = loggerMock.create();
 
-    getILMExplainRoute(server.router);
+    getILMExplainRoute(server.router, logger);
   });
 
   test('disallows invalid pattern', () => {
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts
index dab234eecaae7..c30271c62e313 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_ilm_explain.ts
@@ -5,41 +5,51 @@
  * 2.0.
  */
 
-import { IRouter } from '@kbn/core/server';
+import { IRouter, Logger } from '@kbn/core/server';
 import { transformError } from '@kbn/securitysolution-es-utils';
 
-import { GET_ILM_EXPLAIN } from '../../common/constants';
+import { GET_ILM_EXPLAIN, INTERNAL_API_VERSION } from '../../common/constants';
 import { fetchILMExplain } from '../lib';
 import { buildResponse } from '../lib/build_response';
 import { buildRouteValidation } from '../schemas/common';
 import { GetILMExplainParams } from '../schemas/get_ilm_explain';
 
-export const getILMExplainRoute = (router: IRouter) => {
-  router.get(
-    {
+export const getILMExplainRoute = (router: IRouter, logger: Logger) => {
+  router.versioned
+    .get({
       path: GET_ILM_EXPLAIN,
-      validate: { params: buildRouteValidation(GetILMExplainParams) },
-    },
-    async (context, request, response) => {
-      const resp = buildResponse(response);
+      access: 'internal',
+    })
+    .addVersion(
+      {
+        version: INTERNAL_API_VERSION,
+        validate: {
+          request: {
+            params: buildRouteValidation(GetILMExplainParams),
+          },
+        },
+      },
+      async (context, request, response) => {
+        const resp = buildResponse(response);
 
-      try {
-        const { client } = (await context.core).elasticsearch;
-        const decodedIndexName = decodeURIComponent(request.params.pattern);
+        try {
+          const { client } = (await context.core).elasticsearch;
+          const decodedIndexName = decodeURIComponent(request.params.pattern);
 
-        const ilmExplain = await fetchILMExplain(client, decodedIndexName);
+          const ilmExplain = await fetchILMExplain(client, decodedIndexName);
 
-        return response.ok({
-          body: ilmExplain.indices,
-        });
-      } catch (err) {
-        const error = transformError(err);
+          return response.ok({
+            body: ilmExplain.indices,
+          });
+        } catch (err) {
+          const error = transformError(err);
 
-        return resp.error({
-          body: error.message,
-          statusCode: error.statusCode,
-        });
+          logger.error(error.message);
+          return resp.error({
+            body: error.message,
+            statusCode: error.statusCode,
+          });
+        }
       }
-    }
-  );
+    );
 };
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.test.ts
index 6c76c84396299..34ce98d4f9378 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.test.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.test.ts
@@ -12,6 +12,7 @@ import { serverMock } from '../__mocks__/server';
 import { requestMock } from '../__mocks__/request';
 import { requestContextMock } from '../__mocks__/request_context';
 import { getIndexMappingsRoute } from './get_index_mappings';
+import { loggerMock, MockedLogger } from '@kbn/logging-mocks';
 
 jest.mock('../lib', () => ({
   fetchMappings: jest.fn(),
@@ -20,6 +21,8 @@ jest.mock('../lib', () => ({
 describe('getIndexMappingsRoute route', () => {
   let server: ReturnType<typeof serverMock.create>;
   let { context } = requestContextMock.createTools();
+  let logger: MockedLogger;
+
   const req = requestMock.create({
     method: 'get',
     path: GET_INDEX_MAPPINGS,
@@ -32,9 +35,11 @@ describe('getIndexMappingsRoute route', () => {
     jest.clearAllMocks();
 
     server = serverMock.create();
+    logger = loggerMock.create();
+
     ({ context } = requestContextMock.createTools());
 
-    getIndexMappingsRoute(server.router);
+    getIndexMappingsRoute(server.router, logger);
   });
 
   test('Returns index stats', async () => {
@@ -58,11 +63,11 @@ describe('getIndexMappingsRoute route', () => {
 
 describe('request validation', () => {
   let server: ReturnType<typeof serverMock.create>;
-
+  let logger: MockedLogger;
   beforeEach(() => {
     server = serverMock.create();
-
-    getIndexMappingsRoute(server.router);
+    logger = loggerMock.create();
+    getIndexMappingsRoute(server.router, logger);
   });
 
   test('disallows invalid pattern', () => {
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts
index 8b81daebeec8d..c7ab5e1d4a790 100755
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_mappings.ts
@@ -5,41 +5,47 @@
  * 2.0.
  */
 
-import { IRouter } from '@kbn/core/server';
+import { IRouter, Logger } from '@kbn/core/server';
 import { transformError } from '@kbn/securitysolution-es-utils';
 
 import { fetchMappings } from '../lib';
 import { buildResponse } from '../lib/build_response';
-import { GET_INDEX_MAPPINGS } from '../../common/constants';
+import { GET_INDEX_MAPPINGS, INTERNAL_API_VERSION } from '../../common/constants';
 import { GetIndexMappingsParams } from '../schemas/get_index_mappings';
 import { buildRouteValidation } from '../schemas/common';
 
-export const getIndexMappingsRoute = (router: IRouter) => {
-  router.get(
-    {
+export const getIndexMappingsRoute = (router: IRouter, logger: Logger) => {
+  router.versioned
+    .get({
       path: GET_INDEX_MAPPINGS,
-      validate: { params: buildRouteValidation(GetIndexMappingsParams) },
-    },
-    async (context, request, response) => {
-      const resp = buildResponse(response);
+      access: 'internal',
+    })
+    .addVersion(
+      {
+        version: INTERNAL_API_VERSION,
+        validate: { request: { params: buildRouteValidation(GetIndexMappingsParams) } },
+      },
+      async (context, request, response) => {
+        const resp = buildResponse(response);
 
-      try {
-        const { client } = (await context.core).elasticsearch;
-        const decodedIndexName = decodeURIComponent(request.params.pattern);
+        try {
+          const { client } = (await context.core).elasticsearch;
+          const decodedIndexName = decodeURIComponent(request.params.pattern);
 
-        const mappings = await fetchMappings(client, decodedIndexName);
+          const mappings = await fetchMappings(client, decodedIndexName);
 
-        return response.ok({
-          body: mappings,
-        });
-      } catch (err) {
-        const error = transformError(err);
+          return response.ok({
+            body: mappings,
+          });
+        } catch (err) {
+          const error = transformError(err);
+          logger.error(error.message);
 
-        return resp.error({
-          body: error.message,
-          statusCode: error.statusCode,
-        });
+          return resp.error({
+            body: error.message,
+            statusCode: error.statusCode,
+          });
+        }
       }
-    }
-  );
+    );
 };
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.test.ts
index aa7fc306b47e8..e000809797a01 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.test.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.test.ts
@@ -12,6 +12,7 @@ import { serverMock } from '../__mocks__/server';
 import { requestMock } from '../__mocks__/request';
 import { requestContextMock } from '../__mocks__/request_context';
 import { getIndexStatsRoute } from './get_index_stats';
+import { loggerMock, MockedLogger } from '@kbn/logging-mocks';
 
 jest.mock('../lib', () => ({
   fetchStats: jest.fn(),
@@ -21,6 +22,8 @@ jest.mock('../lib', () => ({
 describe('getIndexStatsRoute route', () => {
   let server: ReturnType<typeof serverMock.create>;
   let { context } = requestContextMock.createTools();
+  let logger: MockedLogger;
+
   const req = requestMock.create({
     method: 'get',
     path: GET_INDEX_STATS,
@@ -38,9 +41,11 @@ describe('getIndexStatsRoute route', () => {
     jest.clearAllMocks();
 
     server = serverMock.create();
+    logger = loggerMock.create();
+
     ({ context } = requestContextMock.createTools());
 
-    getIndexStatsRoute(server.router);
+    getIndexStatsRoute(server.router, logger);
   });
 
   test('Returns index stats', async () => {
@@ -127,11 +132,13 @@ describe('getIndexStatsRoute route', () => {
 
 describe('request validation', () => {
   let server: ReturnType<typeof serverMock.create>;
+  let logger: MockedLogger;
 
   beforeEach(() => {
     server = serverMock.create();
+    logger = loggerMock.create();
 
-    getIndexStatsRoute(server.router);
+    getIndexStatsRoute(server.router, logger);
   });
 
   test('disallows invalid pattern', () => {
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts
index 839d21931a064..f98fa03c27523 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_index_stats.ts
@@ -5,87 +5,96 @@
  * 2.0.
  */
 import { i18n } from '@kbn/i18n';
-import { IRouter } from '@kbn/core/server';
+import { IRouter, Logger } from '@kbn/core/server';
 import { transformError } from '@kbn/securitysolution-es-utils';
 
 import { IndicesStatsIndicesStats } from '@elastic/elasticsearch/lib/api/types';
 import { fetchStats, fetchAvailableIndices } from '../lib';
 import { buildResponse } from '../lib/build_response';
-import { GET_INDEX_STATS } from '../../common/constants';
+import { GET_INDEX_STATS, INTERNAL_API_VERSION } from '../../common/constants';
 import { buildRouteValidation } from '../schemas/common';
 import { GetIndexStatsParams, GetIndexStatsQuery } from '../schemas/get_index_stats';
 
-export const getIndexStatsRoute = (router: IRouter) => {
-  router.get(
-    {
+export const getIndexStatsRoute = (router: IRouter, logger: Logger) => {
+  router.versioned
+    .get({
       path: GET_INDEX_STATS,
-      validate: {
-        params: buildRouteValidation(GetIndexStatsParams),
-        query: buildRouteValidation(GetIndexStatsQuery),
+      access: 'internal',
+    })
+    .addVersion(
+      {
+        version: INTERNAL_API_VERSION,
+        validate: {
+          request: {
+            params: buildRouteValidation(GetIndexStatsParams),
+            query: buildRouteValidation(GetIndexStatsQuery),
+          },
+        },
       },
-    },
-    async (context, request, response) => {
-      const resp = buildResponse(response);
+      async (context, request, response) => {
+        const resp = buildResponse(response);
 
-      try {
-        const { client } = (await context.core).elasticsearch;
-        const esClient = client.asCurrentUser;
+        try {
+          const { client } = (await context.core).elasticsearch;
+          const esClient = client.asCurrentUser;
 
-        const decodedIndexName = decodeURIComponent(request.params.pattern);
+          const decodedIndexName = decodeURIComponent(request.params.pattern);
 
-        const stats = await fetchStats(client, decodedIndexName);
-        const { isILMAvailable, startDate, endDate } = request.query;
+          const stats = await fetchStats(client, decodedIndexName);
+          const { isILMAvailable, startDate, endDate } = request.query;
 
-        if (isILMAvailable === true) {
-          return response.ok({
-            body: stats.indices,
-          });
-        }
+          if (isILMAvailable === true) {
+            return response.ok({
+              body: stats.indices,
+            });
+          }
 
-        /**
-         * If ILM is not available, we need to fetch the available indices with the given date range.
-         * `fetchAvailableIndices` returns indices that have data in the given date range.
-         */
-        if (startDate && endDate) {
-          const decodedStartDate = decodeURIComponent(startDate);
-          const decodedEndDate = decodeURIComponent(endDate);
+          /**
+           * If ILM is not available, we need to fetch the available indices with the given date range.
+           * `fetchAvailableIndices` returns indices that have data in the given date range.
+           */
+          if (startDate && endDate) {
+            const decodedStartDate = decodeURIComponent(startDate);
+            const decodedEndDate = decodeURIComponent(endDate);
 
-          const indices = await fetchAvailableIndices(esClient, {
-            indexPattern: decodedIndexName,
-            startDate: decodedStartDate,
-            endDate: decodedEndDate,
-          });
-          const availableIndices = indices?.aggregations?.index?.buckets?.reduce(
-            (acc: Record<string, IndicesStatsIndicesStats>, { key }: { key: string }) => {
-              if (stats.indices?.[key]) {
-                acc[key] = stats.indices?.[key];
-              }
-              return acc;
-            },
-            {}
-          );
+            const indices = await fetchAvailableIndices(esClient, {
+              indexPattern: decodedIndexName,
+              startDate: decodedStartDate,
+              endDate: decodedEndDate,
+            });
+            const availableIndices = indices?.aggregations?.index?.buckets?.reduce(
+              (acc: Record<string, IndicesStatsIndicesStats>, { key }: { key: string }) => {
+                if (stats.indices?.[key]) {
+                  acc[key] = stats.indices?.[key];
+                }
+                return acc;
+              },
+              {}
+            );
+
+            return response.ok({
+              body: availableIndices,
+            });
+          } else {
+            return resp.error({
+              body: i18n.translate(
+                'xpack.ecsDataQualityDashboard.getIndexStats.dateRangeRequiredErrorMessage',
+                {
+                  defaultMessage: 'startDate and endDate are required',
+                }
+              ),
+              statusCode: 400,
+            });
+          }
+        } catch (err) {
+          const error = transformError(err);
+          logger.error(error.message);
 
-          return response.ok({
-            body: availableIndices,
-          });
-        } else {
           return resp.error({
-            body: i18n.translate(
-              'xpack.ecsDataQualityDashboard.getIndexStats.dateRangeRequiredErrorMessage',
-              {
-                defaultMessage: 'startDate and endDate are required',
-              }
-            ),
-            statusCode: 400,
+            body: error.message,
+            statusCode: error.statusCode,
           });
         }
-      } catch (err) {
-        const error = transformError(err);
-        return resp.error({
-          body: error.message,
-          statusCode: error.statusCode,
-        });
       }
-    }
-  );
+    );
 };
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.test.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.test.ts
index bb59356111699..fe18893acaec1 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.test.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.test.ts
@@ -12,6 +12,7 @@ import { serverMock } from '../__mocks__/server';
 import { requestMock } from '../__mocks__/request';
 import { requestContextMock } from '../__mocks__/request_context';
 import { getUnallowedFieldValuesRoute } from './get_unallowed_field_values';
+import { loggerMock, MockedLogger } from '@kbn/logging-mocks';
 
 jest.mock('../lib', () => ({
   getUnallowedFieldValues: jest.fn(),
@@ -20,6 +21,8 @@ jest.mock('../lib', () => ({
 describe('getUnallowedFieldValuesRoute route', () => {
   let server: ReturnType<typeof serverMock.create>;
   let { context } = requestContextMock.createTools();
+  let logger: MockedLogger;
+
   const req = requestMock.create({
     method: 'post',
     path: GET_UNALLOWED_FIELD_VALUES,
@@ -37,8 +40,9 @@ describe('getUnallowedFieldValuesRoute route', () => {
 
     server = serverMock.create();
     ({ context } = requestContextMock.createTools());
+    logger = loggerMock.create();
 
-    getUnallowedFieldValuesRoute(server.router);
+    getUnallowedFieldValuesRoute(server.router, logger);
   });
 
   test('Returns unallowedValues', async () => {
@@ -107,11 +111,13 @@ describe('getUnallowedFieldValuesRoute route', () => {
 
 describe('request validation', () => {
   let server: ReturnType<typeof serverMock.create>;
+  let logger: MockedLogger;
 
   beforeEach(() => {
     server = serverMock.create();
+    logger = loggerMock.create();
 
-    getUnallowedFieldValuesRoute(server.router);
+    getUnallowedFieldValuesRoute(server.router, logger);
   });
 
   test('disallows invalid pattern', () => {
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts
index be504a812e16b..db8887c2dfa66 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/routes/get_unallowed_field_values.ts
@@ -5,40 +5,46 @@
  * 2.0.
  */
 
-import { IRouter } from '@kbn/core/server';
+import { IRouter, Logger } from '@kbn/core/server';
 import { transformError } from '@kbn/securitysolution-es-utils';
 
 import { getUnallowedFieldValues } from '../lib';
 import { buildResponse } from '../lib/build_response';
-import { GET_UNALLOWED_FIELD_VALUES } from '../../common/constants';
+import { GET_UNALLOWED_FIELD_VALUES, INTERNAL_API_VERSION } from '../../common/constants';
 import { buildRouteValidation } from '../schemas/common';
 import { GetUnallowedFieldValuesBody } from '../schemas/get_unallowed_field_values';
 
-export const getUnallowedFieldValuesRoute = (router: IRouter) => {
-  router.post(
-    {
+export const getUnallowedFieldValuesRoute = (router: IRouter, logger: Logger) => {
+  router.versioned
+    .post({
       path: GET_UNALLOWED_FIELD_VALUES,
-      validate: { body: buildRouteValidation(GetUnallowedFieldValuesBody) },
-    },
-    async (context, request, response) => {
-      const resp = buildResponse(response);
-      const esClient = (await context.core).elasticsearch.client.asCurrentUser;
+      access: 'internal',
+    })
+    .addVersion(
+      {
+        version: INTERNAL_API_VERSION,
+        validate: { request: { body: buildRouteValidation(GetUnallowedFieldValuesBody) } },
+      },
+      async (context, request, response) => {
+        const resp = buildResponse(response);
+        const esClient = (await context.core).elasticsearch.client.asCurrentUser;
 
-      try {
-        const items = request.body;
+        try {
+          const items = request.body;
 
-        const { responses } = await getUnallowedFieldValues(esClient, items);
-        return response.ok({
-          body: responses,
-        });
-      } catch (err) {
-        const error = transformError(err);
+          const { responses } = await getUnallowedFieldValues(esClient, items);
+          return response.ok({
+            body: responses,
+          });
+        } catch (err) {
+          const error = transformError(err);
+          logger.error(error.message);
 
-        return resp.error({
-          body: error.message,
-          statusCode: error.statusCode,
-        });
+          return resp.error({
+            body: error.message,
+            statusCode: error.statusCode,
+          });
+        }
       }
-    }
-  );
+    );
 };
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/common.ts b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/common.ts
index 00e97a9326c5e..57dc45d4071f7 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/common.ts
+++ b/x-pack/plugins/ecs_data_quality_dashboard/server/schemas/common.ts
@@ -7,7 +7,7 @@
 
 import { fold } from 'fp-ts/lib/Either';
 import { pipe } from 'fp-ts/lib/pipeable';
-import type * as rt from 'io-ts';
+import * as rt from 'io-ts';
 import { exactCheck, formatErrors } from '@kbn/securitysolution-io-ts-utils';
 import type {
   RouteValidationFunction,
diff --git a/x-pack/plugins/ecs_data_quality_dashboard/tsconfig.json b/x-pack/plugins/ecs_data_quality_dashboard/tsconfig.json
index b5c1ad152b232..c0603ef91df6b 100644
--- a/x-pack/plugins/ecs_data_quality_dashboard/tsconfig.json
+++ b/x-pack/plugins/ecs_data_quality_dashboard/tsconfig.json
@@ -20,6 +20,8 @@
     "@kbn/securitysolution-io-ts-utils",
     "@kbn/securitysolution-io-ts-types",
     "@kbn/i18n",
+    "@kbn/core-http-router-server-mocks",
+    "@kbn/logging-mocks",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/elastic_assistant/server/routes/evaluate/utils.ts b/x-pack/plugins/elastic_assistant/server/routes/evaluate/utils.ts
index a519398f158be..f208fe1d5739f 100644
--- a/x-pack/plugins/elastic_assistant/server/routes/evaluate/utils.ts
+++ b/x-pack/plugins/elastic_assistant/server/routes/evaluate/utils.ts
@@ -23,7 +23,7 @@ export const getLlmType = (connectorId: string, connectors: ActionResult[]): str
     // See: https://github.com/langchain-ai/langchainjs/blob/fb699647a310c620140842776f4a7432c53e02fa/langchain/src/agents/openai/index.ts#L185
     return 'openai';
   }
-  // TODO: Add support for AWS Bedrock Connector once merged
+  // TODO: Add support for Amazon Bedrock Connector once merged
   // Note: Doesn't appear to be a difference between Azure and OpenAI LLM types, so TBD for functions agent on Azure
   // See: https://github.com/langchain-ai/langchainjs/blob/fb699647a310c620140842776f4a7432c53e02fa/langchain/src/llms/openai.ts#L539
 
diff --git a/x-pack/plugins/enterprise_search/common/types/error_codes.ts b/x-pack/plugins/enterprise_search/common/types/error_codes.ts
index de38fa1d24f16..1492dc4e763b3 100644
--- a/x-pack/plugins/enterprise_search/common/types/error_codes.ts
+++ b/x-pack/plugins/enterprise_search/common/types/error_codes.ts
@@ -6,6 +6,7 @@
  */
 
 export enum ErrorCode {
+  ACCESS_CONTROL_DISABLED = 'access_control_disabled',
   ANALYTICS_COLLECTION_ALREADY_EXISTS = 'analytics_collection_already_exists',
   ANALYTICS_COLLECTION_NOT_FOUND = 'analytics_collection_not_found',
   CONNECTOR_DOCUMENT_ALREADY_EXISTS = 'connector_document_already_exists',
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/components/header_actions/syncs_context_menu.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/components/header_actions/syncs_context_menu.tsx
index 0e1ddbf3e84ae..d49df5e74ef03 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/components/header_actions/syncs_context_menu.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/components/header_actions/syncs_context_menu.tsx
@@ -27,6 +27,7 @@ import { KibanaLogic } from '../../../../../shared/kibana';
 import { CancelSyncsApiLogic } from '../../../../api/connector/cancel_syncs_api_logic';
 import { IngestionStatus } from '../../../../types';
 import { CancelSyncsLogic } from '../../connector/cancel_syncs_logic';
+import { ConnectorConfigurationLogic } from '../../connector/connector_configuration_logic';
 import { IndexViewLogic } from '../../index_view_logic';
 
 export const SyncsContextMenu: React.FC = () => {
@@ -43,6 +44,7 @@ export const SyncsContextMenu: React.FC = () => {
   const { cancelSyncs } = useActions(CancelSyncsLogic);
   const { status } = useValues(CancelSyncsApiLogic);
   const { startSync, startIncrementalSync, startAccessControlSync } = useActions(IndexViewLogic);
+  const { configState } = useValues(ConnectorConfigurationLogic);
 
   const [isPopoverOpen, setPopover] = useState(false);
   const togglePopover = () => setPopover(!isPopoverOpen);
@@ -124,7 +126,9 @@ export const SyncsContextMenu: React.FC = () => {
                   'entSearchContent-${ingestionMethod}-header-sync-more-accessControlSync',
                 'data-test-subj':
                   'entSearchContent-${ingestionMethod}-header-sync-more-accessControlSync',
-                disabled: ingestionStatus === IngestionStatus.INCOMPLETE,
+                disabled:
+                  ingestionStatus === IngestionStatus.INCOMPLETE ||
+                  !configState.use_document_level_security?.value,
                 icon: 'play',
                 name: i18n.translate('xpack.enterpriseSearch.index.header.more.accessControlSync', {
                   defaultMessage: 'Access Control',
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/native_connector_configuration/research_configuration.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/native_connector_configuration/research_configuration.tsx
index b76d89396384e..8f32044356a68 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/native_connector_configuration/research_configuration.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/connector/native_connector_configuration/research_configuration.tsx
@@ -44,17 +44,19 @@ export const ResearchConfiguration: React.FC<ResearchConfigurationProps> = ({
             )}
           </EuiLink>
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiLink target="_blank" href={externalDocsUrl}>
-            {i18n.translate(
-              'xpack.enterpriseSearch.content.indices.configurationConnector.researchConfiguration.serviceDocumentationLinkLabel',
-              {
-                defaultMessage: '{name} documentation',
-                values: { name },
-              }
-            )}
-          </EuiLink>
-        </EuiFlexItem>
+        {externalDocsUrl && (
+          <EuiFlexItem grow={false}>
+            <EuiLink target="_blank" href={externalDocsUrl}>
+              {i18n.translate(
+                'xpack.enterpriseSearch.content.indices.configurationConnector.researchConfiguration.serviceDocumentationLinkLabel',
+                {
+                  defaultMessage: '{name} documentation',
+                  values: { name },
+                }
+              )}
+            </EuiLink>
+          </EuiFlexItem>
+        )}
       </EuiFlexGroup>
     </>
   );
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/ml_inference_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/ml_inference_logic.ts
index 4d3747f79adc1..dd01db93bd689 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/ml_inference_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/ml_inference_logic.ts
@@ -15,6 +15,7 @@ import {
   generateMlInferencePipelineBody,
   getMlInferencePrefixedFieldName,
   getMlModelTypesForModelConfig,
+  ML_INFERENCE_PREFIX,
   parseMlInferenceParametersFromPipeline,
 } from '../../../../../../../common/ml_inference_pipeline';
 import { Status } from '../../../../../../../common/types/api';
@@ -533,7 +534,7 @@ export const MLInferenceLogic = kea<
 
         return generateMlInferencePipelineBody({
           model,
-          pipelineName: configuration.pipelineName,
+          pipelineName: `${ML_INFERENCE_PREFIX}${configuration.pipelineName}`,
           fieldMappings: configuration.fieldMappings ?? [],
           inferenceConfig: configuration.inferenceConfig,
         });
diff --git a/x-pack/plugins/enterprise_search/server/lib/connectors/start_sync.test.ts b/x-pack/plugins/enterprise_search/server/lib/connectors/start_sync.test.ts
index 6498d3f4d1a03..978896289763f 100644
--- a/x-pack/plugins/enterprise_search/server/lib/connectors/start_sync.test.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/connectors/start_sync.test.ts
@@ -299,7 +299,11 @@ describe('startSync lib function', () => {
         _id: 'connectorId',
         _source: {
           api_key_id: null,
-          configuration: {},
+          configuration: {
+            use_document_level_security: {
+              value: true,
+            },
+          },
           created_at: null,
           custom_scheduling: {},
           error: null,
@@ -334,7 +338,11 @@ describe('startSync lib function', () => {
         canceled_at: null,
         completed_at: null,
         connector: {
-          configuration: {},
+          configuration: {
+            use_document_level_security: {
+              value: true,
+            },
+          },
           filtering: null,
           id: 'connectorId',
           index_name: `${CONNECTORS_ACCESS_CONTROL_INDEX_PREFIX}index_name`,
diff --git a/x-pack/plugins/enterprise_search/server/lib/connectors/start_sync.ts b/x-pack/plugins/enterprise_search/server/lib/connectors/start_sync.ts
index 808fd2fc0d40e..ab58fd1417b73 100644
--- a/x-pack/plugins/enterprise_search/server/lib/connectors/start_sync.ts
+++ b/x-pack/plugins/enterprise_search/server/lib/connectors/start_sync.ts
@@ -50,6 +50,12 @@ export const startSync = async (
         }
       : config;
     const { index_name } = connector;
+    if (
+      jobType === SyncJobType.ACCESS_CONTROL &&
+      !configuration.use_document_level_security?.value
+    ) {
+      throw new Error(ErrorCode.ACCESS_CONTROL_DISABLED);
+    }
 
     if (connector.service_type === ENTERPRISE_SEARCH_CONNECTOR_CRAWLER_SERVICE_TYPE) {
       return await client.asCurrentUser.update({
diff --git a/x-pack/plugins/enterprise_search/server/routes/enterprise_search/connectors.ts b/x-pack/plugins/enterprise_search/server/routes/enterprise_search/connectors.ts
index fea646d9d726e..a224babe33292 100644
--- a/x-pack/plugins/enterprise_search/server/routes/enterprise_search/connectors.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/enterprise_search/connectors.ts
@@ -38,6 +38,7 @@ import { updateConnectorPipeline } from '../../lib/pipelines/update_pipeline';
 import { RouteDependencies } from '../../plugin';
 import { createError } from '../../utils/create_error';
 import { elasticsearchErrorHandler } from '../../utils/elasticsearch_error_handler';
+import { isAccessControlDisabledException } from '../../utils/identify_exceptions';
 import { validateEnum } from '../../utils/validate_enum';
 
 export function registerConnectorRoutes({ router, log }: RouteDependencies) {
@@ -203,9 +204,27 @@ export function registerConnectorRoutes({ router, log }: RouteDependencies) {
       },
     },
     elasticsearchErrorHandler(log, async (context, request, response) => {
-      const { client } = (await context.core).elasticsearch;
-      await startSync(client, request.params.connectorId, SyncJobType.ACCESS_CONTROL);
-      return response.ok();
+      try {
+        const { client } = (await context.core).elasticsearch;
+        await startSync(client, request.params.connectorId, SyncJobType.ACCESS_CONTROL);
+        return response.ok();
+      } catch (error) {
+        if (isAccessControlDisabledException(error)) {
+          return createError({
+            errorCode: ErrorCode.ACCESS_CONTROL_DISABLED,
+            message: i18n.translate(
+              'xpack.enterpriseSearch.server.connectors.accessControlSync.accessControlDisabledError',
+              {
+                defaultMessage:
+                  'Access control sync cannot be created. You must first enable Document Level Security.',
+              }
+            ),
+            response,
+            statusCode: 400,
+          });
+        }
+        throw error;
+      }
     })
   );
 
diff --git a/x-pack/plugins/enterprise_search/server/utils/identify_exceptions.ts b/x-pack/plugins/enterprise_search/server/utils/identify_exceptions.ts
index 415d81ee8cec7..a1688520bb593 100644
--- a/x-pack/plugins/enterprise_search/server/utils/identify_exceptions.ts
+++ b/x-pack/plugins/enterprise_search/server/utils/identify_exceptions.ts
@@ -52,3 +52,7 @@ export const isMissingAliasException = (error: ElasticsearchResponseError) =>
   error.meta?.statusCode === 404 &&
   typeof error.meta?.body?.error === 'string' &&
   MISSING_ALIAS_ERROR.test(error.meta?.body?.error);
+
+export const isAccessControlDisabledException = (error: Error) => {
+  return error.message === ErrorCode.ACCESS_CONTROL_DISABLED;
+};
diff --git a/x-pack/plugins/fleet/common/types/models/agent.ts b/x-pack/plugins/fleet/common/types/models/agent.ts
index f8ed69d6d4d33..934ca7ecd2641 100644
--- a/x-pack/plugins/fleet/common/types/models/agent.ts
+++ b/x-pack/plugins/fleet/common/types/models/agent.ts
@@ -48,6 +48,17 @@ export type AgentActionType =
   | 'POLICY_CHANGE'
   | 'INPUT_ACTION';
 
+export type AgentUpgradeStateType =
+  | 'UPG_REQUESTED'
+  | 'UPG_SCHEDULED'
+  | 'UPG_DOWNLOADING'
+  | 'UPG_EXTRACTING'
+  | 'UPG_REPLACING'
+  | 'UPG_RESTARTING'
+  | 'UPG_WATCHING'
+  | 'UPG_ROLLBACK'
+  | 'UPG_FAILED';
+
 type FleetServerAgentComponentStatusTuple = typeof FleetServerAgentComponentStatuses;
 export type FleetServerAgentComponentStatus = FleetServerAgentComponentStatusTuple[number];
 
@@ -89,6 +100,7 @@ interface AgentBase {
   unenrollment_started_at?: string;
   upgraded_at?: string | null;
   upgrade_started_at?: string | null;
+  upgrade_details?: AgentUpgradeDetails;
   access_api_key_id?: string;
   default_api_key?: string;
   default_api_key_id?: string;
@@ -249,6 +261,10 @@ export interface FleetServerAgent {
   /**
    * ID of the API key the Elastic Agent must used to contact Fleet Server
    */
+  /**
+   * Upgrade state of the Elastic Agent
+   */
+  upgrade_details?: AgentUpgradeDetails;
   access_api_key_id?: string;
   agent?: FleetServerAgentMetadata;
   /**
@@ -328,6 +344,7 @@ export interface FleetServerAgent {
    */
   outputs?: OutputMap;
 }
+
 /**
  * An Elastic Agent metadata
  */
@@ -421,3 +438,15 @@ export interface ActionStatusOptions {
   page?: number;
   perPage?: number;
 }
+
+export interface AgentUpgradeDetails {
+  target_version: string;
+  action_id: string;
+  state: AgentUpgradeStateType;
+  metadata: {
+    scheduled_at?: string;
+    download_percent?: number;
+    failed_state?: AgentUpgradeStateType;
+    error_msg?: string;
+  };
+}
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_list_table.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_list_table.tsx
index afc4dd80a7f76..c52f1bb6588ae 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_list_table.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_list_table.tsx
@@ -31,6 +31,8 @@ import { Tags } from '../../components/tags';
 import type { AgentMetrics } from '../../../../../../../common/types';
 import { formatAgentCPU, formatAgentMemory } from '../../services/agent_metrics';
 
+import { AgentUpgradeStatus } from './agent_upgrade_status';
+
 import { EmptyPrompt } from './empty_prompt';
 
 const VERSION_FIELD = 'local_metadata.elastic.agent.version';
@@ -175,7 +177,7 @@ export const AgentListTable: React.FC<Props> = (props: Props) => {
       name: i18n.translate('xpack.fleet.agentList.policyColumnTitle', {
         defaultMessage: 'Agent policy',
       }),
-      width: '260px',
+      width: '185px',
       render: (policyId: string, agent: Agent) => {
         const agentPolicy = agentPoliciesIndexedById[policyId];
         const showWarning = agent.policy_revision && agentPolicy?.revision > agent.policy_revision;
@@ -276,29 +278,35 @@ export const AgentListTable: React.FC<Props> = (props: Props) => {
     {
       field: VERSION_FIELD,
       sortable: true,
-      width: '70px',
+      width: '180px',
       name: i18n.translate('xpack.fleet.agentList.versionTitle', {
         defaultMessage: 'Version',
       }),
       render: (version: string, agent: Agent) => (
         <EuiFlexGroup gutterSize="none" style={{ minWidth: 0 }} direction="column">
-          <EuiFlexItem grow={false} className="eui-textNoWrap">
-            {safeMetadata(version)}
-          </EuiFlexItem>
-          {isAgentSelectable(agent) &&
-          latestAgentVersion &&
-          isAgentUpgradeable(agent, latestAgentVersion) ? (
-            <EuiFlexItem grow={false}>
-              <EuiText color="subdued" size="xs" className="eui-textNoWrap">
-                <EuiIcon size="m" type="warning" color="warning" />
-                &nbsp;
-                <FormattedMessage
-                  id="xpack.fleet.agentList.agentUpgradeLabel"
-                  defaultMessage="Upgrade available"
+          <EuiFlexItem grow={false}>
+            <EuiFlexGroup gutterSize="s" alignItems="center">
+              <EuiFlexItem grow={false}>
+                <EuiText size="s" className="eui-textNoWrap">
+                  {safeMetadata(version)}
+                </EuiText>
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <AgentUpgradeStatus
+                  isAgentUpgradable={
+                    !!(
+                      isAgentSelectable(agent) &&
+                      latestAgentVersion &&
+                      isAgentUpgradeable(agent, latestAgentVersion)
+                    )
+                  }
+                  agentUpgradeStartedAt={agent.upgrade_started_at}
+                  agentUpgradedAt={agent.upgraded_at}
+                  agentUpgradeDetails={agent.upgrade_details}
                 />
-              </EuiText>
-            </EuiFlexItem>
-          ) : null}
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFlexItem>
         </EuiFlexGroup>
       ),
     },
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.test.tsx
new file mode 100644
index 0000000000000..9937126213c91
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.test.tsx
@@ -0,0 +1,274 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { fireEvent, waitFor } from '@testing-library/dom';
+import React from 'react';
+
+import { createFleetTestRendererMock } from '../../../../../../mock';
+
+import {
+  AgentUpgradeStatus,
+  getDownloadEstimate,
+  getUpgradeStartDelay,
+} from './agent_upgrade_status';
+
+function getDateString(futureOffsetInMinutes: number): string {
+  return new Date(Date.now() + futureOffsetInMinutes * 6e4).toISOString();
+}
+
+describe('getUpgradeStartDelay', () => {
+  it('should return a user-friendly time estimation', () => {
+    expect(getUpgradeStartDelay(getDateString(9))).toEqual(
+      ' The upgrade will start in less than 15 minutes.'
+    );
+    expect(getUpgradeStartDelay(getDateString(25))).toEqual(
+      ' The upgrade will start in less than 30 minutes.'
+    );
+    expect(getUpgradeStartDelay(getDateString(55))).toEqual(
+      ' The upgrade will start in less than 1 hour.'
+    );
+    expect(getUpgradeStartDelay(getDateString(61))).toEqual(
+      ' The upgrade will start in less than 2 hours.'
+    );
+    expect(getUpgradeStartDelay(getDateString(119))).toEqual(
+      ' The upgrade will start in less than 2 hours.'
+    );
+    expect(getUpgradeStartDelay(getDateString(121))).toEqual(
+      ' The upgrade will start in less than 3 hours.'
+    );
+  });
+});
+
+describe('getDownloadEstimate', () => {
+  it('should return an empty string if the agent does not have a download percent', () => {
+    expect(getDownloadEstimate()).toEqual('');
+  });
+
+  it('should return an empty string if the agent has a zero download percent', () => {
+    expect(getDownloadEstimate(0)).toEqual('');
+  });
+
+  it('should return a formatted string if the agent has a positive download percent', () => {
+    expect(getDownloadEstimate(16.4)).toEqual(' (16.4%)');
+  });
+});
+
+describe('AgentUpgradeStatus', () => {
+  function render(props: any) {
+    const renderer = createFleetTestRendererMock();
+
+    return renderer.render(<AgentUpgradeStatus {...props} />);
+  }
+
+  const badgeLabels = [
+    'Upgrade requested',
+    'Upgrade scheduled',
+    'Upgrade downloading',
+    'Upgrade extracting',
+    'Upgrade replacing',
+    'Upgrade restarting',
+    'Upgrade monitoring',
+    'Upgrade rolled back',
+    'Upgrade failed',
+  ];
+
+  function expectNotInDocument(results: any, texts: string[]) {
+    texts.forEach((text) => {
+      expect(results.queryByText(text)).not.toBeInTheDocument();
+    });
+  }
+
+  function expectUpgradeStatusBadgeLabel(results: any, text: string) {
+    expect(results.queryByText(text)).toBeInTheDocument();
+    expectNotInDocument(
+      results,
+      badgeLabels.filter((label) => label !== text)
+    );
+  }
+
+  function expectNoUpgradeStatusBadges(results: any) {
+    expectNotInDocument(results, badgeLabels);
+  }
+
+  async function expectTooltip(results: any, text: string) {
+    fireEvent.mouseOver(results.getByText('Info'));
+    await waitFor(() => {
+      expect(results.getByText(text)).toBeInTheDocument();
+    });
+  }
+
+  describe('with agent upgrade details', () => {
+    it('should render UPG_REQUESTED state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_REQUESTED',
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade requested');
+      await expectTooltip(results, 'The agent has requested an upgrade.');
+    });
+
+    it('should render UPG_SCHEDULED state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_SCHEDULED',
+          metadata: {
+            scheduled_at: getDateString(200),
+          },
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade scheduled');
+      await expectTooltip(
+        results,
+        'The agent has been instructed to upgrade. The upgrade will start in less than 4 hours.'
+      );
+    });
+
+    it('should render UPG_DOWNLOADING state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_DOWNLOADING',
+          metadata: {
+            download_percent: 16.4,
+          },
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade downloading');
+      await expectTooltip(results, 'Downloading the new agent artifact version (16.4%).');
+    });
+
+    it('should render UPG_EXTRACTING state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_EXTRACTING',
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade extracting');
+      await expectTooltip(results, 'The new agent artifact is extracting.');
+    });
+
+    it('should render UPG_REPLACING state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_REPLACING',
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade replacing');
+      await expectTooltip(results, 'Replacing the agent artifact version.');
+    });
+
+    it('should render UPG_RESTARTING state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_RESTARTING',
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade restarting');
+      await expectTooltip(results, 'The agent is restarting to apply the update.');
+    });
+
+    it('should render UPG_WATCHING state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_WATCHING',
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade monitoring');
+      await expectTooltip(results, 'Monitoring the new agent version for errors.');
+    });
+
+    it('should render UPG_ROLLBACK state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_ROLLBACK',
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade rolled back');
+      await expectTooltip(results, 'Upgrade unsuccessful. Rolling back to previous version.');
+    });
+
+    it('should render UPG_FAILED state correctly', async () => {
+      const results = render({
+        agentUpgradeDetails: {
+          target_version: 'XXX',
+          action_id: 'xxx',
+          state: 'UPG_FAILED',
+          metadata: {
+            failed_state: 'UPG_DOWNLOADING',
+            error_msg: 'Something went wrong',
+          },
+        },
+      });
+
+      expectUpgradeStatusBadgeLabel(results, 'Upgrade failed');
+      await expectTooltip(results, 'Upgrade failed: Something went wrong.');
+    });
+  });
+
+  describe('with no agent upgrade details', () => {
+    it('should render a badge with no tooltip if the agent is upgradable', () => {
+      const results = render({
+        isAgentUpgradable: true,
+      });
+
+      expectNoUpgradeStatusBadges(results);
+      expect(results.queryByText('Upgrade available')).toBeInTheDocument();
+      expect(results.queryAllByText('Info')).toEqual([]);
+    });
+
+    // Unskip this test when minVersion is set.
+    it.skip('should render an icon with tooltip if the agent is upgrading', async () => {
+      const results = render({
+        agentUpgradeStartedAt: '2023-10-03T14:34:12Z',
+        agentUpgradedAt: null,
+      });
+
+      expectNoUpgradeStatusBadges(results);
+      expect(results.getByText('Info')).toBeInTheDocument();
+
+      await expectTooltip(
+        results,
+        'Detailed upgrade status is available for Elastic Agents on version 8.12 and higher.'
+      );
+    });
+
+    it('should not render anything if the agent is neither upgrading nor upgradable', () => {
+      const results = render({
+        agentUpgradeStartedAt: null,
+        agentUpgradedAt: '2023-10-03T14:34:12Z',
+      });
+      expectNoUpgradeStatusBadges(results);
+      expect(
+        results.container.querySelector('[data-euiicon-type="iInCircle"]')
+      ).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.tsx
new file mode 100644
index 0000000000000..de9767c2f0b54
--- /dev/null
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/components/agent_upgrade_status.tsx
@@ -0,0 +1,269 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo } from 'react';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { EuiBadge, EuiFlexGroup, EuiFlexItem, EuiIconTip } from '@elastic/eui';
+
+import type { AgentUpgradeDetails } from '../../../../../../../common/types';
+
+/**
+ * Returns a user-friendly string for the estimated remaining time until the upgrade is scheduled.
+ */
+export function getUpgradeStartDelay(scheduledAt?: string): string {
+  const timeDiffMillis = Date.parse(scheduledAt || '') - Date.now();
+
+  if (timeDiffMillis < 0) {
+    // The scheduled time should not be in the past, this would indicate an issue.
+    // We choose not to provide a time estimation rather than negative duration.
+    return '';
+  }
+
+  if (timeDiffMillis < 15 * 6e4) {
+    return ' The upgrade will start in less than 15 minutes.';
+  }
+  if (timeDiffMillis < 30 * 6e4) {
+    return ' The upgrade will start in less than 30 minutes.';
+  }
+  if (timeDiffMillis < 60 * 6e4) {
+    return ' The upgrade will start in less than 1 hour.';
+  }
+  return ` The upgrade will start in less than ${Math.ceil(timeDiffMillis / 36e5)} hours.`;
+}
+
+export function getDownloadEstimate(downloadPercent?: number): string {
+  if (!downloadPercent || downloadPercent === 0) {
+    return '';
+  }
+
+  return ` (${downloadPercent}%)`;
+}
+
+function getStatusComponents(agentUpgradeDetails?: AgentUpgradeDetails) {
+  switch (agentUpgradeDetails?.state) {
+    case 'UPG_REQUESTED':
+      return {
+        Badge: (
+          <EuiBadge color="accent" iconType="calendar">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeRequested"
+              defaultMessage="Upgrade requested"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeRequested"
+            defaultMessage="The agent has requested an upgrade."
+          />
+        ),
+      };
+    case 'UPG_SCHEDULED':
+      return {
+        Badge: (
+          <EuiBadge color="accent" iconType="clock">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeScheduled"
+              defaultMessage="Upgrade scheduled"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeScheduled"
+            defaultMessage="The agent has been instructed to upgrade.{upgradeStartDelay}"
+            values={{
+              upgradeStartDelay: getUpgradeStartDelay(agentUpgradeDetails.metadata.scheduled_at),
+            }}
+          />
+        ),
+      };
+    case 'UPG_DOWNLOADING':
+      return {
+        Badge: (
+          <EuiBadge color="accent" iconType="download">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeDownloading"
+              defaultMessage="Upgrade downloading"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeDownloading"
+            defaultMessage="Downloading the new agent artifact version{downloadEstimate}."
+            values={{
+              downloadEstimate: getDownloadEstimate(agentUpgradeDetails?.metadata.download_percent),
+            }}
+          />
+        ),
+      };
+    case 'UPG_EXTRACTING':
+      return {
+        Badge: (
+          <EuiBadge color="accent" iconType="package">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeExtracting"
+              defaultMessage="Upgrade extracting"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeExtracting"
+            defaultMessage="The new agent artifact is extracting."
+          />
+        ),
+      };
+    case 'UPG_REPLACING':
+      return {
+        Badge: (
+          <EuiBadge color="warning" iconType="copy">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeReplacing"
+              defaultMessage="Upgrade replacing"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeReplacing"
+            defaultMessage="Replacing the agent artifact version."
+          />
+        ),
+      };
+    case 'UPG_RESTARTING':
+      return {
+        Badge: (
+          <EuiBadge color="warning" iconType="refresh">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeRestarting"
+              defaultMessage="Upgrade restarting"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeRestarting"
+            defaultMessage="The agent is restarting to apply the update."
+          />
+        ),
+      };
+    case 'UPG_WATCHING':
+      return {
+        Badge: (
+          <EuiBadge color="warning" iconType="inspect">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeMonitoring"
+              defaultMessage="Upgrade monitoring"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeMonitoring"
+            defaultMessage="Monitoring the new agent version for errors."
+          />
+        ),
+      };
+    case 'UPG_ROLLBACK':
+      return {
+        Badge: (
+          <EuiBadge color="danger" iconType="returnKey">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeRolledBack"
+              defaultMessage="Upgrade rolled back"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeRolledBack"
+            defaultMessage="Upgrade unsuccessful. Rolling back to previous version."
+          />
+        ),
+      };
+    case 'UPG_FAILED':
+      return {
+        Badge: (
+          <EuiBadge color="danger" iconType="error">
+            <FormattedMessage
+              id="xpack.fleet.agentUpgradeStatusBadge.upgradeFailed"
+              defaultMessage="Upgrade failed"
+            />
+          </EuiBadge>
+        ),
+        TooltipText: (
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeFailed"
+            defaultMessage="Upgrade failed: {errorMsg}."
+            values={{
+              errorMsg: agentUpgradeDetails?.metadata.error_msg,
+            }}
+          />
+        ),
+      };
+    default:
+      return null;
+  }
+}
+
+export const AgentUpgradeStatus: React.FC<{
+  isAgentUpgradable: boolean;
+  agentUpgradeStartedAt?: string | null;
+  agentUpgradedAt?: string | null;
+  agentUpgradeDetails?: AgentUpgradeDetails;
+}> = ({ isAgentUpgradable, agentUpgradeStartedAt, agentUpgradedAt, agentUpgradeDetails }) => {
+  const isAgentUpgrading = useMemo(
+    () => agentUpgradeStartedAt && !agentUpgradedAt,
+    [agentUpgradeStartedAt, agentUpgradedAt]
+  );
+  const status = useMemo(() => getStatusComponents(agentUpgradeDetails), [agentUpgradeDetails]);
+  const minVersion = undefined; // Change this to a string in order for a tooltip to render for upgrading agents with no upgrade details.
+
+  if (isAgentUpgradable) {
+    return (
+      <EuiBadge color="hollow" iconType="sortUp">
+        <FormattedMessage
+          id="xpack.fleet.agentUpgradeStatusBadge.upgradeAvailable"
+          defaultMessage="Upgrade available"
+        />
+      </EuiBadge>
+    );
+  }
+
+  if (agentUpgradeDetails && status) {
+    return (
+      <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
+        <EuiFlexItem grow={false}>{status.Badge}</EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiIconTip type="iInCircle" content={status.TooltipText} color="subdued" />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+
+  if (minVersion && isAgentUpgrading) {
+    return (
+      <EuiIconTip
+        type="iInCircle"
+        content={
+          <FormattedMessage
+            id="xpack.fleet.agentUpgradeStatusTooltip.upgradeDetailsNotAvailable"
+            defaultMessage="Detailed upgrade status is available for Elastic Agents on version {minVersion} and higher."
+            values={{
+              minVersion,
+            }}
+          />
+        }
+        color="subdued"
+      />
+    );
+  }
+
+  return null;
+};
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid/controls.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid/controls.tsx
index cb5c61ff57a14..c50d396c143f8 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid/controls.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/components/package_list_grid/controls.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { type ReactNode } from 'react';
+import styled from 'styled-components';
 
 import { EuiFlexGroup, EuiSpacer, EuiTitle } from '@elastic/eui';
 
@@ -14,6 +15,10 @@ interface ControlsColumnProps {
   title: string | undefined;
 }
 
+const FlexGroupWithMaxHeight = styled(EuiFlexGroup)`
+  max-height: calc(100vh - 120px);
+`;
+
 export const ControlsColumn = ({ controls, title }: ControlsColumnProps) => {
   let titleContent;
   if (title) {
@@ -27,9 +32,9 @@ export const ControlsColumn = ({ controls, title }: ControlsColumnProps) => {
     );
   }
   return (
-    <EuiFlexGroup direction="column" gutterSize="none">
+    <FlexGroupWithMaxHeight direction="column" gutterSize="none">
       {titleContent}
       {controls}
-    </EuiFlexGroup>
+    </FlexGroupWithMaxHeight>
   );
 };
diff --git a/x-pack/plugins/fleet/server/collectors/agent_collectors.ts b/x-pack/plugins/fleet/server/collectors/agent_collectors.ts
index 109f2d5d36c0b..09a4986e0e6f0 100644
--- a/x-pack/plugins/fleet/server/collectors/agent_collectors.ts
+++ b/x-pack/plugins/fleet/server/collectors/agent_collectors.ts
@@ -58,13 +58,13 @@ export const getAgentUsage = async (
   };
 };
 
+export interface AgentPerVersion {
+  version: string;
+  count: number;
+}
+
 export interface AgentData {
-  agents_per_version: Array<
-    {
-      version: string;
-      count: number;
-    } & AgentStatus
-  >;
+  agents_per_version: Array<AgentPerVersion & AgentStatus>;
   agent_checkin_status: {
     error: number;
     degraded: number;
diff --git a/x-pack/plugins/fleet/server/constants/mappings.ts b/x-pack/plugins/fleet/server/constants/mappings.ts
index 9ae9353396803..75ff9cbb549be 100644
--- a/x-pack/plugins/fleet/server/constants/mappings.ts
+++ b/x-pack/plugins/fleet/server/constants/mappings.ts
@@ -298,6 +298,47 @@ export const AGENT_MAPPINGS = {
     upgrade_status: {
       type: 'keyword',
     },
+    upgrade_details: {
+      properties: {
+        target_version: {
+          type: 'text',
+          fields: {
+            keyword: {
+              type: 'keyword',
+              ignore_above: 16,
+            },
+          },
+        },
+        action_id: {
+          type: 'keyword',
+        },
+        state: {
+          type: 'keyword',
+        },
+        metadata: {
+          properties: {
+            scheduled_at: {
+              type: 'date',
+            },
+            download_percent: {
+              type: 'double',
+            },
+            failed_state: {
+              type: 'keyword',
+            },
+            error_msg: {
+              type: 'text',
+              fields: {
+                keyword: {
+                  type: 'keyword',
+                  ignore_above: 1024,
+                },
+              },
+            },
+          },
+        },
+      },
+    },
     // added to allow validation on status field
     status: {
       type: 'keyword',
diff --git a/x-pack/plugins/fleet/server/mocks/index.ts b/x-pack/plugins/fleet/server/mocks/index.ts
index adc0ecb1931b4..2716fd82b6811 100644
--- a/x-pack/plugins/fleet/server/mocks/index.ts
+++ b/x-pack/plugins/fleet/server/mocks/index.ts
@@ -84,6 +84,7 @@ export const createAppContextStartContractMock = (
     config$,
     kibanaVersion: '8.99.0', // Fake version :)
     kibanaBranch: 'main',
+    kibanaInstanceId: '1',
     telemetryEventsSender: createMockTelemetryEventsSender(),
     bulkActionsResolver: {} as any,
     messageSigningService: createMessageSigningServiceMock(),
diff --git a/x-pack/plugins/fleet/server/plugin.ts b/x-pack/plugins/fleet/server/plugin.ts
index e0aa5315d8ff9..e6310a0b0da59 100644
--- a/x-pack/plugins/fleet/server/plugin.ts
+++ b/x-pack/plugins/fleet/server/plugin.ts
@@ -130,6 +130,8 @@ import { FleetActionsClient, type FleetActionsClientInterface } from './services
 import type { FilesClientFactory } from './services/files/types';
 import { PolicyWatcher } from './services/agent_policy_watch';
 import { getPackageSpecTagId } from './services/epm/kibana/assets/tag_assets';
+import { FleetMetricsTask } from './services/metrics/fleet_metrics_task';
+import { fetchAgentMetrics } from './services/metrics/fetch_agent_metrics';
 
 export interface FleetSetupDeps {
   security: SecurityPluginSetup;
@@ -167,6 +169,7 @@ export interface FleetAppContext {
   isProductionMode: PluginInitializerContext['env']['mode']['prod'];
   kibanaVersion: PluginInitializerContext['env']['packageInfo']['version'];
   kibanaBranch: PluginInitializerContext['env']['packageInfo']['branch'];
+  kibanaInstanceId: PluginInitializerContext['env']['instanceUuid'];
   cloud?: CloudSetup;
   logger?: Logger;
   httpSetup?: HttpServiceSetup;
@@ -251,6 +254,7 @@ export class FleetPlugin
   private isProductionMode: FleetAppContext['isProductionMode'];
   private kibanaVersion: FleetAppContext['kibanaVersion'];
   private kibanaBranch: FleetAppContext['kibanaBranch'];
+  private kibanaInstanceId: FleetAppContext['kibanaInstanceId'];
   private httpSetup?: HttpServiceSetup;
   private securitySetup!: SecurityPluginSetup;
   private encryptedSavedObjectsSetup?: EncryptedSavedObjectsPluginSetup;
@@ -259,6 +263,7 @@ export class FleetPlugin
   private bulkActionsResolver?: BulkActionsResolver;
   private fleetUsageSender?: FleetUsageSender;
   private checkDeletedFilesTask?: CheckDeletedFilesTask;
+  private fleetMetricsTask?: FleetMetricsTask;
 
   private agentService?: AgentService;
   private packageService?: PackageService;
@@ -270,6 +275,7 @@ export class FleetPlugin
     this.isProductionMode = this.initializerContext.env.mode.prod;
     this.kibanaVersion = this.initializerContext.env.packageInfo.version;
     this.kibanaBranch = this.initializerContext.env.packageInfo.branch;
+    this.kibanaInstanceId = this.initializerContext.env.instanceUuid;
     this.logger = this.initializerContext.logger.get();
     this.configInitialValue = this.initializerContext.config.get();
     this.telemetryEventsSender = new TelemetryEventsSender(this.logger.get('telemetry_events'));
@@ -440,6 +446,10 @@ export class FleetPlugin
     this.fleetUsageSender = new FleetUsageSender(deps.taskManager, core, fetch);
     registerFleetUsageLogger(deps.taskManager, async () => fetchAgentsUsage(core, config));
 
+    const fetchAgents = async (abortController: AbortController) =>
+      await fetchAgentMetrics(core, abortController);
+    this.fleetMetricsTask = new FleetMetricsTask(deps.taskManager, fetchAgents);
+
     const router: FleetRouter = core.http.createRouter<FleetRequestHandlerContext>();
     // Allow read-only users access to endpoints necessary for Integrations UI
     // Only some endpoints require superuser so we pass a raw IRouter here
@@ -490,6 +500,7 @@ export class FleetPlugin
       isProductionMode: this.isProductionMode,
       kibanaVersion: this.kibanaVersion,
       kibanaBranch: this.kibanaBranch,
+      kibanaInstanceId: this.kibanaInstanceId,
       httpSetup: this.httpSetup,
       cloud: this.cloud,
       logger: this.logger,
@@ -504,6 +515,7 @@ export class FleetPlugin
     this.fleetUsageSender?.start(plugins.taskManager);
     this.checkDeletedFilesTask?.start({ taskManager: plugins.taskManager });
     startFleetUsageLogger(plugins.taskManager);
+    this.fleetMetricsTask?.start(plugins.taskManager, core.elasticsearch.client.asInternalUser);
 
     const logger = appContextService.getLogger();
 
diff --git a/x-pack/plugins/fleet/server/services/agents/helpers.ts b/x-pack/plugins/fleet/server/services/agents/helpers.ts
index 4aaab95e9d1ac..6da24cdbfb55c 100644
--- a/x-pack/plugins/fleet/server/services/agents/helpers.ts
+++ b/x-pack/plugins/fleet/server/services/agents/helpers.ts
@@ -66,6 +66,7 @@ export function searchHitToAgent(
     unenrollment_started_at: hit._source?.unenrollment_started_at,
     upgraded_at: hit._source?.upgraded_at,
     upgrade_started_at: hit._source?.upgrade_started_at,
+    upgrade_details: hit._source?.upgrade_details,
     access_api_key_id: hit._source?.access_api_key_id,
     default_api_key_id: hit._source?.default_api_key_id,
     policy_id: hit._source?.policy_id,
diff --git a/x-pack/plugins/fleet/server/services/app_context.ts b/x-pack/plugins/fleet/server/services/app_context.ts
index c5c99432d8575..24b35b7b10201 100644
--- a/x-pack/plugins/fleet/server/services/app_context.ts
+++ b/x-pack/plugins/fleet/server/services/app_context.ts
@@ -62,6 +62,7 @@ class AppContextService {
   private isProductionMode: FleetAppContext['isProductionMode'] = false;
   private kibanaVersion: FleetAppContext['kibanaVersion'] = kibanaPackageJson.version;
   private kibanaBranch: FleetAppContext['kibanaBranch'] = kibanaPackageJson.branch;
+  private kibanaInstanceId: FleetAppContext['kibanaInstanceId'] = '';
   private cloud?: CloudSetup;
   private logger: Logger | undefined;
   private httpSetup?: HttpServiceSetup;
@@ -86,6 +87,7 @@ class AppContextService {
     this.logger = appContext.logger;
     this.kibanaVersion = appContext.kibanaVersion;
     this.kibanaBranch = appContext.kibanaBranch;
+    this.kibanaInstanceId = appContext.kibanaInstanceId;
     this.httpSetup = appContext.httpSetup;
     this.telemetryEventsSender = appContext.telemetryEventsSender;
     this.savedObjectsTagging = appContext.savedObjectsTagging;
@@ -209,6 +211,10 @@ class AppContextService {
     return this.kibanaBranch;
   }
 
+  public getKibanaInstanceId() {
+    return this.kibanaInstanceId;
+  }
+
   public addExternalCallback(type: ExternalCallback[0], callback: ExternalCallback[1]) {
     if (!this.externalCallbacks.has(type)) {
       this.externalCallbacks.set(type, new Set());
diff --git a/x-pack/plugins/fleet/server/services/epm/filtered_packages.ts b/x-pack/plugins/fleet/server/services/epm/filtered_packages.ts
index 696554a1451a4..4f18f6fbfddb8 100644
--- a/x-pack/plugins/fleet/server/services/epm/filtered_packages.ts
+++ b/x-pack/plugins/fleet/server/services/epm/filtered_packages.ts
@@ -22,12 +22,8 @@ export function getFilteredSearchPackages() {
 }
 
 export function getFilteredInstallPackages() {
-  const shouldFilterFleetServer = appContextService.getConfig()?.internal?.fleetServerStandalone;
   const filtered: string[] = [];
-  // Do not allow to install Fleet server integration if configured to use standalone fleet server
-  if (shouldFilterFleetServer) {
-    filtered.push(FLEET_SERVER_PACKAGE);
-  }
+
   const excludePackages = appContextService.getConfig()?.internal?.registry?.excludePackages ?? [];
 
   return filtered.concat(excludePackages);
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/bundled_package.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/bundled_package.test.ts
new file mode 100644
index 0000000000000..f44a865e8992c
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/epm/packages/bundled_package.test.ts
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import fs from 'fs/promises';
+
+import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
+
+import { appContextService } from '../../app_context';
+
+import { getBundledPackageByPkgKey, getBundledPackages } from './bundled_packages';
+
+jest.mock('fs/promises');
+jest.mock('../../app_context');
+
+describe('bundledPackages', () => {
+  beforeAll(() => {
+    jest.mocked(appContextService.getConfig).mockReturnValue({
+      developer: {
+        bundledPackageLocation: '/tmp/test',
+      },
+    } as any);
+    jest.mocked(appContextService.getLogger).mockReturnValue(loggingSystemMock.createLogger());
+  });
+  beforeEach(() => {
+    jest.mocked(fs.stat).mockResolvedValue({} as any);
+    jest.mocked(fs.readdir).mockResolvedValue(['apm-8.8.0.zip', 'test-1.0.0.zip'] as any);
+    jest.mocked(fs.readFile).mockResolvedValue(Buffer.from('TEST'));
+  });
+
+  afterEach(() => {
+    jest.mocked(fs.stat).mockReset();
+  });
+  describe('getBundledPackages', () => {
+    it('return an empty array if dir do not exists', async () => {
+      jest.mocked(fs.stat).mockRejectedValue(new Error('NOTEXISTS'));
+      const packages = await getBundledPackages();
+      expect(packages).toEqual([]);
+    });
+
+    it('return packages in bundled directory', async () => {
+      const packages = await getBundledPackages();
+      expect(packages).toEqual([
+        {
+          name: 'apm',
+          version: '8.8.0',
+          buffer: Buffer.from('TEST'),
+        },
+        {
+          name: 'test',
+          version: '1.0.0',
+          buffer: Buffer.from('TEST'),
+        },
+      ]);
+    });
+  });
+  describe('getBundledPackageByPkgKey', () => {
+    it('should return package by name if no version is provided', async () => {
+      const pkg = await getBundledPackageByPkgKey('apm');
+
+      expect(pkg).toBeDefined();
+      expect(pkg).toEqual({
+        name: 'apm',
+        version: '8.8.0',
+        buffer: Buffer.from('TEST'),
+      });
+    });
+
+    it('should return package by name and version if version is provided', async () => {
+      const pkg = await getBundledPackageByPkgKey('apm-8.8.0');
+
+      expect(pkg).toBeDefined();
+      expect(pkg).toEqual({
+        name: 'apm',
+        version: '8.8.0',
+        buffer: Buffer.from('TEST'),
+      });
+    });
+
+    it('should return package by name and version if version is provided and do not exists', async () => {
+      const pkg = await getBundledPackageByPkgKey('apm-8.0.0');
+
+      expect(pkg).not.toBeDefined();
+    });
+  });
+});
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/bundled_packages.ts b/x-pack/plugins/fleet/server/services/epm/packages/bundled_packages.ts
index ede8a25ca254f..decd5e977506c 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/bundled_packages.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/bundled_packages.ts
@@ -11,7 +11,7 @@ import path from 'path';
 import type { BundledPackage } from '../../../types';
 import { FleetError } from '../../../errors';
 import { appContextService } from '../../app_context';
-import { splitPkgKey } from '../registry';
+import { splitPkgKey, pkgToPkgKey } from '../registry';
 
 export async function getBundledPackages(): Promise<BundledPackage[]> {
   const config = appContextService.getConfig();
@@ -57,6 +57,21 @@ export async function getBundledPackages(): Promise<BundledPackage[]> {
   }
 }
 
+export async function getBundledPackageByPkgKey(
+  pkgKey: string
+): Promise<BundledPackage | undefined> {
+  const bundledPackages = await getBundledPackages();
+  const bundledPackage = bundledPackages.find((pkg) => {
+    if (pkgKey.includes('-')) {
+      return pkgToPkgKey(pkg) === pkgKey;
+    } else {
+      return pkg.name === pkgKey;
+    }
+  });
+
+  return bundledPackage;
+}
+
 export async function getBundledPackageByName(name: string): Promise<BundledPackage | undefined> {
   const bundledPackages = await getBundledPackages();
   const bundledPackage = bundledPackages.find((pkg) => pkg.name === name);
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
index 9030026da7c49..d21e023ce7cdd 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install.test.ts
@@ -22,7 +22,7 @@ import * as Registry from '../registry';
 
 import { createInstallation, handleInstallPackageFailure, installPackage } from './install';
 import * as install from './_install_package';
-import { getBundledPackages } from './bundled_packages';
+import { getBundledPackageByPkgKey } from './bundled_packages';
 
 import * as obj from '.';
 
@@ -80,7 +80,7 @@ jest.mock('../archive', () => {
 });
 jest.mock('../../audit_logging');
 
-const mockGetBundledPackages = jest.mocked(getBundledPackages);
+const mockGetBundledPackageByPkgKey = jest.mocked(getBundledPackageByPkgKey);
 const mockedAuditLoggingService = jest.mocked(auditLoggingService);
 
 describe('createInstallation', () => {
@@ -143,13 +143,13 @@ describe('install', () => {
       } as any)
     );
 
-    mockGetBundledPackages.mockReset();
+    mockGetBundledPackageByPkgKey.mockReset();
     (install._installPackage as jest.Mock).mockClear();
   });
 
   describe('registry', () => {
     beforeEach(() => {
-      mockGetBundledPackages.mockResolvedValue([]);
+      mockGetBundledPackageByPkgKey.mockResolvedValue(undefined);
     });
 
     it('should send telemetry on install failure, out of date', async () => {
@@ -265,13 +265,11 @@ describe('install', () => {
 
     it('should install from bundled package if one exists', async () => {
       (install._installPackage as jest.Mock).mockResolvedValue({});
-      mockGetBundledPackages.mockResolvedValue([
-        {
-          name: 'test_package',
-          version: '1.0.0',
-          buffer: Buffer.from('test_package'),
-        },
-      ]);
+      mockGetBundledPackageByPkgKey.mockResolvedValue({
+        name: 'test_package',
+        version: '1.0.0',
+        buffer: Buffer.from('test_package'),
+      });
 
       const response = await installPackage({
         spaceId: DEFAULT_SPACE_ID,
@@ -332,7 +330,7 @@ describe('install', () => {
       expect(response.status).toEqual('already_installed');
     });
 
-    it('should not allow to install fleet_server if internal.fleetServerStandalone is configured', async () => {
+    it('should allow to install fleet_server if internal.fleetServerStandalone is configured', async () => {
       jest.mocked(appContextService.getConfig).mockReturnValueOnce({
         internal: {
           fleetServerStandalone: true,
@@ -347,8 +345,7 @@ describe('install', () => {
         esClient: {} as ElasticsearchClient,
       });
 
-      expect(response.error).toBeDefined();
-      expect(response.error?.message).toMatch(/fleet_server installation is not authorized/);
+      expect(response.status).toEqual('installed');
     });
   });
 
@@ -429,7 +426,7 @@ describe('handleInstallPackageFailure', () => {
     jest.mocked(install._installPackage).mockClear();
     jest.mocked(install._installPackage).mockResolvedValue({} as any);
     mockedLogger.error.mockClear();
-    mockGetBundledPackages.mockResolvedValue([]);
+    mockGetBundledPackageByPkgKey.mockResolvedValue(undefined);
     jest.spyOn(licenseService, 'hasAtLeast').mockReturnValue(true);
     jest.spyOn(Registry, 'splitPkgKey').mockImplementation((pkgKey: string) => {
       const [pkgName, pkgVersion] = pkgKey.split('-');
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install.ts b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
index 78708c7716502..ffd1dfe6379c2 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
@@ -95,7 +95,7 @@ import { removeInstallation } from './remove';
 import { getPackageSavedObjects } from './get';
 import { _installPackage } from './_install_package';
 import { removeOldAssets } from './cleanup';
-import { getBundledPackages } from './bundled_packages';
+import { getBundledPackageByPkgKey } from './bundled_packages';
 import { withPackageSpan } from './utils';
 import { convertStringToTitle, generateDescription } from './custom_integrations/utils';
 import { INITIAL_VERSION } from './custom_integrations/constants';
@@ -718,8 +718,6 @@ export async function installPackage(args: InstallPackageParams): Promise<Instal
 
   const authorizationHeader = args.authorizationHeader;
 
-  const bundledPackages = await getBundledPackages();
-
   if (args.installSource === 'registry') {
     const {
       pkgkey,
@@ -732,9 +730,7 @@ export async function installPackage(args: InstallPackageParams): Promise<Instal
       skipDataStreamRollover,
     } = args;
 
-    const matchingBundledPackage = bundledPackages.find(
-      (pkg) => Registry.pkgToPkgKey(pkg) === pkgkey
-    );
+    const matchingBundledPackage = await getBundledPackageByPkgKey(pkgkey);
 
     if (matchingBundledPackage) {
       logger.debug(
diff --git a/x-pack/plugins/fleet/server/services/metrics/fetch_agent_metrics.test.ts b/x-pack/plugins/fleet/server/services/metrics/fetch_agent_metrics.test.ts
new file mode 100644
index 0000000000000..fee9e7497e0ef
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/metrics/fetch_agent_metrics.test.ts
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ElasticsearchClientMock } from '@kbn/core/server/mocks';
+import { coreMock } from '@kbn/core/server/mocks';
+import type { CoreSetup } from '@kbn/core/server';
+
+import { fetchAgentMetrics } from './fetch_agent_metrics';
+
+jest.mock('../../collectors/agent_collectors', () => {
+  return {
+    getAgentUsage: jest.fn().mockResolvedValue({}),
+  };
+});
+
+describe('fetchAgentMetrics', () => {
+  const { createSetup: coreSetupMock } = coreMock;
+  const abortController = new AbortController();
+  let mockCore: CoreSetup;
+  let esClient: ElasticsearchClientMock;
+
+  beforeEach(async () => {
+    mockCore = coreSetupMock();
+    const [{ elasticsearch }] = await mockCore.getStartServices();
+    esClient = elasticsearch.client.asInternalUser as ElasticsearchClientMock;
+  });
+
+  it('should fetch agent metrics', async () => {
+    esClient.search.mockResolvedValue({
+      took: 5,
+      timed_out: false,
+      _shards: {
+        total: 1,
+        successful: 1,
+        skipped: 0,
+        failed: 0,
+      },
+      hits: {
+        total: {
+          value: 0,
+          relation: 'eq',
+        },
+        hits: [],
+      },
+      aggregations: {
+        versions: {
+          buckets: [
+            {
+              key: '8.12.0',
+              doc_count: 1,
+            },
+          ],
+        },
+        upgrade_details: {
+          buckets: [
+            {
+              key: 'UPG_REQUESTED',
+              doc_count: 1,
+            },
+          ],
+        },
+      },
+    });
+
+    const result = await fetchAgentMetrics(mockCore, abortController);
+
+    expect(result).toEqual({
+      agents: {},
+      agents_per_version: [
+        {
+          version: '8.12.0',
+          count: 1,
+        },
+      ],
+      upgrading_step: {
+        downloading: 0,
+        extracting: 0,
+        failed: 0,
+        replacing: 0,
+        requested: 1,
+        restarting: 0,
+        rollback: 0,
+        scheduled: 0,
+        watching: 0,
+      },
+    });
+  });
+});
diff --git a/x-pack/plugins/fleet/server/services/metrics/fetch_agent_metrics.ts b/x-pack/plugins/fleet/server/services/metrics/fetch_agent_metrics.ts
new file mode 100644
index 0000000000000..b768213986f3a
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/metrics/fetch_agent_metrics.ts
@@ -0,0 +1,180 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
+import type { CoreSetup } from '@kbn/core/server';
+
+import { AGENTS_INDEX } from '../../../common';
+
+import type { AgentPerVersion, AgentUsage } from '../../collectors/agent_collectors';
+import { getAgentUsage } from '../../collectors/agent_collectors';
+import { getInternalClients } from '../../collectors/helpers';
+import { appContextService } from '../app_context';
+import { retryTransientEsErrors } from '../epm/elasticsearch/retry';
+
+export interface AgentMetrics {
+  agents: AgentUsage;
+  agents_per_version: AgentPerVersion[];
+  upgrading_step: UpgradingSteps;
+}
+
+export interface UpgradingSteps {
+  requested: number;
+  scheduled: number;
+  downloading: number;
+  extracting: number;
+  replacing: number;
+  restarting: number;
+  watching: number;
+  rollback: number;
+  failed: number;
+}
+
+export const fetchAgentMetrics = async (
+  core: CoreSetup,
+  abortController: AbortController
+): Promise<AgentMetrics | undefined> => {
+  const [soClient, esClient] = await getInternalClients(core);
+  if (!soClient || !esClient) {
+    return;
+  }
+  const usage = {
+    agents: await getAgentUsage(soClient, esClient),
+    agents_per_version: await getAgentsPerVersion(esClient, abortController),
+    upgrading_step: await getUpgradingSteps(esClient, abortController),
+  };
+  return usage;
+};
+
+export const getAgentsPerVersion = async (
+  esClient: ElasticsearchClient,
+  abortController: AbortController
+): Promise<AgentPerVersion[]> => {
+  try {
+    const response = await retryTransientEsErrors(() =>
+      esClient.search(
+        {
+          index: AGENTS_INDEX,
+          query: {
+            bool: {
+              filter: [
+                {
+                  term: {
+                    active: 'true',
+                  },
+                },
+              ],
+            },
+          },
+          size: 0,
+          aggs: {
+            versions: {
+              terms: { field: 'agent.version' },
+            },
+          },
+        },
+        { signal: abortController.signal }
+      )
+    );
+    return ((response?.aggregations?.versions as any).buckets ?? []).map((bucket: any) => ({
+      version: bucket.key,
+      count: bucket.doc_count,
+    }));
+  } catch (error) {
+    if (error.statusCode === 404) {
+      appContextService.getLogger().debug('Index .fleet-agents does not exist yet.');
+    } else {
+      throw error;
+    }
+    return [];
+  }
+};
+
+export const getUpgradingSteps = async (
+  esClient: ElasticsearchClient,
+  abortController: AbortController
+): Promise<UpgradingSteps> => {
+  const upgradingSteps = {
+    requested: 0,
+    scheduled: 0,
+    downloading: 0,
+    extracting: 0,
+    replacing: 0,
+    restarting: 0,
+    watching: 0,
+    rollback: 0,
+    failed: 0,
+  };
+  try {
+    const response = await retryTransientEsErrors(() =>
+      esClient.search(
+        {
+          index: AGENTS_INDEX,
+          query: {
+            bool: {
+              filter: [
+                {
+                  term: {
+                    active: 'true',
+                  },
+                },
+              ],
+            },
+          },
+          size: 0,
+          aggs: {
+            upgrade_details: {
+              terms: { field: 'upgrade_details.state' },
+            },
+          },
+        },
+        { signal: abortController.signal }
+      )
+    );
+    ((response?.aggregations?.upgrade_details as any).buckets ?? []).forEach((bucket: any) => {
+      switch (bucket.key) {
+        case 'UPG_REQUESTED':
+          upgradingSteps.requested = bucket.doc_count;
+          break;
+        case 'UPG_SCHEDULED':
+          upgradingSteps.scheduled = bucket.doc_count;
+          break;
+        case 'UPG_DOWNLOADING':
+          upgradingSteps.downloading = bucket.doc_count;
+          break;
+        case 'UPG_EXTRACTING':
+          upgradingSteps.extracting = bucket.doc_count;
+          break;
+        case 'UPG_REPLACING':
+          upgradingSteps.replacing = bucket.doc_count;
+          break;
+        case 'UPG_RESTARTING':
+          upgradingSteps.restarting = bucket.doc_count;
+          break;
+        case 'UPG_WATCHING':
+          upgradingSteps.watching = bucket.doc_count;
+          break;
+        case 'UPG_ROLLBACK':
+          upgradingSteps.rollback = bucket.doc_count;
+          break;
+        case 'UPG_FAILED':
+          upgradingSteps.failed = bucket.doc_count;
+          break;
+        default:
+          break;
+      }
+    });
+    return upgradingSteps;
+  } catch (error) {
+    if (error.statusCode === 404) {
+      appContextService.getLogger().debug('Index .fleet-agents does not exist yet.');
+    } else {
+      throw error;
+    }
+    return upgradingSteps;
+  }
+};
diff --git a/x-pack/plugins/fleet/server/services/metrics/fleet_metrics_task.test.ts b/x-pack/plugins/fleet/server/services/metrics/fleet_metrics_task.test.ts
new file mode 100644
index 0000000000000..17c6ede4c3f74
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/metrics/fleet_metrics_task.test.ts
@@ -0,0 +1,218 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { coreMock } from '@kbn/core/server/mocks';
+import { taskManagerMock } from '@kbn/task-manager-plugin/server/mocks';
+import type { TaskManagerSetupContract } from '@kbn/task-manager-plugin/server';
+import { TaskStatus } from '@kbn/task-manager-plugin/server';
+import type { CoreSetup } from '@kbn/core/server';
+import type { ElasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks';
+
+import { appContextService } from '../app_context';
+import { createAppContextStartContractMock } from '../../mocks';
+
+import { FleetMetricsTask, TYPE, VERSION } from './fleet_metrics_task';
+
+const MOCK_TASK_INSTANCE = {
+  id: `${TYPE}:${VERSION}`,
+  runAt: new Date(),
+  attempts: 0,
+  ownerId: '',
+  status: TaskStatus.Running,
+  startedAt: new Date(),
+  scheduledAt: new Date(),
+  retryAt: new Date(),
+  params: {},
+  state: {},
+  taskType: TYPE,
+};
+
+describe('fleet metrics task', () => {
+  const { createSetup: coreSetupMock } = coreMock;
+  const { createSetup: tmSetupMock, createStart: tmStartMock } = taskManagerMock;
+
+  let mockContract: ReturnType<typeof createAppContextStartContractMock>;
+  let mockTask: FleetMetricsTask;
+  let mockCore: CoreSetup;
+  let mockTaskManagerSetup: jest.Mocked<TaskManagerSetupContract>;
+  let mockFetchAgentMetrics: jest.Mock;
+
+  let esClient: ElasticsearchClientMock;
+  beforeEach(async () => {
+    mockContract = createAppContextStartContractMock();
+    appContextService.start(mockContract);
+    mockCore = coreSetupMock();
+    mockTaskManagerSetup = tmSetupMock();
+    const [{ elasticsearch }] = await mockCore.getStartServices();
+    esClient = elasticsearch.client.asInternalUser as ElasticsearchClientMock;
+    mockFetchAgentMetrics = jest.fn();
+    mockTask = new FleetMetricsTask(mockTaskManagerSetup, async () => mockFetchAgentMetrics());
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('task lifecycle', () => {
+    it('should create task', () => {
+      expect(mockTask).toBeInstanceOf(FleetMetricsTask);
+    });
+
+    it('should register task', () => {
+      expect(mockTaskManagerSetup.registerTaskDefinitions).toHaveBeenCalled();
+    });
+
+    it('should schedule task', async () => {
+      const mockTaskManagerStart = tmStartMock();
+      await mockTask.start(mockTaskManagerStart, esClient);
+      expect(mockTaskManagerStart.ensureScheduled).toHaveBeenCalled();
+    });
+  });
+
+  describe('task logic', () => {
+    beforeEach(async () => {
+      esClient.info.mockResolvedValue({
+        cluster_uuid: 'cluster1',
+      } as any);
+
+      mockFetchAgentMetrics.mockResolvedValue({
+        agents: {
+          total_all_statuses: 10,
+          total_enrolled: 5,
+          unenrolled: 5,
+          healthy: 1,
+          offline: 1,
+          updating: 1,
+          unhealthy: 1,
+          inactive: 1,
+        },
+        upgrading_step: {
+          scheduled: 1,
+          requested: 1,
+        },
+        agents_per_version: [
+          {
+            version: '8.12.0',
+            count: 3,
+          },
+          {
+            version: '8.11.0',
+            count: 2,
+          },
+        ],
+      });
+    });
+
+    afterEach(() => {
+      jest.resetAllMocks();
+    });
+
+    const runTask = async (taskInstance = MOCK_TASK_INSTANCE) => {
+      const mockTaskManagerStart = tmStartMock();
+      await mockTask.start(mockTaskManagerStart, esClient);
+      const createTaskRunner =
+        mockTaskManagerSetup.registerTaskDefinitions.mock.calls[0][0][TYPE].createTaskRunner;
+      const taskRunner = createTaskRunner({ taskInstance });
+      return taskRunner.run();
+    };
+
+    it('should publish agent metrics', async () => {
+      await runTask();
+
+      expect(esClient.index).toHaveBeenCalledWith(
+        expect.objectContaining({
+          index: 'metrics-fleet_server.agent_status-default',
+          body: expect.objectContaining({
+            '@timestamp': expect.any(String),
+            data_stream: {
+              dataset: 'fleet_server.agent_status',
+              type: 'metrics',
+              namespace: 'default',
+            },
+            cluster: { id: 'cluster1' },
+            agent: { id: '1', version: '8.99.0', type: 'kibana' },
+            fleet: {
+              agents: {
+                total: 10,
+                enrolled: 5,
+                unenrolled: 5,
+                healthy: 1,
+                offline: 1,
+                updating: 1,
+                unhealthy: 1,
+                inactive: 1,
+                upgrading_step: {
+                  scheduled: 1,
+                  requested: 1,
+                },
+              },
+            },
+          }),
+        })
+      );
+
+      expect(esClient.bulk).toHaveBeenCalledWith({
+        index: 'metrics-fleet_server.agent_versions-default',
+        operations: [
+          { create: {} },
+          {
+            '@timestamp': expect.any(String),
+            agent: { id: '1', type: 'kibana', version: '8.99.0' },
+            cluster: { id: 'cluster1' },
+            data_stream: {
+              dataset: 'fleet_server.agent_versions',
+              namespace: 'default',
+              type: 'metrics',
+            },
+            fleet: { agent: { count: 3, version: '8.12.0' } },
+          },
+          { create: {} },
+          {
+            '@timestamp': expect.any(String),
+            agent: { id: '1', type: 'kibana', version: '8.99.0' },
+            cluster: { id: 'cluster1' },
+            data_stream: {
+              dataset: 'fleet_server.agent_versions',
+              namespace: 'default',
+              type: 'metrics',
+            },
+            fleet: { agent: { count: 2, version: '8.11.0' } },
+          },
+        ],
+        refresh: true,
+      });
+    });
+
+    it('should log errors from bulk create', async () => {
+      esClient.bulk.mockResolvedValue({
+        errors: true,
+        items: [
+          {
+            create: {
+              error: {
+                reason: 'error from es',
+              },
+            },
+          },
+          {
+            create: {
+              error: {
+                reason: 'error from es',
+              },
+            },
+          },
+        ],
+      } as any);
+
+      await runTask();
+
+      expect(appContextService.getLogger().warn).toHaveBeenCalledWith(
+        'Error occurred while publishing Fleet metrics: Error: error from es'
+      );
+    });
+  });
+});
diff --git a/x-pack/plugins/fleet/server/services/metrics/fleet_metrics_task.ts b/x-pack/plugins/fleet/server/services/metrics/fleet_metrics_task.ts
new file mode 100644
index 0000000000000..03f44bf96ae96
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/metrics/fleet_metrics_task.ts
@@ -0,0 +1,204 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type {
+  ConcreteTaskInstance,
+  TaskManagerStartContract,
+  TaskManagerSetupContract,
+} from '@kbn/task-manager-plugin/server';
+import { throwUnrecoverableError } from '@kbn/task-manager-plugin/server';
+import type { ElasticsearchClient } from '@kbn/core/server';
+import { withSpan } from '@kbn/apm-utils';
+
+import { uniq } from 'lodash';
+
+import { appContextService } from '../app_context';
+
+import type { AgentMetrics } from './fetch_agent_metrics';
+
+export const TYPE = 'Fleet-Metrics-Task';
+export const VERSION = '1.0.0';
+const TITLE = 'Fleet Metrics Task';
+const TIMEOUT = '1m';
+const SCOPE = ['fleet'];
+const INTERVAL = '1m';
+
+export class FleetMetricsTask {
+  private taskManager?: TaskManagerStartContract;
+  private wasStarted: boolean = false;
+  private abortController = new AbortController();
+  private esClient?: ElasticsearchClient;
+
+  constructor(
+    taskManager: TaskManagerSetupContract,
+    fetchAgentMetrics: (abortController: AbortController) => Promise<AgentMetrics | undefined>
+  ) {
+    taskManager.registerTaskDefinitions({
+      [TYPE]: {
+        title: TITLE,
+        timeout: TIMEOUT,
+        maxAttempts: 1,
+        createTaskRunner: ({ taskInstance }: { taskInstance: ConcreteTaskInstance }) => {
+          return {
+            run: async () => {
+              return withSpan({ name: TYPE, type: 'metrics' }, () =>
+                this.runTask(taskInstance, () => fetchAgentMetrics(this.abortController))
+              );
+            },
+
+            cancel: async () => {
+              this.abortController.abort('task timed out');
+            },
+          };
+        },
+      },
+    });
+  }
+
+  private runTask = async (
+    taskInstance: ConcreteTaskInstance,
+    fetchAgentMetrics: () => Promise<AgentMetrics | undefined>
+  ) => {
+    if (!this.wasStarted) {
+      appContextService.getLogger().debug('[runTask()] Aborted. Task not started yet');
+      return;
+    }
+    // Check that this task is current
+    if (taskInstance.id !== this.taskId) {
+      throwUnrecoverableError(new Error('Outdated task version for task: ' + taskInstance.id));
+      return;
+    }
+    if (!this.esClient) {
+      appContextService.getLogger().info('esClient not set, skipping Fleet metrics task');
+      return;
+    }
+    appContextService.getLogger().info('Running Fleet metrics task');
+
+    try {
+      const agentMetrics = await fetchAgentMetrics();
+      if (!agentMetrics) {
+        return;
+      }
+      const { agents_per_version: agentsPerVersion, agents } = agentMetrics;
+      const clusterInfo = await this.esClient.info();
+      const getCommonFields = (dataset: string) => {
+        return {
+          data_stream: {
+            dataset,
+            type: 'metrics',
+            namespace: 'default',
+          },
+          agent: {
+            id: appContextService.getKibanaInstanceId(),
+            version: appContextService.getKibanaVersion(),
+            type: 'kibana',
+          },
+          cluster: {
+            id: clusterInfo?.cluster_uuid ?? '',
+          },
+        };
+      };
+      const agentStatusDoc = {
+        '@timestamp': new Date().toISOString(),
+        ...getCommonFields('fleet_server.agent_status'),
+        fleet: {
+          agents: {
+            total: agents.total_all_statuses,
+            enrolled: agents.total_enrolled,
+            unenrolled: agents.unenrolled,
+            healthy: agents.healthy,
+            offline: agents.offline,
+            updating: agents.updating,
+            unhealthy: agents.unhealthy,
+            inactive: agents.inactive,
+            upgrading_step: agentMetrics.upgrading_step,
+          },
+        },
+      };
+      appContextService
+        .getLogger()
+        .trace('Agent status metrics: ' + JSON.stringify(agentStatusDoc));
+      await this.esClient.index({
+        index: 'metrics-fleet_server.agent_status-default',
+        body: agentStatusDoc,
+        refresh: true,
+      });
+
+      if (agentsPerVersion.length === 0) return;
+
+      const operations = [];
+
+      for (const byVersion of agentsPerVersion) {
+        const agentVersionsDoc = {
+          '@timestamp': new Date().toISOString(),
+          ...getCommonFields('fleet_server.agent_versions'),
+          fleet: {
+            agent: {
+              version: byVersion.version,
+              count: byVersion.count,
+            },
+          },
+        };
+        operations.push(
+          {
+            create: {},
+          },
+          agentVersionsDoc
+        );
+      }
+
+      appContextService.getLogger().trace('Agent versions metrics: ' + JSON.stringify(operations));
+      const resp = await this.esClient.bulk({
+        operations,
+        refresh: true,
+        index: 'metrics-fleet_server.agent_versions-default',
+      });
+      if (resp.errors) {
+        const errors = uniq(
+          resp.items
+            .filter((item) => !!item.create?.error)
+            .map((item) => item.create?.error?.reason ?? '')
+        );
+        throw new Error(errors.join(', '));
+      }
+    } catch (error) {
+      appContextService.getLogger().warn('Error occurred while publishing Fleet metrics: ' + error);
+    }
+  };
+
+  private get taskId() {
+    return `${TYPE}:${VERSION}`;
+  }
+
+  public async start(taskManager: TaskManagerStartContract, esClient: ElasticsearchClient) {
+    this.taskManager = taskManager;
+    this.esClient = esClient;
+
+    if (!taskManager) {
+      appContextService.getLogger().error('missing required service during start');
+      return;
+    }
+
+    this.wasStarted = true;
+
+    try {
+      appContextService.getLogger().info(`Task ${this.taskId} scheduled with interval 1h`);
+
+      await this.taskManager.ensureScheduled({
+        id: this.taskId,
+        taskType: TYPE,
+        schedule: {
+          interval: INTERVAL,
+        },
+        scope: SCOPE,
+        state: {},
+        params: {},
+      });
+    } catch (e) {
+      appContextService.getLogger().error(`Error scheduling task, received error: ${e}`);
+    }
+  }
+}
diff --git a/x-pack/plugins/fleet/server/types/so_attributes.ts b/x-pack/plugins/fleet/server/types/so_attributes.ts
index 8a53ed18ff433..f6e7506d81ecf 100644
--- a/x-pack/plugins/fleet/server/types/so_attributes.ts
+++ b/x-pack/plugins/fleet/server/types/so_attributes.ts
@@ -15,6 +15,7 @@ import type {
   ShipperOutput,
   KafkaAcknowledgeReliabilityLevel,
   KafkaConnectionTypeType,
+  AgentUpgradeDetails,
 } from '../../common/types';
 import type { AgentType, FleetServerAgentComponent } from '../../common/types/models';
 
@@ -73,6 +74,7 @@ export interface AgentSOAttributes {
   unenrollment_started_at?: string;
   upgraded_at?: string | null;
   upgrade_started_at?: string | null;
+  upgrade_details?: AgentUpgradeDetails;
   access_api_key_id?: string;
   default_api_key?: string;
   default_api_key_id?: string;
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/helpers/setup_environment.tsx b/x-pack/plugins/index_management/__jest__/client_integration/helpers/setup_environment.tsx
index 20ae08038a2a2..5fb22ecd4d6e7 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/helpers/setup_environment.tsx
+++ b/x-pack/plugins/index_management/__jest__/client_integration/helpers/setup_environment.tsx
@@ -82,7 +82,7 @@ const appDependencies = {
     enableLegacyTemplates: true,
     enableIndexActions: true,
     enableIndexStats: true,
-    enableIndexDetailsPage: false,
+    editableIndexSettings: 'all',
   },
 } as any;
 
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/index_details_page.test.tsx b/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/index_details_page.test.tsx
index ec5c3288043e1..26812d06b5d64 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/index_details_page.test.tsx
+++ b/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/index_details_page.test.tsx
@@ -17,7 +17,8 @@ import {
   IndexManagementBreadcrumb,
 } from '../../../public/application/services/breadcrumbs';
 import {
-  testIndexEditableSettings,
+  testIndexEditableSettingsAll,
+  testIndexEditableSettingsLimited,
   testIndexMappings,
   testIndexMock,
   testIndexName,
@@ -429,13 +430,30 @@ describe('<IndexDetailsPage />', () => {
         await testBed.actions.settings.clickEditModeSwitch();
       });
 
-      it('displays the editable settings (flattened and filtered)', () => {
+      it('displays all editable settings (flattened and filtered)', () => {
         const editorContent = testBed.actions.settings.getCodeEditorContent();
-        expect(editorContent).toEqual(JSON.stringify(testIndexEditableSettings, null, 2));
+        expect(editorContent).toEqual(JSON.stringify(testIndexEditableSettingsAll, null, 2));
+      });
+
+      it('displays limited editable settings (flattened and filtered)', async () => {
+        await act(async () => {
+          testBed = await setup({
+            httpSetup,
+            dependencies: {
+              config: { editableIndexSettings: 'limited' },
+            },
+          });
+        });
+
+        testBed.component.update();
+        await testBed.actions.clickIndexDetailsTab(IndexDetailsSection.Settings);
+        await testBed.actions.settings.clickEditModeSwitch();
+        const editorContent = testBed.actions.settings.getCodeEditorContent();
+        expect(editorContent).toEqual(JSON.stringify(testIndexEditableSettingsLimited, null, 2));
       });
 
       it('updates the settings', async () => {
-        const updatedSettings = { ...testIndexEditableSettings, 'index.priority': '2' };
+        const updatedSettings = { ...testIndexEditableSettingsAll, 'index.priority': '2' };
         await testBed.actions.settings.updateCodeEditorContent(JSON.stringify(updatedSettings));
         await testBed.actions.settings.saveSettings();
         expect(httpSetup.put).toHaveBeenLastCalledWith(
@@ -452,7 +470,7 @@ describe('<IndexDetailsPage />', () => {
       it('reloads the settings after an update', async () => {
         const numberOfRequests = 2;
         expect(httpSetup.get).toHaveBeenCalledTimes(numberOfRequests);
-        const updatedSettings = { ...testIndexEditableSettings, 'index.priority': '2' };
+        const updatedSettings = { ...testIndexEditableSettingsAll, 'index.priority': '2' };
         await testBed.actions.settings.updateCodeEditorContent(JSON.stringify(updatedSettings));
         await testBed.actions.settings.saveSettings();
         expect(httpSetup.get).toHaveBeenCalledTimes(numberOfRequests + 1);
@@ -463,11 +481,11 @@ describe('<IndexDetailsPage />', () => {
       });
 
       it('resets the changes in the editor', async () => {
-        const updatedSettings = { ...testIndexEditableSettings, 'index.priority': '2' };
+        const updatedSettings = { ...testIndexEditableSettingsAll, 'index.priority': '2' };
         await testBed.actions.settings.updateCodeEditorContent(JSON.stringify(updatedSettings));
         await testBed.actions.settings.resetChanges();
         const editorContent = testBed.actions.settings.getCodeEditorContent();
-        expect(editorContent).toEqual(JSON.stringify(testIndexEditableSettings, null, 2));
+        expect(editorContent).toEqual(JSON.stringify(testIndexEditableSettingsAll, null, 2));
       });
     });
   });
@@ -664,7 +682,7 @@ describe('<IndexDetailsPage />', () => {
     it('updates settings with the encoded index name', async () => {
       await testBed.actions.clickIndexDetailsTab(IndexDetailsSection.Settings);
       await testBed.actions.settings.clickEditModeSwitch();
-      const updatedSettings = { ...testIndexEditableSettings, 'index.priority': '2' };
+      const updatedSettings = { ...testIndexEditableSettingsAll, 'index.priority': '2' };
       await testBed.actions.settings.updateCodeEditorContent(JSON.stringify(updatedSettings));
       await testBed.actions.settings.saveSettings();
       expect(httpSetup.put).toHaveBeenLastCalledWith(
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/mocks.ts b/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/mocks.ts
index 67ff8d57a1eb8..8adab61ec9a56 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/mocks.ts
+++ b/x-pack/plugins/index_management/__jest__/client_integration/index_details_page/mocks.ts
@@ -67,11 +67,14 @@ export const testIndexSettings = {
     },
   },
 };
-export const testIndexEditableSettings = {
+export const testIndexEditableSettingsAll = {
   'index.priority': '1',
   'index.query.default_field': ['*'],
   'index.routing.allocation.include._tier_preference': 'data_content',
 };
+export const testIndexEditableSettingsLimited = {
+  'index.query.default_field': ['*'],
+};
 
 // Mocking partial index stats response
 export const testIndexStats = {
diff --git a/x-pack/plugins/index_management/public/application/app_context.tsx b/x-pack/plugins/index_management/public/application/app_context.tsx
index 8ae5d95a8bca9..0f2a03f76011a 100644
--- a/x-pack/plugins/index_management/public/application/app_context.tsx
+++ b/x-pack/plugins/index_management/public/application/app_context.tsx
@@ -53,6 +53,7 @@ export interface AppDependencies {
     enableIndexActions: boolean;
     enableLegacyTemplates: boolean;
     enableIndexStats: boolean;
+    editableIndexSettings: 'all' | 'limited';
   };
   history: ScopedHistory;
   setBreadcrumbs: ManagementAppMountParams['setBreadcrumbs'];
diff --git a/x-pack/plugins/index_management/public/application/constants/index.ts b/x-pack/plugins/index_management/public/application/constants/index.ts
index 7a1caf5e50771..939a5867a47df 100644
--- a/x-pack/plugins/index_management/public/application/constants/index.ts
+++ b/x-pack/plugins/index_management/public/application/constants/index.ts
@@ -7,14 +7,6 @@
 
 export { REFRESH_RATE_INDEX_LIST } from './refresh_intervals';
 
-export {
-  TAB_SUMMARY,
-  TAB_SETTINGS,
-  TAB_MAPPING,
-  TAB_STATS,
-  TAB_EDIT_SETTINGS,
-} from './detail_panel_tabs';
-
 export const REACT_ROOT_ID = 'indexManagementReactRoot';
 
 export * from './ilm_locator';
diff --git a/x-pack/plugins/index_management/public/application/lib/ace.js b/x-pack/plugins/index_management/public/application/lib/ace.js
deleted file mode 100644
index 3b6c6637215a3..0000000000000
--- a/x-pack/plugins/index_management/public/application/lib/ace.js
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import brace from 'brace';
-import 'brace/ext/language_tools';
-
-const splitTokens = (line) => {
-  return line.split(/\s+/);
-};
-const wordCompleter = (words) => {
-  return {
-    identifierRegexps: [
-      /[a-zA-Z_0-9\.\$\-\u00A2-\uFFFF]/, // adds support for dot character
-    ],
-    getCompletions: (editor, session, pos, prefix, callback) => {
-      const document = session.getDocument();
-      const currentLine = document.getLine(pos.row);
-      const previousLine = document.getLine(pos.row - 1);
-      const currentTokens = splitTokens(currentLine.slice(0, pos.column));
-      const fullLineTokens = splitTokens(currentLine);
-      const isInArray = previousLine && splitTokens(previousLine).slice(-1)[0] === '[';
-      const [, secondToken = null] = currentTokens;
-      const [, secondFullToken = null] = fullLineTokens;
-      if (isInArray || currentTokens.length > 2) {
-        return callback(null, []);
-      }
-      const startQuote = secondToken === '"' ? '' : '"';
-      const endQuote = secondFullToken === '""' ? '' : '"';
-      callback(
-        null,
-        words.map((word) => {
-          return {
-            caption: ` ${word}`,
-            value: `${startQuote}${word}${endQuote}`,
-          };
-        })
-      );
-    },
-  };
-};
-
-export const createAceEditor = (div, value, readOnly = true, autocompleteArray) => {
-  const editor = brace.edit(div);
-  editor.$blockScrolling = Infinity;
-  editor.setValue(value, -1);
-  const session = editor.getSession();
-  session.setUseWrapMode(true);
-  session.setMode('ace/mode/json');
-  if (autocompleteArray) {
-    const languageTools = brace.acequire('ace/ext/language_tools');
-    const autocompleter = wordCompleter(autocompleteArray);
-    languageTools.setCompleters([autocompleter]);
-  }
-  const options = {
-    readOnly,
-    highlightActiveLine: false,
-    highlightGutterLine: false,
-    minLines: 20,
-    maxLines: 30,
-  };
-  //done this way to avoid warnings about unrecognized options
-  const autocompleteOptions = readOnly
-    ? {}
-    : {
-        enableBasicAutocompletion: true,
-        enableLiveAutocompletion: true,
-      };
-  editor.setOptions({ ...options, ...autocompleteOptions });
-  editor.setBehavioursEnabled(!readOnly);
-  return editor;
-};
diff --git a/x-pack/plugins/index_management/public/application/lib/edit_settings.ts b/x-pack/plugins/index_management/public/application/lib/edit_settings.ts
index 936555b8c47ec..16a67633224a9 100644
--- a/x-pack/plugins/index_management/public/application/lib/edit_settings.ts
+++ b/x-pack/plugins/index_management/public/application/lib/edit_settings.ts
@@ -22,7 +22,25 @@ export const readOnlySettings = [
   'index.routing_partition_size',
   'index.store.type',
 ];
-export const settingsToDisplay = [
+
+export const limitedEditableSettings = [
+  'index.blocks.write',
+  'index.blocks.read',
+  'index.blocks.read_only',
+  'index.default_pipeline',
+  'index.lifecycle.origination_date',
+  'index.final_pipeline',
+  'index.query.default_field',
+  'index.refresh_interval',
+  'index.mapping.ignore_malformed',
+  'index.mapping.total_fields.limit',
+  'index.merge.policy.deletes_pct_allowed',
+  'index.merge.policy.max_merge_at_once',
+  'index.merge.policy.expunge_deletes_allowed',
+  'index.merge.policy.floor_segment',
+];
+
+export const defaultsToDisplay = [
   'index.number_of_replicas',
   'index.blocks.read_only_allow_delete',
   'index.codec',
diff --git a/x-pack/plugins/index_management/public/application/mount_management_section.ts b/x-pack/plugins/index_management/public/application/mount_management_section.ts
index d51c8527a6ef5..bd7d778ae103d 100644
--- a/x-pack/plugins/index_management/public/application/mount_management_section.ts
+++ b/x-pack/plugins/index_management/public/application/mount_management_section.ts
@@ -54,9 +54,7 @@ export async function mountManagementSection({
   extensionsService,
   isFleetEnabled,
   kibanaVersion,
-  enableIndexActions = true,
-  enableLegacyTemplates = true,
-  enableIndexStats = true,
+  config,
   cloud,
 }: {
   coreSetup: CoreSetup<StartDependencies>;
@@ -65,9 +63,7 @@ export async function mountManagementSection({
   extensionsService: ExtensionsService;
   isFleetEnabled: boolean;
   kibanaVersion: SemVer;
-  enableIndexActions?: boolean;
-  enableLegacyTemplates?: boolean;
-  enableIndexStats?: boolean;
+  config: AppDependencies['config'];
   cloud?: CloudSetup;
 }) {
   const { element, setBreadcrumbs, history, theme$ } = params;
@@ -114,11 +110,7 @@ export async function mountManagementSection({
       uiMetricService,
       extensionsService,
     },
-    config: {
-      enableIndexActions,
-      enableLegacyTemplates,
-      enableIndexStats,
-    },
+    config,
     history,
     setBreadcrumbs,
     uiSettings,
diff --git a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_settings_content.tsx b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_settings_content.tsx
index 37b10dc851a5a..035e647d19b11 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_settings_content.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/index_list/details_page/details_page_settings_content.tsx
@@ -30,22 +30,39 @@ import { Error } from '../../../../../shared_imports';
 import { documentationService, updateIndexSettings } from '../../../../services';
 import { notificationService } from '../../../../services/notification';
 import { flattenObject } from '../../../../lib/flatten_object';
-import { readOnlySettings, settingsToDisplay } from '../../../../lib/edit_settings';
+import {
+  readOnlySettings,
+  defaultsToDisplay,
+  limitedEditableSettings,
+} from '../../../../lib/edit_settings';
+import { AppDependencies, useAppContext } from '../../../../app_context';
 
-const getEditableSettings = (
-  data: Props['data'],
-  isIndexOpen: boolean
-): { originalSettings: Record<string, any>; settingsString: string } => {
+const getEditableSettings = ({
+  data,
+  isIndexOpen,
+  editableIndexSettings,
+}: {
+  data: Props['data'];
+  isIndexOpen: boolean;
+  editableIndexSettings: AppDependencies['config']['editableIndexSettings'];
+}): { originalSettings: Record<string, any>; settingsString: string } => {
   const { defaults, settings } = data;
   // settings user has actually set
   const flattenedSettings = flattenObject(settings);
   // settings with their defaults
   const flattenedDefaults = flattenObject(defaults);
-  const filteredDefaults = _.pick(flattenedDefaults, settingsToDisplay);
-  const newSettings = { ...filteredDefaults, ...flattenedSettings };
-  // store these to be used as autocomplete values later
-  readOnlySettings.forEach((e) => delete newSettings[e]);
-  // can't change codec on open index
+  const filteredDefaults = _.pick(flattenedDefaults, defaultsToDisplay);
+
+  let newSettings = { ...filteredDefaults, ...flattenedSettings };
+  if (editableIndexSettings === 'limited') {
+    // only pick limited settings
+    newSettings = _.pick(newSettings, limitedEditableSettings);
+  } else {
+    // remove read only settings
+    readOnlySettings.forEach((e) => delete newSettings[e]);
+  }
+
+  // can't change codec on an open index
   if (isIndexOpen) {
     delete newSettings['index.codec'];
   }
@@ -67,12 +84,19 @@ export const DetailsPageSettingsContent: FunctionComponent<Props> = ({
   reloadIndexSettings,
 }) => {
   const [isEditMode, setIsEditMode] = useState(false);
+  const {
+    config: { editableIndexSettings },
+  } = useAppContext();
   const onEditModeChange = (event: EuiSwitchEvent) => {
     setUpdateError(null);
     setIsEditMode(event.target.checked);
   };
 
-  const { originalSettings, settingsString } = getEditableSettings(data, isIndexOpen);
+  const { originalSettings, settingsString } = getEditableSettings({
+    data,
+    isIndexOpen,
+    editableIndexSettings,
+  });
   const [editableSettings, setEditableSettings] = useState(settingsString);
   const [isLoading, setIsLoading] = useState(false);
   const [updateError, setUpdateError] = useState<Error | null>(null);
diff --git a/x-pack/plugins/index_management/public/application/services/api.ts b/x-pack/plugins/index_management/public/application/services/api.ts
index 54391aaaedf43..30c8339840018 100644
--- a/x-pack/plugins/index_management/public/application/services/api.ts
+++ b/x-pack/plugins/index_management/public/application/services/api.ts
@@ -41,7 +41,6 @@ import {
   Index,
   IndexSettingsResponse,
 } from '../../../common';
-import { TAB_SETTINGS, TAB_MAPPING, TAB_STATS } from '../constants';
 import { useRequest, sendRequest } from './use_request';
 import { httpService } from './http';
 import { UiMetricService } from './ui_metric';
@@ -245,19 +244,6 @@ export async function loadIndexMapping(indexName: string) {
   return response;
 }
 
-export async function loadIndexData(type: string, indexName: string) {
-  switch (type) {
-    case TAB_MAPPING:
-      return loadIndexMapping(indexName);
-
-    case TAB_SETTINGS:
-      return loadIndexSettings(indexName);
-
-    case TAB_STATS:
-      return loadIndexStats(indexName);
-  }
-}
-
 export function useLoadIndexTemplates() {
   return useRequest<{ templates: TemplateListItem[]; legacyTemplates: TemplateListItem[] }>({
     path: `${API_BASE_PATH}/index_templates`,
diff --git a/x-pack/plugins/index_management/public/application/services/index.ts b/x-pack/plugins/index_management/public/application/services/index.ts
index 058a09d3f15d1..2a88ce37d9a99 100644
--- a/x-pack/plugins/index_management/public/application/services/index.ts
+++ b/x-pack/plugins/index_management/public/application/services/index.ts
@@ -20,7 +20,6 @@ export {
   updateIndexSettings,
   loadIndexStats,
   loadIndexMapping,
-  loadIndexData,
   useLoadIndexTemplates,
   simulateIndexTemplate,
   useLoadNodesPlugins,
diff --git a/x-pack/plugins/index_management/public/plugin.ts b/x-pack/plugins/index_management/public/plugin.ts
index bfa2eab8a753c..8d043ab0af6bc 100644
--- a/x-pack/plugins/index_management/public/plugin.ts
+++ b/x-pack/plugins/index_management/public/plugin.ts
@@ -41,11 +41,18 @@ export class IndexMgmtUIPlugin {
       enableIndexActions,
       enableLegacyTemplates,
       enableIndexStats,
+      editableIndexSettings,
     } = this.ctx.config.get<ClientConfigType>();
 
     if (isIndexManagementUiEnabled) {
       const { fleet, usageCollection, management, cloud } = plugins;
       const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
+      const config = {
+        enableIndexActions: enableIndexActions ?? true,
+        enableLegacyTemplates: enableLegacyTemplates ?? true,
+        enableIndexStats: enableIndexStats ?? true,
+        editableIndexSettings: editableIndexSettings ?? 'all',
+      };
       management.sections.section.data.registerApp({
         id: PLUGIN.id,
         title: i18n.translate('xpack.idxMgmt.appTitle', { defaultMessage: 'Index Management' }),
@@ -59,9 +66,7 @@ export class IndexMgmtUIPlugin {
             extensionsService: this.extensionsService,
             isFleetEnabled: Boolean(fleet),
             kibanaVersion,
-            enableIndexActions,
-            enableLegacyTemplates,
-            enableIndexStats,
+            config,
             cloud,
           });
         },
diff --git a/x-pack/plugins/index_management/public/types.ts b/x-pack/plugins/index_management/public/types.ts
index 36e4f383e265d..3a1958c5e7e93 100644
--- a/x-pack/plugins/index_management/public/types.ts
+++ b/x-pack/plugins/index_management/public/types.ts
@@ -35,4 +35,5 @@ export interface ClientConfigType {
   enableIndexActions?: boolean;
   enableLegacyTemplates?: boolean;
   enableIndexStats?: boolean;
+  editableIndexSettings?: 'all' | 'limited';
 }
diff --git a/x-pack/plugins/index_management/server/config.ts b/x-pack/plugins/index_management/server/config.ts
index a2b3c3259a2ed..e629669ed5311 100644
--- a/x-pack/plugins/index_management/server/config.ts
+++ b/x-pack/plugins/index_management/server/config.ts
@@ -41,6 +41,12 @@ const schemaLatest = schema.object(
       // We take this approach in order to have a central place (serverless.yml) for serverless config across Kibana
       serverless: schema.boolean({ defaultValue: true }),
     }),
+    editableIndexSettings: offeringBasedSchema({
+      // on serverless only a limited set of index settings can be edited
+      serverless: schema.oneOf([schema.literal('all'), schema.literal('limited')], {
+        defaultValue: 'all',
+      }),
+    }),
   },
   { defaultValue: undefined }
 );
@@ -51,6 +57,7 @@ const configLatest: PluginConfigDescriptor<IndexManagementConfig> = {
     enableIndexActions: true,
     enableLegacyTemplates: true,
     enableIndexStats: true,
+    editableIndexSettings: true,
   },
   schema: schemaLatest,
   deprecations: ({ unused }) => [unused('dev.enableIndexDetailsPage', { level: 'warning' })],
diff --git a/x-pack/plugins/infra/server/lib/alerting/common/utils.ts b/x-pack/plugins/infra/server/lib/alerting/common/utils.ts
index dc518e1e08cf7..40b1ae35f3d5e 100644
--- a/x-pack/plugins/infra/server/lib/alerting/common/utils.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/common/utils.ts
@@ -18,6 +18,7 @@ import {
 } from '@kbn/rule-registry-plugin/common/parse_technical_fields';
 import { ES_FIELD_TYPES } from '@kbn/field-types';
 import { set } from '@kbn/safer-lodash-set';
+import { Alert } from '@kbn/alerts-as-data-utils';
 import { ParsedExperimentalFields } from '@kbn/rule-registry-plugin/common/parse_experimental_fields';
 import { LINK_TO_METRICS_EXPLORER } from '../../../../common/alerting/metrics';
 import { getInventoryViewInAppUrl } from '../../../../common/alerting/metrics/alert_link';
@@ -223,8 +224,10 @@ export const flattenAdditionalContext = (
   return additionalContext ? flattenObject(additionalContext) : {};
 };
 
-export const getContextForRecoveredAlerts = (
-  alertHitSource: Partial<ParsedTechnicalFields & ParsedExperimentalFields> | undefined | null
+export const getContextForRecoveredAlerts = <
+  T extends Alert | (ParsedTechnicalFields & ParsedExperimentalFields)
+>(
+  alertHitSource: Partial<T> | undefined | null
 ): AdditionalContext => {
   const alert = alertHitSource ? unflattenObject(alertHitSource) : undefined;
 
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index f7052b3e1916f..b5b0c1973307b 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -5,27 +5,14 @@
  * 2.0.
  */
 
-import {
-  AlertInstanceContext as AlertContext,
-  AlertInstanceState as AlertState,
-} from '@kbn/alerting-plugin/server';
-// import { RecoveredActionGroup } from '../../../../../alerting/common';
-import {
-  AlertInstanceMock,
-  RuleExecutorServicesMock,
-  alertsMock,
-} from '@kbn/alerting-plugin/server/mocks';
-import { LifecycleAlertServices } from '@kbn/rule-registry-plugin/server';
-import { ruleRegistryMocks } from '@kbn/rule-registry-plugin/server/mocks';
-import { createLifecycleRuleExecutorMock } from '@kbn/rule-registry-plugin/server/utils/create_lifecycle_rule_executor_mock';
-import { MetricsDataClient } from '@kbn/metrics-data-access-plugin/server';
+import { alertsMock } from '@kbn/alerting-plugin/server/mocks';
+import { set } from '@kbn/safer-lodash-set';
 import {
   Aggregators,
   Comparator,
   CountMetricExpressionParams,
   NonCountMetricExpressionParams,
 } from '../../../../common/alerting/metrics';
-import { InfraSources } from '../../sources';
 import {
   createMetricThresholdExecutor,
   FIRED_ACTIONS,
@@ -36,28 +23,10 @@ import { Evaluation } from './lib/evaluate_rule';
 import type { LogMeta, Logger } from '@kbn/logging';
 import { DEFAULT_FLAPPING_SETTINGS } from '@kbn/alerting-plugin/common';
 import { InfraConfig } from '../../../../common/plugin_config_types';
+import { ALERT_EVALUATION_VALUES, ALERT_REASON } from '@kbn/rule-data-utils';
 
 jest.mock('./lib/evaluate_rule', () => ({ evaluateRule: jest.fn() }));
 
-interface AlertTestInstance {
-  instance: AlertInstanceMock;
-  actionQueue: any[];
-  state: any;
-}
-
-let persistAlertInstances = false; // eslint-disable-line prefer-const
-
-type TestRuleState = Record<string, unknown> & {
-  aRuleStateKey: string;
-  groups: string[];
-  groupBy?: string | string[];
-};
-
-const initialRuleState: TestRuleState = {
-  aRuleStateKey: 'INITIAL_RULE_STATE_VALUE',
-  groups: [],
-};
-
 const fakeLogger = <Meta extends LogMeta = LogMeta>(msg: string, meta?: Meta) => {};
 
 const logger = {
@@ -71,34 +40,13 @@ const logger = {
   get: () => logger,
 } as unknown as Logger;
 
-const STARTED_AT_MOCK_DATE = new Date();
+const mockNow = new Date('2023-09-20T15:11:04.105Z');
 
 const mockOptions = {
   executionId: '',
-  startedAt: STARTED_AT_MOCK_DATE,
+  startedAt: mockNow,
   previousStartedAt: null,
-  state: {
-    wrapped: initialRuleState,
-    trackedAlerts: {
-      TEST_ALERT_0: {
-        alertId: 'TEST_ALERT_0',
-        alertUuid: 'TEST_ALERT_0_UUID',
-        started: '2020-01-01T12:00:00.000Z',
-        flappingHistory: [],
-        flapping: false,
-        pendingRecoveredCount: 0,
-      },
-      TEST_ALERT_1: {
-        alertId: 'TEST_ALERT_1',
-        alertUuid: 'TEST_ALERT_1_UUID',
-        started: '2020-01-02T12:00:00.000Z',
-        flappingHistory: [],
-        flapping: false,
-        pendingRecoveredCount: 0,
-      },
-    },
-    trackedAlertsRecovered: {},
-  },
+  state: {},
   spaceId: '',
   rule: {
     id: '',
@@ -131,10 +79,22 @@ const setEvaluationResults = (response: Array<Record<string, Evaluation>>) => {
   jest.requireMock('./lib/evaluate_rule').evaluateRule.mockImplementation(() => response);
 };
 
-describe('The metric threshold alert type', () => {
+describe('The metric threshold rule type', () => {
+  beforeAll(() => {
+    jest.useFakeTimers();
+    jest.setSystemTime();
+  });
+  beforeEach(() => {
+    jest.resetAllMocks();
+
+    services.alertsClient.report.mockImplementation(({ id }: { id: string }) => ({
+      uuid: `uuid-${id}`,
+      start: new Date().toISOString(),
+    }));
+  });
+  afterAll(() => jest.useRealTimers());
+
   describe('querying the entire infrastructure', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
     const execute = (comparator: Comparator, threshold: number[], sourceId: string = 'default') =>
       executor({
         ...mockOptions,
@@ -173,74 +133,141 @@ describe('The metric threshold alert type', () => {
           },
         },
       ]);
-    test('alerts as expected with the > comparator', async () => {
+
+    test('should report alert with the > comparator when condition is met', async () => {
       setResults(Comparator.GT, [0.75], true);
       await execute(Comparator.GT, [0.75]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: '*',
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0.75'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min. Alert when > 0.75.',
+        tags: [],
+      });
+    });
+
+    test('should not report any alerts with the > comparator when condition is not met', async () => {
       setResults(Comparator.GT, [1.5], false);
       await execute(Comparator.GT, [1.5]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      testNAlertsReported(0);
     });
-    test('alerts as expected with the < comparator', async () => {
+
+    test('should report alert with the < comparator when condition is met', async () => {
       setResults(Comparator.LT, [1.5], true);
       await execute(Comparator.LT, [1.5]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: '*',
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['1.5'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min. Alert when < 1.5.',
+        tags: [],
+      });
+    });
+
+    test('should not report any alerts with the < comparator when condition is not met', async () => {
       setResults(Comparator.LT, [0.75], false);
       await execute(Comparator.LT, [0.75]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      testNAlertsReported(0);
     });
-    test('alerts as expected with the >= comparator', async () => {
+
+    test('should report alert with the >= comparator when condition is met', async () => {
       setResults(Comparator.GT_OR_EQ, [0.75], true);
       await execute(Comparator.GT_OR_EQ, [0.75]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
-      setResults(Comparator.GT_OR_EQ, [1.0], true);
-      await execute(Comparator.GT_OR_EQ, [1.0]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: '*',
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0.75'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min. Alert when >= 0.75.',
+        tags: [],
+      });
+    });
+
+    test('should not report any alerts with the >= comparator when condition is not met', async () => {
       setResults(Comparator.GT_OR_EQ, [1.5], false);
       await execute(Comparator.GT_OR_EQ, [1.5]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      testNAlertsReported(0);
     });
-    test('alerts as expected with the <= comparator', async () => {
+
+    test('should report alert with the <= comparator when condition is met', async () => {
       setResults(Comparator.LT_OR_EQ, [1.5], true);
       await execute(Comparator.LT_OR_EQ, [1.5]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
-      setResults(Comparator.LT_OR_EQ, [1.0], true);
-      await execute(Comparator.LT_OR_EQ, [1.0]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: '*',
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['1.5'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min. Alert when <= 1.5.',
+        tags: [],
+      });
+    });
+
+    test('should not report any alerts with the <= comparator when condition is not met', async () => {
       setResults(Comparator.LT_OR_EQ, [0.75], false);
       await execute(Comparator.LT_OR_EQ, [0.75]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      testNAlertsReported(0);
     });
-    test('alerts as expected with the between comparator', async () => {
+
+    test('should report alert with the between comparator when condition is met', async () => {
       setResults(Comparator.BETWEEN, [0, 1.5], true);
       await execute(Comparator.BETWEEN, [0, 1.5]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: '*',
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0', '1.5'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min. Alert when between 0 and 1.5.',
+        tags: [],
+      });
+    });
+
+    test('should not report any alerts with the between comparator when condition is not met', async () => {
       setResults(Comparator.BETWEEN, [0, 0.75], false);
       await execute(Comparator.BETWEEN, [0, 0.75]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      testNAlertsReported(0);
     });
-    test('alerts as expected with the outside range comparator', async () => {
+
+    test('should report alert with the outside range comparator when condition is met', async () => {
       setResults(Comparator.OUTSIDE_RANGE, [0, 0.75], true);
       await execute(Comparator.OUTSIDE_RANGE, [0, 0.75]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: '*',
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0', '0.75'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min. Alert when outside 0 and 0.75.',
+        tags: [],
+      });
+    });
+
+    test('should not report any alerts with the outside range comparator when condition is not met', async () => {
       setResults(Comparator.OUTSIDE_RANGE, [0, 1.5], false);
       await execute(Comparator.OUTSIDE_RANGE, [0, 1.5]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
-    });
-    test('reports expected values to the action context', async () => {
-      setResults(Comparator.GT, [0.75], true);
-      await execute(Comparator.GT, [0.75]);
-      const { action } = mostRecentAction(instanceID);
-      expect(action.group).toBe('*');
-      expect(action.reason).toContain('is 1');
-      expect(action.reason).toContain('Alert when > 0.75');
-      expect(action.reason).toContain('test.metric.1');
-      expect(action.reason).toContain('in the last 1 min');
+      testNAlertsReported(0);
     });
   });
 
   describe('querying with a groupBy parameter', () => {
-    afterAll(() => clearInstances());
     const execute = (
       comparator: Comparator,
       threshold: number[],
@@ -262,11 +289,12 @@ describe('The metric threshold alert type', () => {
             },
           ],
         },
-        state: state ?? mockOptions.state.wrapped,
+        state: state ?? mockOptions.state,
       });
-    const instanceIdA = 'a';
-    const instanceIdB = 'b';
-    test('sends an alert when all groups pass the threshold', async () => {
+    const alertIdA = 'a';
+    const alertIdB = 'b';
+
+    test('should report alert when all groups pass the threshold', async () => {
       setEvaluationResults([
         {
           a: {
@@ -296,10 +324,32 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.GT, [0.75]);
-      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
-      expect(mostRecentAction(instanceIdB)).toBeAlertAction();
+      testNAlertsReported(2);
+      testAlertReported(1, {
+        id: alertIdA,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0.75'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min for a. Alert when > 0.75.',
+        tags: [],
+        groupByKeys: { something: alertIdA },
+      });
+      testAlertReported(2, {
+        id: alertIdB,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0.75'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min for b. Alert when > 0.75.',
+        tags: [],
+        groupByKeys: { something: alertIdB },
+      });
     });
-    test('sends an alert when only some groups pass the threshold', async () => {
+
+    test('should report alert when only some groups pass the threshold', async () => {
       setEvaluationResults([
         {
           a: {
@@ -329,10 +379,21 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.LT, [1.5]);
-      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
-      expect(mostRecentAction(instanceIdB)).toBe(undefined);
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertIdA,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['1.5'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min for a. Alert when < 1.5.',
+        tags: [],
+        groupByKeys: { something: alertIdA },
+      });
     });
-    test('sends no alert when no groups pass the threshold', async () => {
+
+    test('should not report any alerts when no groups pass the threshold', async () => {
       setEvaluationResults([
         {
           a: {
@@ -362,43 +423,10 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.GT, [5]);
-      expect(mostRecentAction(instanceIdA)).toBe(undefined);
-      expect(mostRecentAction(instanceIdB)).toBe(undefined);
-    });
-    test('reports group values to the action context', async () => {
-      setEvaluationResults([
-        {
-          a: {
-            ...baseNonCountCriterion,
-            comparator: Comparator.GT,
-            threshold: [0.75],
-            metric: 'test.metric.1',
-            currentValue: 1.0,
-            timestamp: new Date().toISOString(),
-            shouldFire: true,
-            shouldWarn: false,
-            isNoData: false,
-            bucketKey: { groupBy0: 'a' },
-          },
-          b: {
-            ...baseNonCountCriterion,
-            comparator: Comparator.GT,
-            threshold: [0.75],
-            metric: 'test.metric.1',
-            currentValue: 3,
-            timestamp: new Date().toISOString(),
-            shouldFire: true,
-            shouldWarn: false,
-            isNoData: false,
-            bucketKey: { groupBy0: 'b' },
-          },
-        },
-      ]);
-      await execute(Comparator.GT, [0.75]);
-      expect(mostRecentAction(instanceIdA).action.group).toBe('a');
-      expect(mostRecentAction(instanceIdB).action.group).toBe('b');
+      testNAlertsReported(0);
     });
-    test('persists previous groups that go missing, until the groupBy param changes', async () => {
+
+    test('should persist previous groups that go missing, until the groupBy param changes', async () => {
       setEvaluationResults([
         {
           a: {
@@ -556,9 +584,10 @@ describe('The metric threshold alert type', () => {
           ],
           filterQuery,
         },
-        state: state ?? mockOptions.state.wrapped,
+        state: state ?? mockOptions.state,
       });
-    test('persists previous groups that go missing, until the filterQuery param changes', async () => {
+
+    test('should persist previous groups that go missing, until the filterQuery param changes', async () => {
       setEvaluationResults([
         {
           a: {
@@ -691,12 +720,11 @@ describe('The metric threshold alert type', () => {
         'test.metric.1',
         stateResult2
       );
-      expect(stateResult3.groups).toEqual(expect.arrayContaining([]));
+      expect(stateResult3.missingGroups).toEqual(expect.arrayContaining([]));
     });
   });
 
   describe('querying with a groupBy parameter host.name and rule tags', () => {
-    afterAll(() => clearInstances());
     const execute = (
       comparator: Comparator,
       threshold: number[],
@@ -718,14 +746,14 @@ describe('The metric threshold alert type', () => {
             },
           ],
         },
-        state: state ?? mockOptions.state.wrapped,
+        state: state ?? mockOptions.state,
         rule: {
           ...mockOptions.rule,
           tags: ['ruleTag1', 'ruleTag2'],
         },
       });
-    const instanceIdA = 'host-01';
-    const instanceIdB = 'host-02';
+    const alertIdA = 'host-01';
+    const alertIdB = 'host-02';
 
     test('rule tags and source tags are combined in alert context', async () => {
       setEvaluationResults([
@@ -763,23 +791,33 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.GT, [0.75]);
-      expect(mostRecentAction(instanceIdA).action.tags).toStrictEqual([
-        'host-01_tag1',
-        'host-01_tag2',
-        'ruleTag1',
-        'ruleTag2',
-      ]);
-      expect(mostRecentAction(instanceIdB).action.tags).toStrictEqual([
-        'host-02_tag1',
-        'host-02_tag2',
-        'ruleTag1',
-        'ruleTag2',
-      ]);
+      testNAlertsReported(2);
+      testAlertReported(1, {
+        id: alertIdA,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0.75'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min for host-01. Alert when > 0.75.',
+        tags: ['host-01_tag1', 'host-01_tag2', 'ruleTag1', 'ruleTag2'],
+        groupByKeys: { host: { name: alertIdA } },
+      });
+      testAlertReported(2, {
+        id: alertIdB,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0.75'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 3 in the last 1 min for host-02. Alert when > 0.75.',
+        tags: ['host-02_tag1', 'host-02_tag2', 'ruleTag1', 'ruleTag2'],
+        groupByKeys: { host: { name: alertIdB } },
+      });
     });
   });
 
   describe('querying without a groupBy parameter and rule tags', () => {
-    afterAll(() => clearInstances());
     const execute = (
       comparator: Comparator,
       threshold: number[],
@@ -801,7 +839,7 @@ describe('The metric threshold alert type', () => {
             },
           ],
         },
-        state: state ?? mockOptions.state.wrapped,
+        state: state ?? mockOptions.state,
         rule: {
           ...mockOptions.rule,
           tags: ['ruleTag1', 'ruleTag2'],
@@ -826,14 +864,23 @@ describe('The metric threshold alert type', () => {
         },
       ]);
 
-      const instanceID = '*';
+      const alertID = '*';
       await execute(Comparator.GT, [0.75]);
-      expect(mostRecentAction(instanceID).action.tags).toStrictEqual(['ruleTag1', 'ruleTag2']);
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0.75'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min. Alert when > 0.75.',
+        tags: ['ruleTag1', 'ruleTag2'],
+      });
     });
   });
 
   describe('querying with multiple criteria', () => {
-    afterAll(() => clearInstances());
     const execute = (
       comparator: Comparator,
       thresholdA: number[],
@@ -862,7 +909,8 @@ describe('The metric threshold alert type', () => {
           ],
         },
       });
-    test('sends an alert when all criteria cross the threshold', async () => {
+
+    test('should report alert when all criteria cross the threshold', async () => {
       setEvaluationResults([
         {
           '*': {
@@ -893,11 +941,24 @@ describe('The metric threshold alert type', () => {
           },
         },
       ]);
-      const instanceID = '*';
+      const alertID = '*';
       await execute(Comparator.GT_OR_EQ, [1.0], [3.0]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['1'], value: '1', evaluation_value: 1 },
+          { metric: 'test.metric.2', threshold: ['3'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason:
+          'test.metric.1 is 1 in the last 1 min. Alert when >= 1.\ntest.metric.2 is 3 in the last 1 min. Alert when >= 3.',
+        tags: [],
+      });
     });
-    test('sends no alert when some, but not all, criteria cross the threshold', async () => {
+
+    test('should not report any alerts when some, but not all, criteria cross the threshold', async () => {
       setEvaluationResults([
         {
           '*': {
@@ -915,10 +976,10 @@ describe('The metric threshold alert type', () => {
         },
         {},
       ]);
-      const instanceID = '*';
       await execute(Comparator.LT_OR_EQ, [1.0], [2.5]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      testNAlertsReported(0);
     });
+
     test('alerts only on groups that meet all criteria when querying with a groupBy parameter', async () => {
       setEvaluationResults([
         {
@@ -974,61 +1035,27 @@ describe('The metric threshold alert type', () => {
           },
         },
       ]);
-      const instanceIdA = 'a';
-      const instanceIdB = 'b';
+      const alertIdA = 'a';
       await execute(Comparator.GT_OR_EQ, [1.0], [3.0], 'something');
-      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
-      expect(mostRecentAction(instanceIdB)).toBe(undefined);
-    });
-    test('sends all criteria to the action context', async () => {
-      setEvaluationResults([
-        {
-          '*': {
-            ...baseNonCountCriterion,
-            comparator: Comparator.GT_OR_EQ,
-            threshold: [1.0],
-            metric: 'test.metric.1',
-            currentValue: 1.0,
-            timestamp: new Date().toISOString(),
-            shouldFire: true,
-            shouldWarn: false,
-            isNoData: false,
-            bucketKey: { groupBy0: '*' },
-          },
-        },
-        {
-          '*': {
-            ...baseNonCountCriterion,
-            comparator: Comparator.GT_OR_EQ,
-            threshold: [3.0],
-            metric: 'test.metric.2',
-            currentValue: 3.0,
-            timestamp: new Date().toISOString(),
-            shouldFire: true,
-            shouldWarn: false,
-            isNoData: false,
-            bucketKey: { groupBy0: '*' },
-          },
-        },
-      ]);
-      const instanceID = '*';
-      await execute(Comparator.GT_OR_EQ, [1.0], [3.0]);
-      const { action } = mostRecentAction(instanceID);
-      const reasons = action.reason.split('\n');
-      expect(reasons.length).toBe(2);
-      expect(reasons[0]).toContain('test.metric.1');
-      expect(reasons[1]).toContain('test.metric.2');
-      expect(reasons[0]).toContain('is 1');
-      expect(reasons[1]).toContain('is 3');
-      expect(reasons[0]).toContain('Alert when >= 1');
-      expect(reasons[1]).toContain('Alert when >= 3');
-      expect(reasons[0]).toContain('in the last 1 min');
-      expect(reasons[1]).toContain('in the last 1 min');
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertIdA,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['1'], value: '1', evaluation_value: 1 },
+          { metric: 'test.metric.2', threshold: ['3'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason:
+          'test.metric.1 is 1 in the last 1 min for a. Alert when >= 1.\ntest.metric.2 is 3 in the last 1 min for a. Alert when >= 3.',
+        tags: [],
+        groupByKeys: { something: alertIdA },
+      });
     });
   });
+
   describe('querying with the count aggregator', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
+    const alertID = '*';
     const execute = (comparator: Comparator, threshold: number[], sourceId: string = 'default') =>
       executor({
         ...mockOptions,
@@ -1044,6 +1071,7 @@ describe('The metric threshold alert type', () => {
           ],
         },
       });
+
     test('alerts based on the doc_count value instead of the aggregatedValue', async () => {
       setEvaluationResults([
         {
@@ -1062,7 +1090,16 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.GT, [0.9]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [{ metric: 'count', threshold: ['0.9'], value: '1', evaluation_value: 1 }],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'count is 1 in the last 1 min. Alert when > 0.9.',
+        tags: [],
+      });
+
       setEvaluationResults([
         {
           '*': {
@@ -1080,8 +1117,10 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.LT, [0.5]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      // should still have only been called once
+      testNAlertsReported(1);
     });
+
     describe('with a groupBy parameter', () => {
       const executeGroupBy = (
         comparator: Comparator,
@@ -1103,10 +1142,10 @@ describe('The metric threshold alert type', () => {
               },
             ],
           },
-          state: state ?? mockOptions.state.wrapped,
+          state: state ?? mockOptions.state,
         });
-      const instanceIdA = 'a';
-      const instanceIdB = 'b';
+      const alertIdA = 'a';
+      const alertIdB = 'b';
 
       test('successfully detects and alerts on a document count of 0', async () => {
         setEvaluationResults([
@@ -1138,8 +1177,7 @@ describe('The metric threshold alert type', () => {
           },
         ]);
         const resultState = await executeGroupBy(Comparator.LT_OR_EQ, [0]);
-        expect(mostRecentAction(instanceIdA)).toBe(undefined);
-        expect(mostRecentAction(instanceIdB)).toBe(undefined);
+        testNAlertsReported(0);
         setEvaluationResults([
           {
             a: {
@@ -1169,14 +1207,30 @@ describe('The metric threshold alert type', () => {
           },
         ]);
         await executeGroupBy(Comparator.LT_OR_EQ, [0], 'empty-response', resultState);
-        expect(mostRecentAction(instanceIdA)).toBeAlertAction();
-        expect(mostRecentAction(instanceIdB)).toBeAlertAction();
+        testNAlertsReported(2);
+        testAlertReported(1, {
+          id: alertIdA,
+          conditions: [{ metric: 'count', threshold: ['0'], value: '0', evaluation_value: 0 }],
+          actionGroup: FIRED_ACTIONS.id,
+          alertState: 'ALERT',
+          reason: 'count is 0 in the last 1 min for a. Alert when <= 0.',
+          tags: [],
+          groupByKeys: { something: alertIdA },
+        });
+        testAlertReported(2, {
+          id: alertIdB,
+          conditions: [{ metric: 'count', threshold: ['0'], value: '0', evaluation_value: 0 }],
+          actionGroup: FIRED_ACTIONS.id,
+          alertState: 'ALERT',
+          reason: 'count is 0 in the last 1 min for b. Alert when <= 0.',
+          tags: [],
+          groupByKeys: { something: alertIdB },
+        });
       });
     });
   });
   describe('querying with the p99 aggregator', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
+    const alertID = '*';
     const execute = (comparator: Comparator, threshold: number[], sourceId: string = 'default') =>
       executor({
         ...mockOptions,
@@ -1193,6 +1247,7 @@ describe('The metric threshold alert type', () => {
           ],
         },
       });
+
     test('alerts based on the p99 values', async () => {
       setEvaluationResults([
         {
@@ -1211,7 +1266,18 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.GT, [1]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.2', threshold: ['1'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.2 is 3 in the last 1 min. Alert when > 1.',
+        tags: [],
+      });
+
       setEvaluationResults([
         {
           '*': {
@@ -1229,12 +1295,13 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.LT, [1]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      // should still only have been called once
+      testNAlertsReported(1);
     });
   });
+
   describe('querying with the p95 aggregator', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
+    const alertID = '*';
     const execute = (comparator: Comparator, threshold: number[], sourceId: string = 'default') =>
       executor({
         ...mockOptions,
@@ -1270,7 +1337,18 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.GT, [0.25]);
-      expect(mostRecentAction(instanceID)).toBeAlertAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0.25'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min. Alert when > 0.25.',
+        tags: [],
+      });
+
       setEvaluationResults([
         {
           '*': {
@@ -1288,12 +1366,13 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(Comparator.LT, [0.95]);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      // should still only have been called once
+      testNAlertsReported(1);
     });
   });
+
   describe("querying a metric that hasn't reported data", () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
+    const alertID = '*';
     const execute = (alertOnNoData: boolean, sourceId: string = 'default') =>
       executor({
         ...mockOptions,
@@ -1311,6 +1390,7 @@ describe('The metric threshold alert type', () => {
           alertOnNoData,
         },
       });
+
     test('sends a No Data alert when configured to do so', async () => {
       setEvaluationResults([
         {
@@ -1329,10 +1409,19 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(true);
-      const recentAction = mostRecentAction(instanceID);
-      expect(recentAction.action.reason).toEqual('test.metric.3 reported no data in the last 1m');
-      expect(recentAction).toBeNoDataAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.3', threshold: ['1'], value: '[NO DATA]', evaluation_value: null },
+        ],
+        actionGroup: NO_DATA_ACTIONS.id,
+        alertState: 'NO DATA',
+        reason: 'test.metric.3 reported no data in the last 1m',
+        tags: [],
+      });
     });
+
     test('does not send a No Data alert when not configured to do so', async () => {
       setEvaluationResults([
         {
@@ -1351,13 +1440,12 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute(false);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
+      testNAlertsReported(0);
     });
   });
 
-  describe('alerts with NO_DATA where one condtion is an aggregation and the other is a document count', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
+  describe('alerts with NO_DATA where one condition is an aggregation and the other is a document count', () => {
+    const alertID = '*';
     const execute = (alertOnNoData: boolean, sourceId: string = 'default') =>
       executor({
         ...mockOptions,
@@ -1380,6 +1468,7 @@ describe('The metric threshold alert type', () => {
           alertOnNoData,
         },
       });
+
     test('sends a No Data alert when configured to do so', async () => {
       setEvaluationResults([
         {
@@ -1389,7 +1478,7 @@ describe('The metric threshold alert type', () => {
             threshold: [1],
             metric: 'test.metric.3',
             currentValue: null,
-            timestamp: STARTED_AT_MOCK_DATE.toISOString(),
+            timestamp: mockNow.toISOString(),
             shouldFire: false,
             shouldWarn: false,
             isNoData: true,
@@ -1399,30 +1488,26 @@ describe('The metric threshold alert type', () => {
         {},
       ]);
       await execute(true);
-      const recentAction = mostRecentAction(instanceID);
-      expect(recentAction.action).toEqual({
-        alertDetailsUrl: '',
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.3', threshold: ['1'], value: '[NO DATA]', evaluation_value: null },
+          { metric: 'count', threshold: [30], value: 0 },
+        ],
+        actionGroup: NO_DATA_ACTIONS.id,
         alertState: 'NO DATA',
-        group: '*',
-        groupByKeys: undefined,
-        metric: { condition0: 'test.metric.3', condition1: 'count' },
         reason: 'test.metric.3 reported no data in the last 1m',
-        threshold: { condition0: ['1'], condition1: [30] },
-        timestamp: STARTED_AT_MOCK_DATE.toISOString(),
-        value: { condition0: '[NO DATA]', condition1: 0 },
-        viewInAppUrl: 'http://localhost:5601/app/metrics/explorer',
         tags: [],
       });
-      expect(recentAction).toBeNoDataAction();
     });
   });
 
   describe('querying a groupBy alert that starts reporting no data, and then later reports data', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
-    const instanceIdA = 'a';
-    const instanceIdB = 'b';
-    const instanceIdC = 'c';
+    const alertID = '*';
+    const alertIdA = 'a';
+    const alertIdB = 'b';
+    const alertIdC = 'c';
     const execute = (metric: string, alertOnGroupDisappear: boolean = true, state?: any) =>
       executor({
         ...mockOptions,
@@ -1441,7 +1526,7 @@ describe('The metric threshold alert type', () => {
           alertOnNoData: true,
           alertOnGroupDisappear,
         },
-        state: state ?? mockOptions.state.wrapped,
+        state: state ?? mockOptions.state,
       });
 
     const executeEmptyResponse = (...args: [boolean?, any?]) => execute('test.metric.3', ...args);
@@ -1471,7 +1556,19 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       let resultState = await executeEmptyResponse();
-      expect(mostRecentAction(instanceID)).toBeNoDataAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.3', threshold: ['0'], value: '[NO DATA]', evaluation_value: null },
+        ],
+        actionGroup: NO_DATA_ACTIONS.id,
+        alertState: 'NO DATA',
+        reason: 'test.metric.3 reported no data in the last 1m',
+        tags: [],
+        groupByKeys: { something: alertID },
+      });
+
       setEvaluationResults([
         {
           '*': {
@@ -1489,7 +1586,19 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       resultState = await executeEmptyResponse(true, resultState);
-      expect(mostRecentAction(instanceID)).toBeNoDataAction();
+      testNAlertsReported(2);
+      testAlertReported(2, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.3', threshold: ['0'], value: '[NO DATA]', evaluation_value: null },
+        ],
+        actionGroup: NO_DATA_ACTIONS.id,
+        alertState: 'NO DATA',
+        reason: 'test.metric.3 reported no data in the last 1m',
+        tags: [],
+        groupByKeys: { something: alertID },
+      });
+
       setEvaluationResults([
         {
           a: {
@@ -1519,11 +1628,33 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       resultState = await execute2GroupsABResponse(true, resultState);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
-      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
-      expect(mostRecentAction(instanceIdB)).toBeAlertAction();
+      testNAlertsReported(4);
+      testAlertReported(3, {
+        id: alertIdA,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min for a. Alert when > 0.',
+        tags: [],
+        groupByKeys: { something: alertIdA },
+      });
+      testAlertReported(4, {
+        id: alertIdB,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 3 in the last 1 min for b. Alert when > 0.',
+        tags: [],
+        groupByKeys: { something: alertIdB },
+      });
+
       interTestStateStorage.push(resultState); // Hand off resultState to the next test
     });
+
     test('sends No Data alerts for the previously detected groups when they stop reporting data, but not the * group', async () => {
       // Pop a previous execution result instead of defining it manually
       // The type signature of alert executor states are complex
@@ -1557,10 +1688,31 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await executeEmptyResponse(true, resultState);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
-      expect(mostRecentAction(instanceIdA)).toBeNoDataAction();
-      expect(mostRecentAction(instanceIdB)).toBeNoDataAction();
+      testNAlertsReported(2);
+      testAlertReported(1, {
+        id: alertIdA,
+        conditions: [
+          { metric: 'test.metric.3', threshold: ['0'], value: '[NO DATA]', evaluation_value: null },
+        ],
+        actionGroup: NO_DATA_ACTIONS.id,
+        alertState: 'NO DATA',
+        reason: 'test.metric.3 reported no data in the last 1m for a',
+        tags: [],
+        groupByKeys: { something: alertIdA },
+      });
+      testAlertReported(2, {
+        id: alertIdB,
+        conditions: [
+          { metric: 'test.metric.3', threshold: ['0'], value: '[NO DATA]', evaluation_value: null },
+        ],
+        actionGroup: NO_DATA_ACTIONS.id,
+        alertState: 'NO DATA',
+        reason: 'test.metric.3 reported no data in the last 1m for b',
+        tags: [],
+        groupByKeys: { something: alertIdB },
+      });
     });
+
     test('does not send individual No Data alerts when groups disappear if alertOnGroupDisappear is disabled', async () => {
       setEvaluationResults([
         {
@@ -1603,10 +1755,41 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       const resultState = await execute3GroupsABCResponse(false);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
-      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
-      expect(mostRecentAction(instanceIdB)).toBeAlertAction();
-      expect(mostRecentAction(instanceIdC)).toBeAlertAction();
+      testNAlertsReported(3);
+      testAlertReported(1, {
+        id: alertIdA,
+        conditions: [
+          { metric: 'test.metric.2', threshold: ['0'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.2 is 3 in the last 1 min for a. Alert when > 0.',
+        tags: [],
+        groupByKeys: { something: alertIdA },
+      });
+      testAlertReported(2, {
+        id: alertIdB,
+        conditions: [
+          { metric: 'test.metric.2', threshold: ['0'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.2 is 1 in the last 1 min for b. Alert when > 0.',
+        tags: [],
+        groupByKeys: { something: alertIdB },
+      });
+      testAlertReported(3, {
+        id: alertIdC,
+        conditions: [
+          { metric: 'test.metric.2', threshold: ['0'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.2 is 3 in the last 1 min for c. Alert when > 0.',
+        tags: [],
+        groupByKeys: { something: alertIdC },
+      });
+
       setEvaluationResults([
         {
           a: {
@@ -1636,10 +1819,29 @@ describe('The metric threshold alert type', () => {
         },
       ]);
       await execute2GroupsABResponse(false, resultState);
-      expect(mostRecentAction(instanceID)).toBe(undefined);
-      expect(mostRecentAction(instanceIdA)).toBeAlertAction();
-      expect(mostRecentAction(instanceIdB)).toBeAlertAction();
-      expect(mostRecentAction(instanceIdC)).toBe(undefined);
+      testNAlertsReported(5);
+      testAlertReported(4, {
+        id: alertIdA,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0'], value: '1', evaluation_value: 1 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 1 in the last 1 min for a. Alert when > 0.',
+        tags: [],
+        groupByKeys: { something: alertIdA },
+      });
+      testAlertReported(5, {
+        id: alertIdB,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ALERT',
+        reason: 'test.metric.1 is 3 in the last 1 min for b. Alert when > 0.',
+        tags: [],
+        groupByKeys: { something: alertIdB },
+      });
     });
 
     describe('if alertOnNoData is disabled but alertOnGroupDisappear is enabled', () => {
@@ -1661,7 +1863,7 @@ describe('The metric threshold alert type', () => {
             alertOnNoData: false,
             alertOnGroupDisappear: true,
           },
-          state: state ?? mockOptions.state.wrapped,
+          state: state ?? mockOptions.state,
         });
 
       const executeWeirdEmptyResponse = (...args: [any?]) =>
@@ -1687,7 +1889,7 @@ describe('The metric threshold alert type', () => {
           },
         ]);
         let resultState = await executeWeirdEmptyResponse();
-        expect(mostRecentAction(instanceID)).toBe(undefined);
+        testNAlertsReported(0);
         setEvaluationResults([
           {
             '*': {
@@ -1705,7 +1907,7 @@ describe('The metric threshold alert type', () => {
           },
         ]);
         resultState = await executeWeirdEmptyResponse(resultState);
-        expect(mostRecentAction(instanceID)).toBe(undefined);
+        testNAlertsReported(0);
         setEvaluationResults([
           {
             a: {
@@ -1735,11 +1937,33 @@ describe('The metric threshold alert type', () => {
           },
         ]);
         resultState = await executeWeird2GroupsABResponse(resultState);
-        expect(mostRecentAction(instanceID)).toBe(undefined);
-        expect(mostRecentAction(instanceIdA)).toBeAlertAction();
-        expect(mostRecentAction(instanceIdB)).toBeAlertAction();
+        testNAlertsReported(2);
+        testAlertReported(1, {
+          id: alertIdA,
+          conditions: [
+            { metric: 'test.metric.1', threshold: ['0'], value: '1', evaluation_value: 1 },
+          ],
+          actionGroup: FIRED_ACTIONS.id,
+          alertState: 'ALERT',
+          reason: 'test.metric.1 is 1 in the last 1 min for a. Alert when > 0.',
+          tags: [],
+          groupByKeys: { something: alertIdA },
+        });
+        testAlertReported(2, {
+          id: alertIdB,
+          conditions: [
+            { metric: 'test.metric.1', threshold: ['0'], value: '3', evaluation_value: 3 },
+          ],
+          actionGroup: FIRED_ACTIONS.id,
+          alertState: 'ALERT',
+          reason: 'test.metric.1 is 3 in the last 1 min for b. Alert when > 0.',
+          tags: [],
+          groupByKeys: { something: alertIdB },
+        });
+
         interTestStateStorage.push(resultState); // Hand off resultState to the next test
       });
+
       test('sends No Data alerts for the previously detected groups when they stop reporting data, but not the * group', async () => {
         const resultState = interTestStateStorage.pop(); // Import the resultState from the previous test
         setEvaluationResults([
@@ -1771,16 +1995,45 @@ describe('The metric threshold alert type', () => {
           },
         ]);
         await executeWeirdEmptyResponse(resultState);
-        expect(mostRecentAction(instanceID)).toBe(undefined);
-        expect(mostRecentAction(instanceIdA)).toBeNoDataAction();
-        expect(mostRecentAction(instanceIdB)).toBeNoDataAction();
+        testNAlertsReported(2);
+        testAlertReported(1, {
+          id: alertIdA,
+          conditions: [
+            {
+              metric: 'test.metric.3',
+              threshold: ['0'],
+              value: '[NO DATA]',
+              evaluation_value: null,
+            },
+          ],
+          actionGroup: NO_DATA_ACTIONS.id,
+          alertState: 'NO DATA',
+          reason: 'test.metric.3 reported no data in the last 1m for a',
+          tags: [],
+          groupByKeys: { something: alertIdA },
+        });
+        testAlertReported(2, {
+          id: alertIdB,
+          conditions: [
+            {
+              metric: 'test.metric.3',
+              threshold: ['0'],
+              value: '[NO DATA]',
+              evaluation_value: null,
+            },
+          ],
+          actionGroup: NO_DATA_ACTIONS.id,
+          alertState: 'NO DATA',
+          reason: 'test.metric.3 reported no data in the last 1m for b',
+          tags: [],
+          groupByKeys: { something: alertIdB },
+        });
       });
     });
   });
 
   describe('attempting to use a malformed filterQuery', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
+    const alertID = '*';
     const execute = () =>
       executor({
         ...mockOptions,
@@ -1797,15 +2050,25 @@ describe('The metric threshold alert type', () => {
             'host.name:(look.there.is.no.space.after.these.parentheses)and uh.oh: "wow that is bad"',
         },
       });
+
     test('reports an error', async () => {
       await execute();
-      expect(mostRecentAction(instanceID)).toBeErrorAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['0'], value: '3', evaluation_value: 3 },
+        ],
+        actionGroup: FIRED_ACTIONS.id,
+        alertState: 'ERROR',
+        reason:
+          'Alert is using a malformed KQL query: host.name:(look.there.is.no.space.after.these.parentheses)and uh.oh: "wow that is bad"',
+      });
     });
   });
 
   describe('querying the entire infrastructure with warning threshold', () => {
-    afterAll(() => clearInstances());
-    const instanceID = '*';
+    const alertID = '*';
 
     const execute = () =>
       executor({
@@ -1854,20 +2117,22 @@ describe('The metric threshold alert type', () => {
     test('warns as expected with the > comparator', async () => {
       setResults({ warningThreshold: [2.49], currentValue: 2.5, shouldWarn: true });
       await execute();
-      expect(mostRecentAction(instanceID)).toBeWarnAction();
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          { metric: 'test.metric.1', threshold: ['9,999'], value: '2.5', evaluation_value: 2.5 },
+        ],
+        actionGroup: WARNING_ACTIONS.id,
+        alertState: 'WARNING',
+        reason: 'test.metric.1 is 2.5 in the last 1 min. Alert when > 2.49.',
+        tags: [],
+      });
 
       setResults({ warningThreshold: [2.49], currentValue: 1.23, shouldWarn: false });
       await execute();
-      expect(mostRecentAction(instanceID)).toBe(undefined);
-    });
-
-    test('reports expected warning values to the action context', async () => {
-      setResults({ warningThreshold: [2.49], currentValue: 2.5, shouldWarn: true });
-      await execute();
-
-      const { action } = mostRecentAction(instanceID);
-      expect(action.group).toBe('*');
-      expect(action.reason).toBe('test.metric.1 is 2.5 in the last 1 min. Alert when > 2.49.');
+      // should not have been called again
+      testNAlertsReported(1);
     });
 
     test('reports expected warning values to the action context for percentage metric', async () => {
@@ -1879,11 +2144,105 @@ describe('The metric threshold alert type', () => {
       });
       await execute();
 
-      const { action } = mostRecentAction(instanceID);
-      expect(action.group).toBe('*');
-      expect(action.reason).toBe('system.cpu.user.pct is 82% in the last 1 min. Alert when > 81%.');
+      testNAlertsReported(1);
+      testAlertReported(1, {
+        id: alertID,
+        conditions: [
+          {
+            metric: 'test.metric.1',
+            threshold: ['999,900%'],
+            value: '82%',
+            evaluation_value: 0.82,
+          },
+        ],
+        actionGroup: WARNING_ACTIONS.id,
+        alertState: 'WARNING',
+        reason: 'system.cpu.user.pct is 82% in the last 1 min. Alert when > 81%.',
+        tags: [],
+      });
     });
   });
+
+  function testNAlertsReported(n: number) {
+    expect(services.alertsClient.report).toHaveBeenCalledTimes(n);
+    expect(services.alertsClient.setAlertData).toHaveBeenCalledTimes(n);
+  }
+
+  function testAlertReported(
+    index: number,
+    {
+      id,
+      actionGroup,
+      alertState,
+      groupByKeys,
+      conditions,
+      reason,
+      tags,
+    }: {
+      id: string;
+      actionGroup: string;
+      alertState: string;
+      groupByKeys?: any;
+      conditions: Array<{
+        metric: string;
+        threshold: Array<number | string>;
+        value: string | number;
+        evaluation_value?: number | null;
+      }>;
+      reason: string;
+      tags?: string[];
+    }
+  ) {
+    expect(services.alertsClient.report).toHaveBeenNthCalledWith(index, {
+      id,
+      actionGroup,
+    });
+    expect(services.alertsClient.setAlertData).toHaveBeenNthCalledWith(index, {
+      context: {
+        alertDetailsUrl: '',
+        alertState,
+        group: id,
+        reason,
+        timestamp: mockNow.toISOString(),
+        viewInAppUrl: 'http://localhost:5601/app/metrics/explorer',
+
+        metric: conditions.reduce((acc, curr, ndx) => {
+          set(acc, `condition${ndx}`, curr.metric);
+          return acc;
+        }, {}),
+
+        value:
+          alertState !== 'ERROR'
+            ? conditions.reduce((acc, curr, ndx) => {
+                set(acc, `condition${ndx}`, curr.value);
+                return acc;
+              }, {})
+            : null,
+
+        ...(groupByKeys ? { groupByKeys } : {}),
+
+        ...(tags ? { tags } : {}),
+        ...(alertState !== 'ERROR'
+          ? {
+              threshold: conditions.reduce((acc, curr, ndx) => {
+                set(acc, `condition${ndx}`, curr.threshold);
+                return acc;
+              }, {}),
+            }
+          : {}),
+      },
+      id,
+      payload: {
+        ...(alertState !== 'ERROR'
+          ? {
+              [ALERT_EVALUATION_VALUES]: conditions.map((c) => c.evaluation_value),
+            }
+          : {}),
+        [ALERT_REASON]: reason,
+        ...(tags ? { tags } : {}),
+      },
+    });
+  }
 });
 
 const createMockStaticConfiguration = (sources: any): InfraConfig => ({
@@ -1912,16 +2271,20 @@ const createMockStaticConfiguration = (sources: any): InfraConfig => ({
 });
 
 const mockLibs: any = {
-  sources: new InfraSources({
-    config: createMockStaticConfiguration({}),
-    metricsClient: {
-      getMetricIndices: jest.fn().mockResolvedValue('metrics-*,metricbeat-*'),
-    } as unknown as MetricsDataClient,
-  }),
-  configuration: createMockStaticConfiguration({}),
-  metricsRules: {
-    createLifecycleRuleExecutor: createLifecycleRuleExecutorMock,
+  sources: {
+    getSourceConfiguration: (savedObjectsClient: any, sourceId: string) => {
+      return Promise.resolve({
+        id: sourceId,
+        configuration: {
+          logIndices: {
+            type: 'index_pattern',
+            indexPatternId: 'some-id',
+          },
+        },
+      });
+    },
   },
+  configuration: createMockStaticConfiguration({}),
   basePath: {
     publicBaseUrl: 'http://localhost:5601',
     prepend: (path: string) => path,
@@ -1931,12 +2294,7 @@ const mockLibs: any = {
 
 const executor = createMetricThresholdExecutor(mockLibs);
 
-const alertsServices = alertsMock.createRuleExecutorServices();
-const services: RuleExecutorServicesMock &
-  LifecycleAlertServices<AlertState, AlertContext, string> = {
-  ...alertsServices,
-  ...ruleRegistryMocks.createLifecycleAlertServices(alertsServices),
-};
+const services = alertsMock.createRuleExecutorServices();
 services.savedObjectsClient.get.mockImplementation(async (type: string, sourceId: string) => {
   if (sourceId === 'alternate')
     return {
@@ -1955,93 +2313,6 @@ services.savedObjectsClient.get.mockImplementation(async (type: string, sourceId
   return { id: 'default', attributes: { metricAlias: 'metricbeat-*' }, type, references: [] };
 });
 
-const alertInstances = new Map<string, AlertTestInstance>();
-services.alertFactory.create.mockImplementation((instanceID: string) => {
-  const newAlertInstance: AlertTestInstance = {
-    instance: alertsMock.createAlertFactory.create(),
-    actionQueue: [],
-    state: {},
-  };
-  const alertInstance: AlertTestInstance = persistAlertInstances
-    ? alertInstances.get(instanceID) || newAlertInstance
-    : newAlertInstance;
-  alertInstances.set(instanceID, alertInstance);
-
-  alertInstance.instance.replaceState.mockImplementation((newState: any) => {
-    alertInstance.state = newState;
-    return alertInstance.instance;
-  });
-  (alertInstance.instance.scheduleActions as jest.Mock).mockImplementation(
-    (id: string, action: any) => {
-      alertInstance.actionQueue.push({ id, action });
-      return alertInstance.instance;
-    }
-  );
-  return alertInstance.instance;
-});
-
-function mostRecentAction(id: string) {
-  const instance = alertInstances.get(id);
-  if (!instance) return undefined;
-  return instance.actionQueue.pop();
-}
-
-function clearInstances() {
-  alertInstances.clear();
-}
-
-interface Action {
-  id: string;
-  action: { alertState: string };
-}
-
-expect.extend({
-  toBeAlertAction(action?: Action) {
-    const pass = action?.id === FIRED_ACTIONS.id && action?.action.alertState === 'ALERT';
-    const message = () => `expected ${action} to be an ALERT action`;
-    return {
-      message,
-      pass,
-    };
-  },
-  toBeWarnAction(action?: Action) {
-    const pass = action?.id === WARNING_ACTIONS.id && action?.action.alertState === 'WARNING';
-    const message = () => `expected ${JSON.stringify(action)} to be an WARNING action`;
-    return {
-      message,
-      pass,
-    };
-  },
-  toBeNoDataAction(action?: Action) {
-    const pass = action?.id === NO_DATA_ACTIONS.id && action?.action.alertState === 'NO DATA';
-    const message = () => `expected ${action} to be a NO DATA action`;
-    return {
-      message,
-      pass,
-    };
-  },
-  toBeErrorAction(action?: Action) {
-    const pass = action?.id === FIRED_ACTIONS.id && action?.action.alertState === 'ERROR';
-    const message = () => `expected ${action} to be an ERROR action`;
-    return {
-      message,
-      pass,
-    };
-  },
-});
-
-declare global {
-  // eslint-disable-next-line @typescript-eslint/no-namespace
-  namespace jest {
-    interface Matchers<R> {
-      toBeAlertAction(action?: Action): R;
-      toBeWarnAction(action?: Action): R;
-      toBeNoDataAction(action?: Action): R;
-      toBeErrorAction(action?: Action): R;
-    }
-  }
-}
-
 const baseNonCountCriterion = {
   aggType: Aggregators.AVERAGE,
   metric: 'test.metric.1',
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index 26db822e9caf5..4a51722288c05 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { ALERT_ACTION_GROUP, ALERT_EVALUATION_VALUES, ALERT_REASON } from '@kbn/rule-data-utils';
+import { ALERT_EVALUATION_VALUES, ALERT_REASON } from '@kbn/rule-data-utils';
 import { isEqual } from 'lodash';
 import {
   ActionGroupIdsOf,
@@ -14,9 +14,10 @@ import {
   AlertInstanceState as AlertState,
   RecoveredActionGroup,
 } from '@kbn/alerting-plugin/common';
-import { Alert, RuleTypeState } from '@kbn/alerting-plugin/server';
+import { RuleExecutorOptions, RuleTypeState } from '@kbn/alerting-plugin/server';
 import type { TimeUnitChar } from '@kbn/observability-plugin/common';
 import { getAlertUrl } from '@kbn/observability-plugin/common';
+import { ObservabilityMetricsAlert } from '@kbn/alerts-as-data-utils';
 import { getOriginalActionGroup } from '../../../utils/get_original_action_group';
 import { AlertStates, Comparator } from '../../../../common/alerting/metrics';
 import { createFormatter } from '../../../../common/formatters';
@@ -44,6 +45,14 @@ import { EvaluatedRuleParams, evaluateRule } from './lib/evaluate_rule';
 import { MissingGroupsRecord } from './lib/check_missing_group';
 import { convertStringsToMissingGroupsRecord } from './lib/convert_strings_to_missing_groups_record';
 
+export type MetricThresholdAlert = Omit<
+  ObservabilityMetricsAlert,
+  'kibana.alert.evaluation.values'
+> & {
+  // Defining a custom type for this because the schema generation script doesn't allow explicit null values
+  'kibana.alert.evaluation.values'?: Array<number | null>;
+};
+
 export type MetricThresholdRuleParams = Record<string, any>;
 export type MetricThresholdRuleTypeState = RuleTypeState & {
   lastRunTimestamp?: number;
@@ -68,28 +77,27 @@ type MetricThresholdAllowedActionGroups = ActionGroupIdsOf<
   typeof FIRED_ACTIONS | typeof WARNING_ACTIONS | typeof NO_DATA_ACTIONS
 >;
 
-type MetricThresholdAlert = Alert<
-  MetricThresholdAlertState,
-  MetricThresholdAlertContext,
-  MetricThresholdAllowedActionGroups
->;
-
-type MetricThresholdAlertFactory = (
+type MetricThresholdAlertReporter = (
   id: string,
   reason: string,
   actionGroup: MetricThresholdActionGroup,
+  context: MetricThresholdAlertContext,
   additionalContext?: AdditionalContext | null,
   evaluationValues?: Array<number | null>
-) => MetricThresholdAlert;
-
-export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
-  libs.metricsRules.createLifecycleRuleExecutor<
-    MetricThresholdRuleParams,
-    MetricThresholdRuleTypeState,
-    MetricThresholdAlertState,
-    MetricThresholdAlertContext,
-    MetricThresholdAllowedActionGroups
-  >(async function (options) {
+) => void;
+
+export const createMetricThresholdExecutor =
+  (libs: InfraBackendLibs) =>
+  async (
+    options: RuleExecutorOptions<
+      MetricThresholdRuleParams,
+      MetricThresholdRuleTypeState,
+      MetricThresholdAlertState,
+      MetricThresholdAlertContext,
+      MetricThresholdAllowedActionGroups,
+      MetricThresholdAlert
+    >
+  ) => {
     const startTime = Date.now();
 
     const {
@@ -110,30 +118,43 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
       executionId,
     });
 
-    const {
-      alertWithLifecycle,
-      savedObjectsClient,
-      getAlertUuid,
-      getAlertStartedDate,
-      getAlertByAlertUuid,
-    } = services;
+    const { alertsClient, savedObjectsClient } = services;
+    if (!alertsClient) {
+      throw new Error(`Expected alertsClient to be defined but it was not!`);
+    }
 
-    const alertFactory: MetricThresholdAlertFactory = (
+    const alertReporter: MetricThresholdAlertReporter = async (
       id,
       reason,
       actionGroup,
+      contextWithoutAlertDetailsUrl,
       additionalContext,
       evaluationValues
-    ) =>
-      alertWithLifecycle({
+    ) => {
+      const { uuid, start } = alertsClient.report({
         id,
-        fields: {
+        actionGroup,
+      });
+
+      alertsClient.setAlertData({
+        id,
+        payload: {
           [ALERT_REASON]: reason,
-          [ALERT_ACTION_GROUP]: actionGroup,
           [ALERT_EVALUATION_VALUES]: evaluationValues,
           ...flattenAdditionalContext(additionalContext),
         },
+        context: {
+          ...contextWithoutAlertDetailsUrl,
+          alertDetailsUrl: await getAlertUrl(
+            uuid,
+            spaceId,
+            start ?? startedAt.toISOString(),
+            libs.alertsLocator,
+            libs.basePath.publicBaseUrl
+          ),
+        },
       });
+    };
 
     const {
       sourceId,
@@ -154,19 +175,7 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
         const timestamp = startedAt.toISOString();
         const actionGroupId = FIRED_ACTIONS_ID; // Change this to an Error action group when able
         const reason = buildInvalidQueryAlertReason(params.filterQueryText);
-        const alert = alertFactory(UNGROUPED_FACTORY_KEY, reason, actionGroupId);
-        const alertUuid = getAlertUuid(UNGROUPED_FACTORY_KEY);
-        const indexedStartedAt =
-          getAlertStartedDate(UNGROUPED_FACTORY_KEY) ?? startedAt.toISOString();
-
-        alert.scheduleActions(actionGroupId, {
-          alertDetailsUrl: await getAlertUrl(
-            alertUuid,
-            spaceId,
-            indexedStartedAt,
-            libs.alertsLocator,
-            libs.basePath.publicBaseUrl
-          ),
+        const alertContext = {
           alertState: stateToAlertMessage[AlertStates.ERROR],
           group: UNGROUPED_FACTORY_KEY,
           metric: mapToConditionsLookup(criteria, (c) => c.metric),
@@ -174,7 +183,9 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
           timestamp,
           value: null,
           viewInAppUrl: getViewInMetricsAppUrl(libs.basePath, spaceId),
-        });
+        };
+
+        await alertReporter(UNGROUPED_FACTORY_KEY, reason, actionGroupId, alertContext);
 
         return {
           state: {
@@ -317,25 +328,7 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
           return acc;
         }, []);
 
-        const alert = alertFactory(
-          `${group}`,
-          reason,
-          actionGroupId,
-          additionalContext,
-          evaluationValues
-        );
-        const alertUuid = getAlertUuid(group);
-        const indexedStartedAt = getAlertStartedDate(group) ?? startedAt.toISOString();
-        scheduledActionsCount++;
-
-        alert.scheduleActions(actionGroupId, {
-          alertDetailsUrl: await getAlertUrl(
-            alertUuid,
-            spaceId,
-            indexedStartedAt,
-            libs.alertsLocator,
-            libs.basePath.publicBaseUrl
-          ),
+        const alertContext = {
           alertState: stateToAlertMessage[nextState],
           group,
           groupByKeys: groupByKeysObjectMapping[group],
@@ -365,29 +358,37 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
           }),
           viewInAppUrl: getViewInMetricsAppUrl(libs.basePath, spaceId),
           ...additionalContext,
-        });
+        };
+
+        await alertReporter(
+          `${group}`,
+          reason,
+          actionGroupId,
+          alertContext,
+          additionalContext,
+          evaluationValues
+        );
+        scheduledActionsCount++;
       }
     }
 
-    const { getRecoveredAlerts } = services.alertFactory.done();
-    const recoveredAlerts = getRecoveredAlerts();
-
+    const recoveredAlerts = alertsClient?.getRecoveredAlerts() ?? [];
     const groupByKeysObjectForRecovered = getGroupByObject(
       params.groupBy,
-      new Set<string>(recoveredAlerts.map((recoveredAlert) => recoveredAlert.getId()))
+      new Set<string>(recoveredAlerts.map((recoveredAlert) => recoveredAlert.alert.getId()))
     );
 
-    for (const alert of recoveredAlerts) {
-      const recoveredAlertId = alert.getId();
-      const alertUuid = getAlertUuid(recoveredAlertId);
+    for (const recoveredAlert of recoveredAlerts) {
+      const recoveredAlertId = recoveredAlert.alert.getId();
+      const alertUuid = recoveredAlert.alert.getUuid();
       const timestamp = startedAt.toISOString();
-      const indexedStartedAt = getAlertStartedDate(recoveredAlertId) ?? timestamp;
+      const indexedStartedAt = recoveredAlert.alert.getStart() ?? timestamp;
 
-      const alertHits = alertUuid ? await getAlertByAlertUuid(alertUuid) : undefined;
+      const alertHits = recoveredAlert.hit;
       const additionalContext = getContextForRecoveredAlerts(alertHits);
       const originalActionGroup = getOriginalActionGroup(alertHits);
 
-      alert.setContext({
+      recoveredAlert.alert.setContext({
         alertDetailsUrl: await getAlertUrl(
           alertUuid,
           spaceId,
@@ -427,7 +428,7 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
         filterQuery: params.filterQuery,
       },
     };
-  });
+  };
 
 export const FIRED_ACTIONS = {
   id: 'metrics.threshold.fired',
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_rule_type.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_rule_type.ts
index e7ea693a0e74d..108bf49102393 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_rule_type.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_rule_type.ts
@@ -11,6 +11,7 @@ import { i18n } from '@kbn/i18n';
 import { ActionGroupIdsOf } from '@kbn/alerting-plugin/common';
 import {
   GetViewInAppRelativeUrlFnOpts,
+  IRuleTypeAlerts,
   PluginSetupContract,
   RuleType,
 } from '@kbn/alerting-plugin/server';
@@ -44,6 +45,7 @@ import {
   FIRED_ACTIONS,
   WARNING_ACTIONS,
   NO_DATA_ACTIONS,
+  MetricThresholdAlert,
 } from './metric_threshold_executor';
 import { MetricsRulesTypeAlertDefinition } from '../register_rule_types';
 import { O11Y_AAD_FIELDS } from '../../../../common/constants';
@@ -197,7 +199,10 @@ export async function registerMetricThresholdRuleType(
     },
     category: DEFAULT_APP_CATEGORIES.observability.id,
     producer: 'infrastructure',
-    alerts: MetricsRulesTypeAlertDefinition,
+    alerts: {
+      ...MetricsRulesTypeAlertDefinition,
+      shouldWrite: true,
+    } as IRuleTypeAlerts<MetricThresholdAlert>,
     getViewInAppRelativeUrl: ({ rule }: GetViewInAppRelativeUrlFnOpts<{}>) =>
       observabilityPaths.ruleDetails(rule.id),
   });
diff --git a/x-pack/plugins/infra/server/lib/alerting/register_rule_types.ts b/x-pack/plugins/infra/server/lib/alerting/register_rule_types.ts
index 36c836fc50aa7..c26d92d5291c0 100644
--- a/x-pack/plugins/infra/server/lib/alerting/register_rule_types.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/register_rule_types.ts
@@ -29,6 +29,7 @@ export const MetricsRulesTypeAlertDefinition: IRuleTypeAlerts = {
   mappings: { fieldMap: legacyExperimentalFieldMap },
   useEcs: true,
   useLegacyAlerts: true,
+  shouldWrite: false,
 };
 
 const registerRuleTypes = (
diff --git a/x-pack/plugins/infra/server/utils/get_original_action_group.ts b/x-pack/plugins/infra/server/utils/get_original_action_group.ts
index 2ca7f5833c3cd..8b70ad23b8e1e 100644
--- a/x-pack/plugins/infra/server/utils/get_original_action_group.ts
+++ b/x-pack/plugins/infra/server/utils/get_original_action_group.ts
@@ -5,12 +5,15 @@
  * 2.0.
  */
 
+import { Alert } from '@kbn/alerts-as-data-utils';
 import { ALERT_ACTION_GROUP } from '@kbn/rule-data-utils';
 import { ParsedTechnicalFields } from '@kbn/rule-registry-plugin/common';
 import { ParsedExperimentalFields } from '@kbn/rule-registry-plugin/common/parse_experimental_fields';
 
-export const getOriginalActionGroup = (
-  alertHitSource: Partial<ParsedTechnicalFields & ParsedExperimentalFields> | undefined | null
+export const getOriginalActionGroup = <
+  T extends Alert | (ParsedTechnicalFields & ParsedExperimentalFields)
+>(
+  alertHitSource: Partial<T> | undefined | null
 ) => {
   return alertHitSource?.[ALERT_ACTION_GROUP];
 };
diff --git a/x-pack/plugins/lens/public/visualizations/partition/visualization.tsx b/x-pack/plugins/lens/public/visualizations/partition/visualization.tsx
index da42517ad30cc..267c014ae1a6c 100644
--- a/x-pack/plugins/lens/public/visualizations/partition/visualization.tsx
+++ b/x-pack/plugins/lens/public/visualizations/partition/visualization.tsx
@@ -284,6 +284,7 @@ export const getPieVisualization = ({
         case PieChartTypes.MOSAIC:
           return {
             ...primaryGroupConfigBaseProps,
+            requiredMinDimensionCount: 1,
             groupLabel: i18n.translate('xpack.lens.pie.verticalAxisLabel', {
               defaultMessage: 'Vertical axis',
             }),
diff --git a/x-pack/plugins/ml/public/application/components/ml_inference/add_inference_pipeline_flyout.tsx b/x-pack/plugins/ml/public/application/components/ml_inference/add_inference_pipeline_flyout.tsx
index 592df6079603d..c1e612e3b08d1 100644
--- a/x-pack/plugins/ml/public/application/components/ml_inference/add_inference_pipeline_flyout.tsx
+++ b/x-pack/plugins/ml/public/application/components/ml_inference/add_inference_pipeline_flyout.tsx
@@ -33,7 +33,7 @@ import { ReviewAndCreatePipeline } from './components/review_and_create_pipeline
 import { useMlApiContext } from '../../contexts/kibana';
 import { getPipelineConfig } from './get_pipeline_config';
 import { validateInferencePipelineConfigurationStep } from './validation';
-import type { MlInferenceState, InferenceModelTypes } from './types';
+import { type MlInferenceState, type InferenceModelTypes, TEST_PIPELINE_MODE } from './types';
 import { useFetchPipelines } from './hooks/use_fetch_pipelines';
 
 export interface AddInferencePipelineFlyoutProps {
@@ -157,7 +157,11 @@ export const AddInferencePipelineFlyout: FC<AddInferencePipelineFlyoutProps> = (
           />
         )}
         {step === ADD_INFERENCE_PIPELINE_STEPS.TEST && (
-          <TestPipeline sourceIndex={sourceIndex} state={formState} />
+          <TestPipeline
+            sourceIndex={sourceIndex}
+            state={formState}
+            mode={TEST_PIPELINE_MODE.STEP}
+          />
         )}
         {step === ADD_INFERENCE_PIPELINE_STEPS.CREATE && (
           <ReviewAndCreatePipeline
diff --git a/x-pack/plugins/ml/public/application/components/ml_inference/components/test_pipeline.tsx b/x-pack/plugins/ml/public/application/components/ml_inference/components/test_pipeline.tsx
index e2b5ceabaac88..d3dc0b645cbd3 100644
--- a/x-pack/plugins/ml/public/application/components/ml_inference/components/test_pipeline.tsx
+++ b/x-pack/plugins/ml/public/application/components/ml_inference/components/test_pipeline.tsx
@@ -5,24 +5,28 @@
  * 2.0.
  */
 
-import React, { FC, memo, useEffect, useCallback, useState } from 'react';
+import React, { FC, memo, useEffect, useCallback, useMemo, useState } from 'react';
 import { css } from '@emotion/react';
 import { euiThemeVars } from '@kbn/ui-theme';
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import {
+  EuiAccordion,
   EuiButton,
   EuiButtonEmpty,
+  EuiCallOut,
   EuiCode,
   EuiCodeBlock,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiLink,
   EuiResizableContainer,
   EuiSpacer,
   EuiTitle,
   EuiText,
   useIsWithinMaxBreakpoint,
   EuiPanel,
+  htmlIdGenerator,
 } from '@elastic/eui';
 
 import { IngestSimulateDocument } from '@elastic/elasticsearch/lib/api/types';
@@ -35,32 +39,57 @@ import { useMlApiContext, useMlKibana } from '../../../contexts/kibana';
 import { getPipelineConfig } from '../get_pipeline_config';
 import { isValidJson } from '../../../../../common/util/validation_utils';
 import type { MlInferenceState } from '../types';
+import { checkIndexExists } from '../retry_create_data_view';
+import { type TestPipelineMode, TEST_PIPELINE_MODE } from '../types';
+
+const sourceIndexMissingMessage = i18n.translate(
+  'xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.sourceIndexMissing',
+  {
+    defaultMessage:
+      'The source index used to train the model is missing. Enter text for documents to test the pipeline.',
+  }
+);
 
 interface Props {
   sourceIndex?: string;
   state: MlInferenceState;
+  mode: TestPipelineMode;
 }
 
-export const TestPipeline: FC<Props> = memo(({ state, sourceIndex }) => {
+export const TestPipeline: FC<Props> = memo(({ state, sourceIndex, mode }) => {
   const [simulatePipelineResult, setSimulatePipelineResult] = useState<
     undefined | estypes.IngestSimulateResponse
   >();
   const [simulatePipelineError, setSimulatePipelineError] = useState<undefined | string>();
+  const [sourceIndexMissingError, setSourceIndexMissingError] = useState<undefined | string>();
   const [sampleDocsString, setSampleDocsString] = useState<string>('');
+  const [lastFetchedSampleDocsString, setLastFetchedSampleDocsString] = useState<string>('');
   const [isValid, setIsValid] = useState<boolean>(true);
+  const [showCallOut, setShowCallOut] = useState<boolean>(true);
   const {
     esSearch,
     trainedModels: { trainedModelPipelineSimulate },
   } = useMlApiContext();
   const {
     notifications: { toasts },
+    services: {
+      docLinks: { links },
+    },
   } = useMlKibana();
 
   const isSmallerViewport = useIsWithinMaxBreakpoint('s');
+  const accordionId = useMemo(() => htmlIdGenerator()(), []);
+  const pipelineConfig = useMemo(() => getPipelineConfig(state), [state]);
+  const requestBody = useMemo(() => {
+    const body = { pipeline: pipelineConfig, docs: [] };
+    if (isValidJson(sampleDocsString)) {
+      body.docs = JSON.parse(sampleDocsString);
+    }
+    return body;
+  }, [pipelineConfig, sampleDocsString]);
 
   const simulatePipeline = async () => {
     try {
-      const pipelineConfig = getPipelineConfig(state);
       const result = await trainedModelPipelineSimulate(
         pipelineConfig,
         JSON.parse(sampleDocsString) as IngestSimulateDocument[]
@@ -95,36 +124,79 @@ export const TestPipeline: FC<Props> = memo(({ state, sourceIndex }) => {
     setIsValid(valid);
   };
 
-  const getSampleDocs = useCallback(async () => {
-    let records: IngestSimulateDocument[] = [];
-    let resp;
+  const getDocs = useCallback(
+    async (body: any) => {
+      let records: IngestSimulateDocument[] = [];
+      let resp;
+      try {
+        resp = await esSearch(body);
 
-    try {
-      resp = await esSearch({
-        index: sourceIndex,
-        body: {
-          size: 1,
-        },
-      });
+        if (resp && resp.hits.total.value > 0) {
+          records = resp.hits.hits;
+        }
+      } catch (error) {
+        // eslint-disable-next-line no-console
+        console.error(error);
+      }
+      setSampleDocsString(JSON.stringify(records, null, 2));
+      setSimulatePipelineResult(undefined);
+      setLastFetchedSampleDocsString(JSON.stringify(records, null, 2));
+      setIsValid(true);
+    },
+    [esSearch]
+  );
+
+  const { getSampleDoc, getRandomSampleDoc } = useMemo(
+    () => ({
+      getSampleDoc: async () => {
+        getDocs({
+          index: sourceIndex,
+          body: {
+            size: 1,
+          },
+        });
+      },
+      getRandomSampleDoc: async () => {
+        getDocs({
+          index: sourceIndex,
+          body: {
+            size: 1,
+            query: {
+              function_score: {
+                query: { match_all: {} },
+                random_score: {},
+              },
+            },
+          },
+        });
+      },
+    }),
+    [getDocs, sourceIndex]
+  );
 
-      if (resp && resp.hits.total.value > 0) {
-        records = resp.hits.hits;
+  useEffect(
+    function checkSourceIndexExists() {
+      async function ensureSourceIndexExists() {
+        const resp = await checkIndexExists(sourceIndex!);
+        const indexExists = resp.resp && resp.resp[sourceIndex!] && resp.resp[sourceIndex!].exists;
+        if (indexExists === false) {
+          setSourceIndexMissingError(sourceIndexMissingMessage);
+        }
       }
-    } catch (error) {
-      // eslint-disable-next-line no-console
-      console.error(error);
-    }
-    setSampleDocsString(JSON.stringify(records, null, 2));
-    setIsValid(true);
-  }, [sourceIndex, esSearch]);
+      if (sourceIndex) {
+        ensureSourceIndexExists();
+      }
+    },
+    [sourceIndex, sourceIndexMissingError]
+  );
 
   useEffect(
     function fetchSampleDocsFromSource() {
-      if (sourceIndex) {
-        getSampleDocs();
+      if (sourceIndex && sourceIndexMissingError === undefined) {
+        getSampleDoc();
       }
     },
-    [sourceIndex, getSampleDocs]
+    [sourceIndex, getSampleDoc, sourceIndexMissingError]
   );
 
   return (
@@ -147,27 +219,88 @@ export const TestPipeline: FC<Props> = memo(({ state, sourceIndex }) => {
         <EuiFlexItem>
           <EuiText color="subdued" size="s">
             <p>
-              <strong>
-                {i18n.translate(
-                  'xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.optionalCallout',
-                  { defaultMessage: 'This is an optional step.' }
-                )}
-              </strong>
-              &nbsp;
-              <FormattedMessage
-                id="xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.description"
-                defaultMessage="Run a simulation of the pipeline to confirm it produces the anticipated results."
-              />{' '}
-              {state.targetField && (
+              {mode === TEST_PIPELINE_MODE.STEP ? (
+                <>
+                  <strong>
+                    {i18n.translate(
+                      'xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.optionalCallout',
+                      { defaultMessage: 'This is an optional step.' }
+                    )}
+                  </strong>
+                  &nbsp;
+                </>
+              ) : null}
+              <>
                 <FormattedMessage
-                  id="xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.targetFieldHint"
-                  defaultMessage="Check for the target field {targetField} for the prediction in the Result tab."
-                  values={{ targetField: <EuiCode>{state.targetField}</EuiCode> }}
+                  id="xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.description"
+                  defaultMessage="Run a simulation of the pipeline to confirm it produces the anticipated results. {simulatePipelineDocsLink}"
+                  values={{
+                    simulatePipelineDocsLink: (
+                      <EuiLink external target="_blank" href={links.apis.simulatePipeline}>
+                        Learn more.
+                      </EuiLink>
+                    ),
+                  }}
                 />
+                <br />
+              </>
+              {state.targetField && (
+                <>
+                  <FormattedMessage
+                    id="xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.targetFieldHint"
+                    defaultMessage="Check for the target field {targetField} for the prediction in the Result tab."
+                    values={{
+                      targetField: <EuiCode>{state.targetField}</EuiCode>,
+                    }}
+                  />
+                  <br />
+                </>
               )}
+              {sampleDocsString && sourceIndexMissingError === undefined ? (
+                <FormattedMessage
+                  id="xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.sourceIndexDocText"
+                  defaultMessage="The provided sample document is taken from the source index used to train the model."
+                />
+              ) : null}
             </p>
           </EuiText>
         </EuiFlexItem>
+        <EuiSpacer size="m" />
+        {sourceIndexMissingError && showCallOut ? (
+          <EuiFlexItem>
+            <EuiCallOut
+              onDismiss={() => {
+                setShowCallOut(false);
+              }}
+              size="s"
+              title={sourceIndexMissingError}
+              iconType="warning"
+            />
+            <EuiSpacer size="s" />
+          </EuiFlexItem>
+        ) : null}
+        {mode === TEST_PIPELINE_MODE.STAND_ALONE ? (
+          <EuiFlexItem>
+            <EuiAccordion
+              id={accordionId}
+              buttonContent={
+                <FormattedMessage
+                  id="xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.viewRequest"
+                  defaultMessage="View request body"
+                />
+              }
+            >
+              <EuiCodeBlock
+                language="json"
+                isCopyable
+                overflowHeight="400px"
+                data-test-subj="mlTrainedModelsInferenceTestStepConfigBlock"
+              >
+                {JSON.stringify(requestBody, null, 2)}
+              </EuiCodeBlock>
+            </EuiAccordion>
+          </EuiFlexItem>
+        ) : null}
       </EuiFlexGroup>
       <EuiSpacer size="m" />
       <EuiPanel hasBorder={false} hasShadow={false}>
@@ -202,12 +335,26 @@ export const TestPipeline: FC<Props> = memo(({ state, sourceIndex }) => {
               <EuiFlexItem grow={false}>
                 <EuiButtonEmpty
                   size="xs"
-                  onClick={getSampleDocs}
-                  disabled={sampleDocsString === ''}
+                  onClick={() => setSampleDocsString(lastFetchedSampleDocsString)}
+                  disabled={
+                    sampleDocsString === '' || sampleDocsString === lastFetchedSampleDocsString
+                  }
                 >
                   {i18n.translate(
                     'xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.resetSampleDocsButton',
-                    { defaultMessage: 'Reset sample docs' }
+                    { defaultMessage: 'Reset' }
+                  )}
+                </EuiButtonEmpty>
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiButtonEmpty
+                  size="xs"
+                  onClick={getRandomSampleDoc}
+                  disabled={sampleDocsString === ''}
+                >
+                  {i18n.translate(
+                    'xpack.ml.trainedModels.content.indices.pipelines.addInferencePipelineModal.steps.test.reloadSampleDocsButton',
+                    { defaultMessage: 'Reload' }
                   )}
                 </EuiButtonEmpty>
               </EuiFlexItem>
@@ -261,8 +408,6 @@ export const TestPipeline: FC<Props> = memo(({ state, sourceIndex }) => {
                     />
                   </EuiResizablePanel>
 
-                  <EuiResizableButton />
-
                   <EuiResizablePanel grow={false} hasBorder initialSize={50} paddingSize="xs">
                     <EuiCodeBlock
                       language="json"
diff --git a/x-pack/plugins/ml/public/application/components/ml_inference/types.ts b/x-pack/plugins/ml/public/application/components/ml_inference/types.ts
index da0aef1a42154..5092cab93303d 100644
--- a/x-pack/plugins/ml/public/application/components/ml_inference/types.ts
+++ b/x-pack/plugins/ml/public/application/components/ml_inference/types.ts
@@ -46,3 +46,9 @@ export interface AdditionalSettings {
   condition?: string;
   tag?: string;
 }
+
+export const TEST_PIPELINE_MODE = {
+  STAND_ALONE: 'stand_alone',
+  STEP: 'step',
+} as const;
+export type TestPipelineMode = typeof TEST_PIPELINE_MODE[keyof typeof TEST_PIPELINE_MODE];
diff --git a/x-pack/plugins/ml/public/application/model_management/model_actions.tsx b/x-pack/plugins/ml/public/application/model_management/model_actions.tsx
index 7c08717b40723..6890dc1a21de6 100644
--- a/x-pack/plugins/ml/public/application/model_management/model_actions.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/model_actions.tsx
@@ -29,10 +29,11 @@ import { useToastNotificationService } from '../services/toast_notification_serv
 import { getUserInputModelDeploymentParamsProvider } from './deployment_setup';
 import { useMlKibana, useMlLocator, useNavigateToPath } from '../contexts/kibana';
 import { ML_PAGES } from '../../../common/constants/locator';
-import { isTestable } from './test_models';
+import { isTestable, isDfaTrainedModel } from './test_models';
 import { ModelItem } from './models_list';
 
 export function useModelActions({
+  onDfaTestAction,
   onTestAction,
   onModelsDeleteRequest,
   onModelDeployRequest,
@@ -42,6 +43,7 @@ export function useModelActions({
   modelAndDeploymentIds,
 }: {
   isLoading: boolean;
+  onDfaTestAction: (model: ModelItem) => void;
   onTestAction: (model: ModelItem) => void;
   onModelsDeleteRequest: (models: ModelItem[]) => void;
   onModelDeployRequest: (model: ModelItem) => void;
@@ -463,13 +465,8 @@ export function useModelActions({
           onModelDeployRequest(model);
         },
         available: (item) => {
-          const isDfaTrainedModel =
-            item.metadata?.analytics_config !== undefined ||
-            item.inference_config?.regression !== undefined ||
-            item.inference_config?.classification !== undefined;
-
           return (
-            isDfaTrainedModel &&
+            isDfaTrainedModel(item) &&
             !isBuiltInModel(item) &&
             !item.putModelConfig &&
             canManageIngestPipelines
@@ -540,7 +537,13 @@ export function useModelActions({
         type: 'icon',
         isPrimary: true,
         available: isTestable,
-        onClick: (item) => onTestAction(item),
+        onClick: (item) => {
+          if (isDfaTrainedModel(item) && !isBuiltInModel(item)) {
+            onDfaTestAction(item);
+          } else {
+            onTestAction(item);
+          }
+        },
         enabled: (item) => {
           return canTestTrainedModels && isTestable(item, true) && !isLoading;
         },
@@ -599,6 +602,7 @@ export function useModelActions({
       canDeleteTrainedModels,
       isBuiltInModel,
       onTestAction,
+      onDfaTestAction,
       canTestTrainedModels,
       canManageIngestPipelines,
     ]
diff --git a/x-pack/plugins/ml/public/application/model_management/models_list.tsx b/x-pack/plugins/ml/public/application/model_management/models_list.tsx
index af9b9ba3015e7..56486d1bbbd4f 100644
--- a/x-pack/plugins/ml/public/application/model_management/models_list.tsx
+++ b/x-pack/plugins/ml/public/application/model_management/models_list.tsx
@@ -69,6 +69,7 @@ import { useFieldFormatter } from '../contexts/kibana/use_field_formatter';
 import { useRefresh } from '../routing/use_refresh';
 import { SavedObjectsWarning } from '../components/saved_objects_warning';
 import { TestTrainedModelFlyout } from './test_models';
+import { TestDfaModelsFlyout } from './test_dfa_models_flyout';
 import { AddInferencePipelineFlyout } from '../components/ml_inference';
 import { useEnabledFeatures } from '../contexts/ml';
 
@@ -163,6 +164,7 @@ export const ModelsList: FC<Props> = ({
     {}
   );
   const [modelToTest, setModelToTest] = useState<ModelItem | null>(null);
+  const [dfaModelToTest, setDfaModelToTest] = useState<ModelItem | null>(null);
 
   const isBuiltInModel = useCallback(
     (item: ModelItem) => item.tags.includes(BUILT_IN_MODEL_TAG),
@@ -410,6 +412,7 @@ export const ModelsList: FC<Props> = ({
     isLoading,
     fetchModels: fetchModelsData,
     onTestAction: setModelToTest,
+    onDfaTestAction: setDfaModelToTest,
     onModelsDeleteRequest: setModelsToDelete,
     onModelDeployRequest: setModelToDeploy,
     onLoading: setIsLoading,
@@ -763,6 +766,9 @@ export const ModelsList: FC<Props> = ({
       {modelToTest === null ? null : (
         <TestTrainedModelFlyout model={modelToTest} onClose={setModelToTest.bind(null, null)} />
       )}
+      {dfaModelToTest === null ? null : (
+        <TestDfaModelsFlyout model={dfaModelToTest} onClose={setDfaModelToTest.bind(null, null)} />
+      )}
       {modelToDeploy !== undefined ? (
         <AddInferencePipelineFlyout
           onClose={setModelToDeploy.bind(null, undefined)}
diff --git a/x-pack/plugins/ml/public/application/model_management/test_dfa_models_flyout.tsx b/x-pack/plugins/ml/public/application/model_management/test_dfa_models_flyout.tsx
new file mode 100644
index 0000000000000..7d5cff3ab06b1
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/model_management/test_dfa_models_flyout.tsx
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useMemo } from 'react';
+import { EuiFlyout, EuiFlyoutBody, EuiFlyoutHeader, EuiSpacer, EuiTitle } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
+
+import { TestPipeline } from '../components/ml_inference/components/test_pipeline';
+import { getInitialState } from '../components/ml_inference/state';
+import type { ModelItem } from './models_list';
+import { TEST_PIPELINE_MODE } from '../components/ml_inference/types';
+
+interface Props {
+  model: ModelItem;
+  onClose: () => void;
+}
+
+export const TestDfaModelsFlyout: FC<Props> = ({ model, onClose }) => {
+  const sourceIndex = useMemo(
+    () =>
+      Array.isArray(model.metadata?.analytics_config.source.index)
+        ? model.metadata?.analytics_config.source.index.join()
+        : model.metadata?.analytics_config.source.index,
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [model?.model_id]
+  );
+
+  const state = useMemo(
+    () => getInitialState(model),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [model?.model_id]
+  );
+  return (
+    <EuiFlyout size="l" onClose={onClose} data-test-subj="mlTestModelsFlyout">
+      <EuiFlyoutHeader hasBorder>
+        <EuiTitle size="m">
+          <h2>
+            <FormattedMessage
+              id="xpack.ml.trainedModels.testDfaModelsFlyout.headerLabel"
+              defaultMessage="Test trained model"
+            />
+          </h2>
+        </EuiTitle>
+        <EuiSpacer size="s" />
+        <EuiTitle size="xs">
+          <h4>{model.model_id}</h4>
+        </EuiTitle>
+      </EuiFlyoutHeader>
+      <EuiFlyoutBody>
+        <TestPipeline
+          state={state}
+          sourceIndex={sourceIndex}
+          mode={TEST_PIPELINE_MODE.STAND_ALONE}
+        />
+      </EuiFlyoutBody>
+    </EuiFlyout>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/model_management/test_models/index.ts b/x-pack/plugins/ml/public/application/model_management/test_models/index.ts
index da7c12c1c0c58..25078a40d4206 100644
--- a/x-pack/plugins/ml/public/application/model_management/test_models/index.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/index.ts
@@ -6,4 +6,4 @@
  */
 
 export { TestTrainedModelFlyout } from './test_flyout';
-export { isTestable } from './utils';
+export { isTestable, isDfaTrainedModel } from './utils';
diff --git a/x-pack/plugins/ml/public/application/model_management/test_models/utils.ts b/x-pack/plugins/ml/public/application/model_management/test_models/utils.ts
index 3adecb767f280..f21d535fddc58 100644
--- a/x-pack/plugins/ml/public/application/model_management/test_models/utils.ts
+++ b/x-pack/plugins/ml/public/application/model_management/test_models/utils.ts
@@ -15,6 +15,14 @@ import type { ModelItem } from '../models_list';
 
 const PYTORCH_TYPES = Object.values(SUPPORTED_PYTORCH_TASKS);
 
+export function isDfaTrainedModel(modelItem: ModelItem) {
+  return (
+    modelItem.metadata?.analytics_config !== undefined ||
+    modelItem.inference_config?.regression !== undefined ||
+    modelItem.inference_config?.classification !== undefined
+  );
+}
+
 export function isTestable(modelItem: ModelItem, checkForState = false) {
   if (
     modelItem.model_type === TRAINED_MODEL_TYPE.PYTORCH &&
@@ -31,5 +39,5 @@ export function isTestable(modelItem: ModelItem, checkForState = false) {
     return true;
   }
 
-  return false;
+  return isDfaTrainedModel(modelItem);
 }
diff --git a/x-pack/plugins/observability/docs/openapi/slo/bundled.json b/x-pack/plugins/observability/docs/openapi/slo/bundled.json
index 3ba6ab7762e93..b4f52b032a9fc 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/bundled.json
+++ b/x-pack/plugins/observability/docs/openapi/slo/bundled.json
@@ -1240,6 +1240,210 @@
           }
         }
       },
+      "timeslice_metric_basic_metric_with_field": {
+        "title": "Timeslice Metric Basic Metric with Field",
+        "required": [
+          "name",
+          "aggregation",
+          "field"
+        ],
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "The name of the metric. Only valid options are A-Z",
+            "type": "string",
+            "example": "A",
+            "pattern": "^[A-Z]$"
+          },
+          "aggregation": {
+            "description": "The aggregation type of the metric.",
+            "type": "string",
+            "example": "sum",
+            "enum": [
+              "sum",
+              "avg",
+              "min",
+              "max",
+              "std_deviation",
+              "last_value",
+              "cardinality"
+            ]
+          },
+          "field": {
+            "description": "The field of the metric.",
+            "type": "string",
+            "example": "processor.processed"
+          },
+          "filter": {
+            "description": "The filter to apply to the metric.",
+            "type": "string",
+            "example": "processor.outcome: \"success\""
+          }
+        }
+      },
+      "timeslice_metric_percentile_metric": {
+        "title": "Timeslice Metric Percentile Metric",
+        "required": [
+          "name",
+          "aggregation",
+          "field",
+          "percentile"
+        ],
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "The name of the metric. Only valid options are A-Z",
+            "type": "string",
+            "example": "A",
+            "pattern": "^[A-Z]$"
+          },
+          "aggregation": {
+            "description": "The aggregation type of the metric. Only valid option is \"percentile\"",
+            "type": "string",
+            "example": "percentile",
+            "enum": [
+              "percentile"
+            ]
+          },
+          "field": {
+            "description": "The field of the metric.",
+            "type": "string",
+            "example": "processor.processed"
+          },
+          "percentile": {
+            "description": "The percentile value.",
+            "type": "number",
+            "example": 95
+          },
+          "filter": {
+            "description": "The filter to apply to the metric.",
+            "type": "string",
+            "example": "processor.outcome: \"success\""
+          }
+        }
+      },
+      "timeslice_metric_doc_count_metric": {
+        "title": "Timeslice Metric Doc Count Metric",
+        "required": [
+          "name",
+          "aggregation"
+        ],
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "The name of the metric. Only valid options are A-Z",
+            "type": "string",
+            "example": "A",
+            "pattern": "^[A-Z]$"
+          },
+          "aggregation": {
+            "description": "The aggregation type of the metric. Only valid option is \"doc_count\"",
+            "type": "string",
+            "example": "doc_count",
+            "enum": [
+              "doc_count"
+            ]
+          },
+          "filter": {
+            "description": "The filter to apply to the metric.",
+            "type": "string",
+            "example": "processor.outcome: \"success\""
+          }
+        }
+      },
+      "indicator_properties_timeslice_metric": {
+        "title": "Timeslice metric",
+        "required": [
+          "type",
+          "params"
+        ],
+        "description": "Defines properties for a timeslice metric indicator type",
+        "type": "object",
+        "properties": {
+          "params": {
+            "description": "An object containing the indicator parameters.",
+            "type": "object",
+            "nullable": false,
+            "required": [
+              "index",
+              "timestampField",
+              "metric"
+            ],
+            "properties": {
+              "index": {
+                "description": "The index or index pattern to use",
+                "type": "string",
+                "example": "my-service-*"
+              },
+              "filter": {
+                "description": "the KQL query to filter the documents with.",
+                "type": "string",
+                "example": "field.environment : \"production\" and service.name : \"my-service\""
+              },
+              "timestampField": {
+                "description": "The timestamp field used in the source indice.\n",
+                "type": "string",
+                "example": "timestamp"
+              },
+              "metric": {
+                "description": "An object defining the metrics, equation, and threshold to determine if it's a good slice or not\n",
+                "type": "object",
+                "required": [
+                  "metrics",
+                  "equation",
+                  "comparator",
+                  "threshold"
+                ],
+                "properties": {
+                  "metrics": {
+                    "description": "List of metrics with their name, aggregation type, and field.",
+                    "type": "array",
+                    "items": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/timeslice_metric_basic_metric_with_field"
+                        },
+                        {
+                          "$ref": "#/components/schemas/timeslice_metric_percentile_metric"
+                        },
+                        {
+                          "$ref": "#/components/schemas/timeslice_metric_doc_count_metric"
+                        }
+                      ]
+                    }
+                  },
+                  "equation": {
+                    "description": "The equation to calculate the metric.",
+                    "type": "string",
+                    "example": "A"
+                  },
+                  "comparator": {
+                    "description": "The comparator to use to compare the equation to the threshold.",
+                    "type": "string",
+                    "example": "GT",
+                    "enum": [
+                      "GT",
+                      "GTE",
+                      "LT",
+                      "LTE"
+                    ]
+                  },
+                  "threshold": {
+                    "description": "The threshold used to determine if the metric is a good slice or not.",
+                    "type": "number",
+                    "example": 100
+                  }
+                }
+              }
+            }
+          },
+          "type": {
+            "description": "The type of indicator.",
+            "type": "string",
+            "example": "sli.metric.timeslice"
+          }
+        }
+      },
       "time_window": {
         "title": "Time window",
         "required": [
@@ -1427,7 +1631,8 @@
                 "sli.kql.custom": "#/components/schemas/indicator_properties_custom_kql",
                 "sli.apm.transactionDuration": "#/components/schemas/indicator_properties_apm_latency",
                 "sli.metric.custom": "#/components/schemas/indicator_properties_custom_metric",
-                "sli.histogram.custom": "#/components/schemas/indicator_properties_histogram"
+                "sli.histogram.custom": "#/components/schemas/indicator_properties_histogram",
+                "sli.metric.timeslice": "#/components/schemas/indicator_properties_timeslice_metric"
               }
             },
             "oneOf": [
@@ -1445,6 +1650,9 @@
               },
               {
                 "$ref": "#/components/schemas/indicator_properties_histogram"
+              },
+              {
+                "$ref": "#/components/schemas/indicator_properties_timeslice_metric"
               }
             ]
           },
@@ -1661,6 +1869,9 @@
               },
               {
                 "$ref": "#/components/schemas/indicator_properties_histogram"
+              },
+              {
+                "$ref": "#/components/schemas/indicator_properties_timeslice_metric"
               }
             ]
           },
@@ -1755,6 +1966,9 @@
               },
               {
                 "$ref": "#/components/schemas/indicator_properties_histogram"
+              },
+              {
+                "$ref": "#/components/schemas/indicator_properties_timeslice_metric"
               }
             ]
           },
diff --git a/x-pack/plugins/observability/docs/openapi/slo/bundled.yaml b/x-pack/plugins/observability/docs/openapi/slo/bundled.yaml
index c50403e5096f8..8efdbd9dfe2c2 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/bundled.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/bundled.yaml
@@ -837,6 +837,162 @@ components:
           description: The type of indicator.
           type: string
           example: sli.histogram.custom
+    timeslice_metric_basic_metric_with_field:
+      title: Timeslice Metric Basic Metric with Field
+      required:
+        - name
+        - aggregation
+        - field
+      type: object
+      properties:
+        name:
+          description: The name of the metric. Only valid options are A-Z
+          type: string
+          example: A
+          pattern: ^[A-Z]$
+        aggregation:
+          description: The aggregation type of the metric.
+          type: string
+          example: sum
+          enum:
+            - sum
+            - avg
+            - min
+            - max
+            - std_deviation
+            - last_value
+            - cardinality
+        field:
+          description: The field of the metric.
+          type: string
+          example: processor.processed
+        filter:
+          description: The filter to apply to the metric.
+          type: string
+          example: 'processor.outcome: "success"'
+    timeslice_metric_percentile_metric:
+      title: Timeslice Metric Percentile Metric
+      required:
+        - name
+        - aggregation
+        - field
+        - percentile
+      type: object
+      properties:
+        name:
+          description: The name of the metric. Only valid options are A-Z
+          type: string
+          example: A
+          pattern: ^[A-Z]$
+        aggregation:
+          description: The aggregation type of the metric. Only valid option is "percentile"
+          type: string
+          example: percentile
+          enum:
+            - percentile
+        field:
+          description: The field of the metric.
+          type: string
+          example: processor.processed
+        percentile:
+          description: The percentile value.
+          type: number
+          example: 95
+        filter:
+          description: The filter to apply to the metric.
+          type: string
+          example: 'processor.outcome: "success"'
+    timeslice_metric_doc_count_metric:
+      title: Timeslice Metric Doc Count Metric
+      required:
+        - name
+        - aggregation
+      type: object
+      properties:
+        name:
+          description: The name of the metric. Only valid options are A-Z
+          type: string
+          example: A
+          pattern: ^[A-Z]$
+        aggregation:
+          description: The aggregation type of the metric. Only valid option is "doc_count"
+          type: string
+          example: doc_count
+          enum:
+            - doc_count
+        filter:
+          description: The filter to apply to the metric.
+          type: string
+          example: 'processor.outcome: "success"'
+    indicator_properties_timeslice_metric:
+      title: Timeslice metric
+      required:
+        - type
+        - params
+      description: Defines properties for a timeslice metric indicator type
+      type: object
+      properties:
+        params:
+          description: An object containing the indicator parameters.
+          type: object
+          nullable: false
+          required:
+            - index
+            - timestampField
+            - metric
+          properties:
+            index:
+              description: The index or index pattern to use
+              type: string
+              example: my-service-*
+            filter:
+              description: the KQL query to filter the documents with.
+              type: string
+              example: 'field.environment : "production" and service.name : "my-service"'
+            timestampField:
+              description: |
+                The timestamp field used in the source indice.
+              type: string
+              example: timestamp
+            metric:
+              description: |
+                An object defining the metrics, equation, and threshold to determine if it's a good slice or not
+              type: object
+              required:
+                - metrics
+                - equation
+                - comparator
+                - threshold
+              properties:
+                metrics:
+                  description: List of metrics with their name, aggregation type, and field.
+                  type: array
+                  items:
+                    anyOf:
+                      - $ref: '#/components/schemas/timeslice_metric_basic_metric_with_field'
+                      - $ref: '#/components/schemas/timeslice_metric_percentile_metric'
+                      - $ref: '#/components/schemas/timeslice_metric_doc_count_metric'
+                equation:
+                  description: The equation to calculate the metric.
+                  type: string
+                  example: A
+                comparator:
+                  description: The comparator to use to compare the equation to the threshold.
+                  type: string
+                  example: GT
+                  enum:
+                    - GT
+                    - GTE
+                    - LT
+                    - LTE
+                threshold:
+                  description: The threshold used to determine if the metric is a good slice or not.
+                  type: number
+                  example: 100
+        type:
+          description: The type of indicator.
+          type: string
+          example: sli.metric.timeslice
     time_window:
       title: Time window
       required:
@@ -988,12 +1144,14 @@ components:
               sli.apm.transactionDuration: '#/components/schemas/indicator_properties_apm_latency'
               sli.metric.custom: '#/components/schemas/indicator_properties_custom_metric'
               sli.histogram.custom: '#/components/schemas/indicator_properties_histogram'
+              sli.metric.timeslice: '#/components/schemas/indicator_properties_timeslice_metric'
           oneOf:
             - $ref: '#/components/schemas/indicator_properties_custom_kql'
             - $ref: '#/components/schemas/indicator_properties_apm_availability'
             - $ref: '#/components/schemas/indicator_properties_apm_latency'
             - $ref: '#/components/schemas/indicator_properties_custom_metric'
             - $ref: '#/components/schemas/indicator_properties_histogram'
+            - $ref: '#/components/schemas/indicator_properties_timeslice_metric'
         timeWindow:
           $ref: '#/components/schemas/time_window'
         budgetingMethod:
@@ -1150,6 +1308,7 @@ components:
             - $ref: '#/components/schemas/indicator_properties_apm_latency'
             - $ref: '#/components/schemas/indicator_properties_custom_metric'
             - $ref: '#/components/schemas/indicator_properties_histogram'
+            - $ref: '#/components/schemas/indicator_properties_timeslice_metric'
         timeWindow:
           $ref: '#/components/schemas/time_window'
         budgetingMethod:
@@ -1212,6 +1371,7 @@ components:
             - $ref: '#/components/schemas/indicator_properties_apm_latency'
             - $ref: '#/components/schemas/indicator_properties_custom_metric'
             - $ref: '#/components/schemas/indicator_properties_histogram'
+            - $ref: '#/components/schemas/indicator_properties_timeslice_metric'
         timeWindow:
           $ref: '#/components/schemas/time_window'
         budgetingMethod:
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/create_slo_request.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/create_slo_request.yaml
index f14a1a134abd8..c3a848fe52133 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/create_slo_request.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/create_slo_request.yaml
@@ -27,6 +27,7 @@ properties:
       - $ref: "indicator_properties_apm_latency.yaml"
       - $ref: "indicator_properties_custom_metric.yaml"
       - $ref: 'indicator_properties_histogram.yaml'
+      - $ref: 'indicator_properties_timeslice_metric.yaml'
   timeWindow:
     $ref: "time_window.yaml"
   budgetingMethod:
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/indicator_properties_timeslice_metric.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/indicator_properties_timeslice_metric.yaml
new file mode 100644
index 0000000000000..712420f059fdd
--- /dev/null
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/indicator_properties_timeslice_metric.yaml
@@ -0,0 +1,64 @@
+title: Timeslice metric
+required:
+  - type
+  - params
+description: Defines properties for a timeslice metric indicator type
+type: object
+properties:
+  params:
+    description: An object containing the indicator parameters.
+    type: object
+    nullable: false
+    required:
+      - index
+      - timestampField
+      - metric
+    properties:
+      index:
+        description: The index or index pattern to use
+        type: string
+        example: my-service-*
+      filter:
+        description: the KQL query to filter the documents with.
+        type: string
+        example: 'field.environment : "production" and service.name : "my-service"'
+      timestampField:
+        description: >
+          The timestamp field used in the source indice.
+        type: string
+        example: timestamp
+      metric:
+        description: >
+          An object defining the metrics, equation, and threshold to determine if it's a good slice or not
+        type: object
+        required:
+          - metrics
+          - equation
+          - comparator
+          - threshold
+        properties:
+          metrics:
+            description: List of metrics with their name, aggregation type, and field.
+            type: array
+            items:
+              anyOf:
+                - $ref: './timeslice_metric_basic_metric_with_field.yaml'
+                - $ref: './timeslice_metric_percentile_metric.yaml'
+                - $ref: './timeslice_metric_doc_count_metric.yaml'
+          equation:
+            description: The equation to calculate the metric.
+            type: string
+            example: A
+          comparator:
+            description: The comparator to use to compare the equation to the threshold.
+            type: string
+            example: GT
+            enum: [GT, GTE, LT, LTE]
+          threshold:
+            description: The threshold used to determine if the metric is a good slice or not.
+            type: number
+            example: 100
+  type:
+    description: The type of indicator.
+    type: string
+    example: sli.metric.timeslice
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_response.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_response.yaml
index da81009bc20b3..bd58e88c7b641 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_response.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/slo_response.yaml
@@ -37,14 +37,16 @@ properties:
         sli.apm.transactionErrorRate: './indicator_properties_apm_availability.yaml'
         sli.kql.custom: './indicator_properties_custom_kql.yaml'
         sli.apm.transactionDuration: './indicator_properties_apm_latency.yaml'
-        sli.metric.custom: 'indicator_properties_custom_metric.yaml'
-        sli.histogram.custom: 'indicator_properties_histogram.yaml'
+        sli.metric.custom: './indicator_properties_custom_metric.yaml'
+        sli.histogram.custom: './indicator_properties_histogram.yaml'
+        sli.metric.timeslice: './indicator_properties_timeslice_metric.yaml'
     oneOf:
       - $ref: "indicator_properties_custom_kql.yaml"
       - $ref: "indicator_properties_apm_availability.yaml"
       - $ref: "indicator_properties_apm_latency.yaml"
       - $ref: "indicator_properties_custom_metric.yaml"
       - $ref: "indicator_properties_histogram.yaml"
+      - $ref: "indicator_properties_timeslice_metric.yaml"
   timeWindow:
     $ref: "time_window.yaml"
   budgetingMethod:
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_basic_metric_with_field.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_basic_metric_with_field.yaml
new file mode 100644
index 0000000000000..570f4b4dda905
--- /dev/null
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_basic_metric_with_field.yaml
@@ -0,0 +1,25 @@
+title: Timeslice Metric Basic Metric with Field
+required:
+  - name
+  - aggregation
+  - field
+type: object
+properties:
+  name:
+    description: The name of the metric. Only valid options are A-Z
+    type: string
+    example: A
+    pattern: "^[A-Z]$"
+  aggregation:
+    description: The aggregation type of the metric.
+    type: string
+    example: sum
+    enum: [sum, avg, min, max, std_deviation, last_value, cardinality]
+  field:
+    description: The field of the metric.
+    type: string
+    example: processor.processed
+  filter:
+    description: The filter to apply to the metric.
+    type: string
+    example: 'processor.outcome: "success"'
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_doc_count_metric.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_doc_count_metric.yaml
new file mode 100644
index 0000000000000..76417fd111975
--- /dev/null
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_doc_count_metric.yaml
@@ -0,0 +1,21 @@
+title: Timeslice Metric Doc Count Metric
+required:
+  - name
+  - aggregation
+type: object
+properties:
+  name:
+    description: The name of the metric. Only valid options are A-Z
+    type: string
+    example: A
+    pattern: "^[A-Z]$"
+  aggregation:
+    description: The aggregation type of the metric. Only valid option is "doc_count"
+    type: string
+    example: doc_count
+    enum: [doc_count]
+  filter:
+    description: The filter to apply to the metric.
+    type: string
+    example: 'processor.outcome: "success"'
+
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_percentile_metric.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_percentile_metric.yaml
new file mode 100644
index 0000000000000..c55b7e1c5abb8
--- /dev/null
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/timeslice_metric_percentile_metric.yaml
@@ -0,0 +1,30 @@
+title: Timeslice Metric Percentile Metric
+required:
+  - name
+  - aggregation
+  - field
+  - percentile
+type: object
+properties:
+  name:
+    description: The name of the metric. Only valid options are A-Z
+    type: string
+    example: A
+    pattern: "^[A-Z]$"
+  aggregation:
+    description: The aggregation type of the metric. Only valid option is "percentile"
+    type: string
+    example: percentile
+    enum: [percentile]
+  field:
+    description: The field of the metric.
+    type: string
+    example: processor.processed
+  percentile:
+    description: The percentile value.
+    type: number
+    example: 95
+  filter:
+    description: The filter to apply to the metric.
+    type: string
+    example: 'processor.outcome: "success"'
diff --git a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/update_slo_request.yaml b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/update_slo_request.yaml
index ddeb2e39159a3..8d2c61c7b2249 100644
--- a/x-pack/plugins/observability/docs/openapi/slo/components/schemas/update_slo_request.yaml
+++ b/x-pack/plugins/observability/docs/openapi/slo/components/schemas/update_slo_request.yaml
@@ -17,6 +17,7 @@ properties:
       - $ref: "indicator_properties_apm_latency.yaml"
       - $ref: "indicator_properties_custom_metric.yaml"
       - $ref: "indicator_properties_histogram.yaml"
+      - $ref: "indicator_properties_timeslice_metric.yaml"
   timeWindow:
     $ref: "time_window.yaml"
   budgetingMethod:
diff --git a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate_rule_editor.tsx b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate_rule_editor.tsx
index 7e0e88d6c148d..3aa7651320bc3 100644
--- a/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate_rule_editor.tsx
+++ b/x-pack/plugins/observability/public/components/burn_rate_rule_editor/burn_rate_rule_editor.tsx
@@ -31,7 +31,7 @@ type Props = Pick<
 
 export function BurnRateRuleEditor(props: Props) {
   const { setRuleParams, ruleParams, errors } = props;
-  const { isLoading: loadingInitialSlo, slo: initialSlo } = useFetchSloDetails({
+  const { isLoading: loadingInitialSlo, data: initialSlo } = useFetchSloDetails({
     sloId: ruleParams?.sloId,
   });
 
diff --git a/x-pack/plugins/observability/public/embeddable/slo/overview/slo_overview.tsx b/x-pack/plugins/observability/public/embeddable/slo/overview/slo_overview.tsx
index e190196acd794..9ee756c0235b8 100644
--- a/x-pack/plugins/observability/public/embeddable/slo/overview/slo_overview.tsx
+++ b/x-pack/plugins/observability/public/embeddable/slo/overview/slo_overview.tsx
@@ -26,7 +26,12 @@ export function SloOverview({ sloId, sloInstanceId, lastReloadRequestTime }: Emb
     application: { navigateToUrl },
     http: { basePath },
   } = useKibana().services;
-  const { isLoading, slo, refetch, isRefetching } = useFetchSloDetails({
+  const {
+    isLoading,
+    data: slo,
+    refetch,
+    isRefetching,
+  } = useFetchSloDetails({
     sloId,
     instanceId: sloInstanceId,
   });
diff --git a/x-pack/plugins/observability/public/embeddable/slo/overview/slo_selector.tsx b/x-pack/plugins/observability/public/embeddable/slo/overview/slo_selector.tsx
index 468358127bd18..8ad4985e0096d 100644
--- a/x-pack/plugins/observability/public/embeddable/slo/overview/slo_selector.tsx
+++ b/x-pack/plugins/observability/public/embeddable/slo/overview/slo_selector.tsx
@@ -26,7 +26,11 @@ export function SloSelector({ initialSlo, onSelected, hasError }: Props) {
   const [options, setOptions] = useState<Array<EuiComboBoxOptionOption<string>>>([]);
   const [selectedOptions, setSelectedOptions] = useState<Array<EuiComboBoxOptionOption<string>>>();
   const [searchValue, setSearchValue] = useState<string>('');
-  const { isInitialLoading, isLoading, sloList } = useFetchSloList({
+  const {
+    isInitialLoading,
+    isLoading,
+    data: sloList,
+  } = useFetchSloList({
     kqlQuery: `slo.name: ${searchValue.replaceAll(' ', '*')}*`,
   });
 
diff --git a/x-pack/plugins/observability/public/hooks/__storybook_mocks__/use_fetch_data_views.ts b/x-pack/plugins/observability/public/hooks/__storybook_mocks__/use_fetch_data_views.ts
new file mode 100644
index 0000000000000..5affe18c75d03
--- /dev/null
+++ b/x-pack/plugins/observability/public/hooks/__storybook_mocks__/use_fetch_data_views.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DataView } from '@kbn/data-views-plugin/public';
+import { UseFetchDataViewsResponse } from '../use_fetch_data_views';
+
+export const useFetchDataViews = (): UseFetchDataViewsResponse => {
+  return {
+    isLoading: false,
+    isError: false,
+    isSuccess: true,
+    data: Array(20)
+      .fill(0)
+      .map((_, i) => ({
+        title: `dataview-${i}`,
+        type: 'foo',
+        getName: () => `dataview-${i}`,
+        getIndexPattern: () => `.index-pattern-dataview-${i}`,
+      })) as DataView[],
+  };
+};
diff --git a/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_slo_list.ts b/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_slo_list.ts
index 2faa0887b82ea..4e7d1889e5bb0 100644
--- a/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_slo_list.ts
+++ b/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_slo_list.ts
@@ -15,7 +15,7 @@ export const useFetchSloList = (): UseFetchSloListResponse => {
     isRefetching: false,
     isError: false,
     isSuccess: true,
-    sloList,
+    data: sloList,
     refetch: function () {} as UseFetchSloListResponse['refetch'],
   };
 };
diff --git a/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_details.ts b/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_details.ts
index 38f980ee1bdc9..ad5511433522e 100644
--- a/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_details.ts
+++ b/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_details.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
+import { ALL_VALUE, GetSLOResponse } from '@kbn/slo-schema';
 import {
   QueryObserverResult,
   RefetchOptions,
   RefetchQueryFilters,
   useQuery,
 } from '@tanstack/react-query';
-import { ALL_VALUE, GetSLOResponse, SLOWithSummaryResponse } from '@kbn/slo-schema';
 import { useKibana } from '../../utils/kibana_react';
 import { sloKeys } from './query_key_factory';
 
@@ -21,7 +21,7 @@ export interface UseFetchSloDetailsResponse {
   isRefetching: boolean;
   isSuccess: boolean;
   isError: boolean;
-  slo: SLOWithSummaryResponse | undefined;
+  data: GetSLOResponse | undefined;
   refetch: <TPageData>(
     options?: (RefetchOptions & RefetchQueryFilters<TPageData>) | undefined
   ) => Promise<QueryObserverResult<GetSLOResponse | undefined, unknown>>;
@@ -65,7 +65,7 @@ export function useFetchSloDetails({
   );
 
   return {
-    slo: data,
+    data,
     isLoading,
     isInitialLoading,
     isRefetching,
diff --git a/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_list.ts b/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_list.ts
index 22a918eb23127..f97c2398b8efc 100644
--- a/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_list.ts
+++ b/x-pack/plugins/observability/public/hooks/slo/use_fetch_slo_list.ts
@@ -33,7 +33,7 @@ export interface UseFetchSloListResponse {
   isRefetching: boolean;
   isSuccess: boolean;
   isError: boolean;
-  sloList: FindSLOResponse | undefined;
+  data: FindSLOResponse | undefined;
   refetch: <TPageData>(
     options?: (RefetchOptions & RefetchQueryFilters<TPageData>) | undefined
   ) => Promise<QueryObserverResult<FindSLOResponse | undefined, unknown>>;
@@ -48,36 +48,29 @@ export function useFetchSloList({
   sortBy = 'status',
   sortDirection = 'desc',
   shouldRefetch,
-}: SLOListParams | undefined = {}): UseFetchSloListResponse {
+}: SLOListParams = {}): UseFetchSloListResponse {
   const {
     http,
     notifications: { toasts },
   } = useKibana().services;
   const queryClient = useQueryClient();
-
-  const [stateRefetchInterval, setStateRefetchInterval] = useState<number | undefined>(
-    SHORT_REFETCH_INTERVAL
-  );
+  const [stateRefetchInterval, setStateRefetchInterval] = useState<number>(SHORT_REFETCH_INTERVAL);
 
   const { isInitialLoading, isLoading, isError, isSuccess, isRefetching, data, refetch } = useQuery(
     {
       queryKey: sloKeys.list({ kqlQuery, page, sortBy, sortDirection }),
       queryFn: async ({ signal }) => {
-        try {
-          const response = await http.get<FindSLOResponse>(`/api/observability/slos`, {
-            query: {
-              ...(kqlQuery && { kqlQuery }),
-              ...(sortBy && { sortBy }),
-              ...(sortDirection && { sortDirection }),
-              ...(page && { page }),
-            },
-            signal,
-          });
+        const response = await http.get<FindSLOResponse>(`/api/observability/slos`, {
+          query: {
+            ...(kqlQuery && { kqlQuery }),
+            ...(sortBy && { sortBy }),
+            ...(sortDirection && { sortDirection }),
+            ...(page && { page }),
+          },
+          signal,
+        });
 
-          return response;
-        } catch (error) {
-          throw error;
-        }
+        return response;
       },
       keepPreviousData: true,
       refetchOnWindowFocus: false,
@@ -115,7 +108,7 @@ export function useFetchSloList({
   );
 
   return {
-    sloList: data,
+    data,
     isInitialLoading,
     isLoading,
     isRefetching,
diff --git a/x-pack/plugins/observability/public/hooks/use_fetch_data_views.ts b/x-pack/plugins/observability/public/hooks/use_fetch_data_views.ts
index 1da32948e2e50..bff276181e95f 100644
--- a/x-pack/plugins/observability/public/hooks/use_fetch_data_views.ts
+++ b/x-pack/plugins/observability/public/hooks/use_fetch_data_views.ts
@@ -5,12 +5,7 @@
  * 2.0.
  */
 
-import {
-  QueryObserverResult,
-  RefetchOptions,
-  RefetchQueryFilters,
-  useQuery,
-} from '@tanstack/react-query';
+import { useQuery } from '@tanstack/react-query';
 import { DataView } from '@kbn/data-views-plugin/public';
 import { useKibana } from '../utils/kibana_react';
 
@@ -19,9 +14,6 @@ export interface UseFetchDataViewsResponse {
   isSuccess: boolean;
   isError: boolean;
   data: DataView[] | undefined;
-  refetch: <TPageData>(
-    options?: (RefetchOptions & RefetchQueryFilters<TPageData>) | undefined
-  ) => Promise<QueryObserverResult<DataView[], unknown>>;
 }
 
 interface Params {
@@ -33,16 +25,15 @@ export function useFetchDataViews({ name = '', size = 10 }: Params): UseFetchDat
   const { dataViews } = useKibana().services;
   const search = name.endsWith('*') ? name : `${name}*`;
 
-  const { isLoading, isError, isSuccess, data, refetch } = useQuery({
+  const { isLoading, isError, isSuccess, data } = useQuery({
     queryKey: ['fetchDataViews', search],
     queryFn: async () => {
-      try {
-        return await dataViews.find(search, size);
-      } catch (error) {
-        throw new Error(`Something went wrong. Error: ${error}`);
-      }
+      return dataViews.find(search, size);
     },
+    retry: false,
+    keepPreviousData: true,
+    refetchOnWindowFocus: false,
   });
 
-  return { isLoading, isError, isSuccess, data, refetch };
+  return { isLoading, isError, isSuccess, data };
 }
diff --git a/x-pack/plugins/observability/public/hooks/use_fetch_indices.ts b/x-pack/plugins/observability/public/hooks/use_fetch_indices.ts
index 2d622a702a839..bd5aae9c30df8 100644
--- a/x-pack/plugins/observability/public/hooks/use_fetch_indices.ts
+++ b/x-pack/plugins/observability/public/hooks/use_fetch_indices.ts
@@ -32,18 +32,15 @@ export function useFetchIndices({ search }: Params): UseFetchIndicesResponse {
     queryKey: ['fetchIndices', search],
     queryFn: async () => {
       const searchPattern = search?.endsWith('*') ? search : `${search}*`;
-      try {
-        const response = await http.get<ResolveIndexReponse>(
-          `/internal/index-pattern-management/resolve_index/${searchPattern}`
-        );
-        return response.indices.map((index) => index.name);
-      } catch (error) {
-        throw new Error(`Something went wrong. Error: ${error}`);
-      }
+      const response = await http.get<ResolveIndexReponse>(
+        `/internal/index-pattern-management/resolve_index/${searchPattern}`
+      );
+      return response.indices.map((index) => index.name);
     },
     retry: false,
     enabled: Boolean(search),
     refetchOnWindowFocus: false,
+    keepPreviousData: true,
   });
 
   return { isLoading, isError, isSuccess, data };
diff --git a/x-pack/plugins/observability/public/pages/overview/components/sections/metrics/metric_with_sparkline.tsx b/x-pack/plugins/observability/public/pages/overview/components/sections/metrics/metric_with_sparkline.tsx
index 56e518e835c43..bbd3b9acd224c 100644
--- a/x-pack/plugins/observability/public/pages/overview/components/sections/metrics/metric_with_sparkline.tsx
+++ b/x-pack/plugins/observability/public/pages/overview/components/sections/metrics/metric_with_sparkline.tsx
@@ -8,6 +8,7 @@
 import { Chart, Settings, AreaSeries, TooltipType, Tooltip } from '@elastic/charts';
 import { EuiFlexItem, EuiFlexGroup, EuiIcon, EuiTextColor } from '@elastic/eui';
 import React, { useContext } from 'react';
+import { FormattedMessage } from '@kbn/i18n-react';
 import {
   EUI_CHARTS_THEME_DARK,
   EUI_CHARTS_THEME_LIGHT,
@@ -39,7 +40,11 @@ export function MetricWithSparkline({ id, formatter, value, timeseries, color }:
     return (
       <EuiTextColor color="subdued">
         <EuiIcon type="visLine" />
-        &nbsp;N/A
+         
+        <FormattedMessage
+          id="xpack.observability.metricWithSparkline.nATextColorLabel"
+          defaultMessage="N/A"
+        />
       </EuiTextColor>
     );
   }
diff --git a/x-pack/plugins/observability/public/pages/slo_details/components/overview/overview.tsx b/x-pack/plugins/observability/public/pages/slo_details/components/overview/overview.tsx
index f3a6abb829984..03d76b8dc2a7d 100644
--- a/x-pack/plugins/observability/public/pages/slo_details/components/overview/overview.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_details/components/overview/overview.tsx
@@ -94,16 +94,26 @@ export function Overview({ slo }: Props) {
             ) : (
               <EuiText size="s">
                 {BUDGETING_METHOD_TIMESLICES} (
-                {i18n.translate(
-                  'xpack.observability.slo.sloDetails.overview.timeslicesBudgetingMethodDetails',
-                  {
-                    defaultMessage: '{duration} slices, {target} target',
-                    values: {
-                      duration: toDurationLabel(slo.objective.timesliceWindow!),
-                      target: numeral(slo.objective.timesliceTarget!).format(percentFormat),
-                    },
-                  }
-                )}
+                {slo.indicator.type === 'sli.metric.timeslice'
+                  ? i18n.translate(
+                      'xpack.observability.slo.sloDetails.overview.timeslicesBudgetingMethodDetailsForTimesliceMetric',
+                      {
+                        defaultMessage: '{duration} slices',
+                        values: {
+                          duration: toDurationLabel(slo.objective.timesliceWindow!),
+                        },
+                      }
+                    )
+                  : i18n.translate(
+                      'xpack.observability.slo.sloDetails.overview.timeslicesBudgetingMethodDetails',
+                      {
+                        defaultMessage: '{duration} slices, {target} target',
+                        values: {
+                          duration: toDurationLabel(slo.objective.timesliceWindow!),
+                          target: numeral(slo.objective.timesliceTarget!).format(percentFormat),
+                        },
+                      }
+                    )}
                 )
               </EuiText>
             )
diff --git a/x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx b/x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx
index 5dad78763fe04..f31d36c822264 100644
--- a/x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_details/slo_details.test.tsx
@@ -124,7 +124,7 @@ describe('SLO Details Page', () => {
     it('navigates to the SLO List page', async () => {
       const slo = buildSlo();
       useParamsMock.mockReturnValue(slo.id);
-      useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+      useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
       useLicenseMock.mockReturnValue({ hasAtLeast: () => false });
 
       render(<SloDetailsPage />);
@@ -135,7 +135,7 @@ describe('SLO Details Page', () => {
 
   it('renders the PageNotFound when the SLO cannot be found', async () => {
     useParamsMock.mockReturnValue('nonexistent');
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo: undefined });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: undefined });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
     render(<SloDetailsPage />);
@@ -146,7 +146,7 @@ describe('SLO Details Page', () => {
   it('renders the loading spinner when fetching the SLO', async () => {
     const slo = buildSlo();
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: true, slo: undefined });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: true, data: undefined });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
     render(<SloDetailsPage />);
@@ -159,7 +159,7 @@ describe('SLO Details Page', () => {
   it('renders the SLO details page with loading charts when summary data is loading', async () => {
     const slo = buildSlo({ id: HEALTHY_STEP_DOWN_ROLLING_SLO });
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
     useFetchHistoricalSummaryMock.mockReturnValue({
       isLoading: true,
@@ -178,7 +178,7 @@ describe('SLO Details Page', () => {
   it('renders the SLO details page with the overview and chart panels', async () => {
     const slo = buildSlo({ id: HEALTHY_STEP_DOWN_ROLLING_SLO });
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
     render(<SloDetailsPage />);
@@ -194,7 +194,7 @@ describe('SLO Details Page', () => {
   it("renders a 'Edit' button under actions menu", async () => {
     const slo = buildSlo();
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
     render(<SloDetailsPage />);
@@ -206,7 +206,7 @@ describe('SLO Details Page', () => {
   it("renders a 'Create alert rule' button under actions menu", async () => {
     const slo = buildSlo();
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
     render(<SloDetailsPage />);
@@ -218,7 +218,7 @@ describe('SLO Details Page', () => {
   it("renders a 'Manage rules' button under actions menu", async () => {
     const slo = buildSlo();
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
     render(<SloDetailsPage />);
@@ -230,7 +230,7 @@ describe('SLO Details Page', () => {
   it("renders a 'Clone' button under actions menu", async () => {
     const slo = buildSlo();
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
     render(<SloDetailsPage />);
@@ -271,7 +271,7 @@ describe('SLO Details Page', () => {
   it("renders a 'Delete' button under actions menu", async () => {
     const slo = buildSlo();
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
     render(<SloDetailsPage />);
@@ -301,7 +301,7 @@ describe('SLO Details Page', () => {
   it('renders the Overview tab by default', async () => {
     const slo = buildSlo();
     useParamsMock.mockReturnValue(slo.id);
-    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+    useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
     useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
     useFetchActiveAlertsMock.mockReturnValue({
       isLoading: false,
@@ -320,7 +320,7 @@ describe('SLO Details Page', () => {
     it("renders a 'Explore in APM' button under actions menu", async () => {
       const slo = buildSlo({ indicator: buildApmAvailabilityIndicator() });
       useParamsMock.mockReturnValue(slo.id);
-      useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+      useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
       useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
       render(<SloDetailsPage />);
@@ -334,7 +334,7 @@ describe('SLO Details Page', () => {
     it("does not render a 'Explore in APM' button under actions menu", async () => {
       const slo = buildSlo();
       useParamsMock.mockReturnValue(slo.id);
-      useFetchSloDetailsMock.mockReturnValue({ isLoading: false, slo });
+      useFetchSloDetailsMock.mockReturnValue({ isLoading: false, data: slo });
       useLicenseMock.mockReturnValue({ hasAtLeast: () => true });
 
       render(<SloDetailsPage />);
diff --git a/x-pack/plugins/observability/public/pages/slo_details/slo_details.tsx b/x-pack/plugins/observability/public/pages/slo_details/slo_details.tsx
index 6b50fbde29268..195cb164e5197 100644
--- a/x-pack/plugins/observability/public/pages/slo_details/slo_details.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_details/slo_details.tsx
@@ -45,7 +45,7 @@ export function SloDetailsPage() {
   const sloInstanceId = useGetInstanceIdQueryParam();
   const { storeAutoRefreshState, getAutoRefreshState } = useAutoRefreshStorage();
   const [isAutoRefreshing, setIsAutoRefreshing] = useState(getAutoRefreshState());
-  const { isLoading, slo } = useFetchSloDetails({
+  const { isLoading, data: slo } = useFetchSloDetails({
     sloId,
     instanceId: sloInstanceId,
     shouldRefetch: isAutoRefreshing,
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/common/data_preview_chart.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/common/data_preview_chart.tsx
index 8f6fe11cae333..7dc2e00f60829 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/components/common/data_preview_chart.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/common/data_preview_chart.tsx
@@ -5,7 +5,18 @@
  * 2.0.
  */
 
-import { AreaSeries, Axis, Chart, Position, ScaleType, Settings, Tooltip } from '@elastic/charts';
+import {
+  AnnotationDomainType,
+  AreaSeries,
+  Axis,
+  Chart,
+  LineAnnotation,
+  Position,
+  RectAnnotation,
+  ScaleType,
+  Settings,
+  Tooltip,
+} from '@elastic/charts';
 import {
   EuiFlexGroup,
   EuiFlexItem,
@@ -22,12 +33,27 @@ import moment from 'moment';
 import React from 'react';
 import { useFormContext } from 'react-hook-form';
 import { FormattedMessage } from '@kbn/i18n-react';
+import { min, max } from 'lodash';
 import { useKibana } from '../../../../utils/kibana_react';
 import { useDebouncedGetPreviewData } from '../../hooks/use_preview';
 import { useSectionFormValidation } from '../../hooks/use_section_form_validation';
 import { CreateSLOForm } from '../../types';
 
-export function DataPreviewChart() {
+interface DataPreviewChartProps {
+  formatPattern?: string;
+  threshold?: number;
+  thresholdDirection?: 'above' | 'below';
+  thresholdColor?: string;
+  thresholdMessage?: string;
+}
+
+export function DataPreviewChart({
+  formatPattern,
+  threshold,
+  thresholdDirection,
+  thresholdColor,
+  thresholdMessage,
+}: DataPreviewChartProps) {
   const { watch, getFieldState, formState, getValues } = useFormContext<CreateSLOForm>();
   const { charts, uiSettings } = useKibana().services;
   const { isIndicatorSectionValid } = useSectionFormValidation({
@@ -47,7 +73,22 @@ export function DataPreviewChart() {
   const theme = charts.theme.useChartsTheme();
   const baseTheme = charts.theme.useChartsBaseTheme();
   const dateFormat = uiSettings.get('dateFormat');
-  const percentFormat = uiSettings.get('format:percent:defaultPattern');
+  const numberFormat =
+    formatPattern != null
+      ? formatPattern
+      : (uiSettings.get('format:percent:defaultPattern') as string);
+
+  const values = (previewData || []).map((row) => row.sliValue);
+  const maxValue = max(values);
+  const minValue = min(values);
+  const domain = {
+    fit: true,
+    min:
+      threshold != null && minValue != null && threshold < minValue ? threshold : minValue || NaN,
+    max:
+      threshold != null && maxValue != null && threshold > maxValue ? threshold : maxValue || NaN,
+  };
+
   const title = (
     <>
       <EuiTitle size="xs">
@@ -85,6 +126,39 @@ export function DataPreviewChart() {
     );
   }
 
+  const annotation = threshold != null && (
+    <>
+      <LineAnnotation
+        id="thresholdAnnotation"
+        domainType={AnnotationDomainType.YDomain}
+        dataValues={[{ dataValue: threshold }]}
+        style={{
+          line: {
+            strokeWidth: 2,
+            stroke: thresholdColor || '#000',
+            opacity: 1,
+          },
+        }}
+      />
+      <RectAnnotation
+        dataValues={[
+          {
+            coordinates:
+              thresholdDirection === 'above'
+                ? {
+                    y0: threshold,
+                    y1: maxValue,
+                  }
+                : { y0: minValue, y1: threshold },
+            details: thresholdMessage,
+          },
+        ]}
+        id="thresholdShade"
+        style={{ fill: thresholdColor || '#000', opacity: 0.1 }}
+      />
+    </>
+  );
+
   return (
     <EuiFlexItem>
       {title}
@@ -127,6 +201,8 @@ export function DataPreviewChart() {
                 locale={i18n.getLocale()}
               />
 
+              {annotation}
+
               <Axis
                 id="y-axis"
                 title={i18n.translate('xpack.observability.slo.sloEdit.dataPreviewChart.yTitle', {
@@ -134,12 +210,8 @@ export function DataPreviewChart() {
                 })}
                 ticks={5}
                 position={Position.Left}
-                tickFormat={(d) => numeral(d).format(percentFormat)}
-                domain={{
-                  fit: true,
-                  min: NaN,
-                  max: NaN,
-                }}
+                tickFormat={(d) => numeral(d).format(numberFormat)}
+                domain={domain}
               />
 
               <Axis
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/custom_common/index_selection.stories.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/custom_common/index_selection.stories.tsx
index b5f4848fe303d..4b8dce62f43bb 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/components/custom_common/index_selection.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/custom_common/index_selection.stories.tsx
@@ -15,7 +15,7 @@ import { SLO_EDIT_FORM_DEFAULT_VALUES } from '../../constants';
 
 export default {
   component: Component,
-  title: 'app/SLO/EditPage/CustomKQL/IndexSelection',
+  title: 'app/SLO/EditPage/Common/IndexSelection',
   decorators: [KibanaReactStorybookDecorator],
 };
 
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/custom_common/index_selection.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/custom_common/index_selection.tsx
index 7dda62122b1b4..b0fe712052191 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/components/custom_common/index_selection.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/custom_common/index_selection.tsx
@@ -9,7 +9,7 @@ import { EuiComboBox, EuiComboBoxOptionOption, EuiFormRow } from '@elastic/eui';
 import { DataView } from '@kbn/data-views-plugin/public';
 import { i18n } from '@kbn/i18n';
 import { debounce } from 'lodash';
-import React, { useEffect, useMemo, useState } from 'react';
+import React, { useState } from 'react';
 import { Controller, useFormContext } from 'react-hook-form';
 import { useFetchDataViews } from '../../../../hooks/use_fetch_data_views';
 import { useFetchIndices } from '../../../../hooks/use_fetch_indices';
@@ -22,10 +22,7 @@ interface Option {
 
 export function IndexSelection() {
   const { control, getFieldState } = useFormContext<CreateSLOForm>();
-
   const [searchValue, setSearchValue] = useState<string>('');
-  const [dataViewOptions, setDataViewOptions] = useState<Option[]>([]);
-  const [indexPatternOption, setIndexPatternOption] = useState<Option | undefined>();
 
   const { isLoading: isIndicesLoading, data: indices = [] } = useFetchIndices({
     search: searchValue,
@@ -34,54 +31,19 @@ export function IndexSelection() {
     name: searchValue,
   });
 
-  useEffect(() => {
-    if (dataViews.length > 0) {
-      setDataViewOptions(createDataViewOptions(dataViews));
-    }
-  }, [dataViews]);
+  const options: Option[] = [];
+  if (!isDataViewsLoading && dataViews.length > 0) {
+    options.push(createDataViewsOption(dataViews));
+  }
+  if (!isIndicesLoading && !!searchValue) {
+    options.push(createIndexPatternOption(searchValue, indices));
+  }
 
-  useEffect(() => {
-    if (indices.length === 0) {
-      setIndexPatternOption(undefined);
-    } else if (!!searchValue) {
-      const searchPattern = searchValue.endsWith('*') ? searchValue : `${searchValue}*`;
+  const onSearchChange = debounce((value: string) => setSearchValue(value), 300);
 
-      setIndexPatternOption({
-        label: i18n.translate(
-          'xpack.observability.slo.sloEdit.customKql.indexSelection.indexPatternLabel',
-          { defaultMessage: 'Use the index pattern' }
-        ),
-        options: [
-          {
-            value: searchPattern,
-            label: i18n.translate(
-              'xpack.observability.slo.sloEdit.customKql.indexSelection.indexPatternFoundLabel',
-              {
-                defaultMessage:
-                  '{searchPattern} (match {num, plural, one {# index} other {# indices}})',
-                values: {
-                  searchPattern,
-                  num: indices.length,
-                },
-              }
-            ),
-          },
-        ],
-      });
-    }
-  }, [indices.length, searchValue]);
-
-  const onDataViewSearchChange = useMemo(
-    () => debounce((value: string) => setSearchValue(value), 300),
-    []
-  );
-
-  const placeholder = i18n.translate(
-    'xpack.observability.slo.sloEdit.customKql.indexSelection.placeholder',
-    {
-      defaultMessage: 'Select a Data View or use an index pattern',
-    }
-  );
+  const placeholder = i18n.translate('xpack.observability.slo.sloEdit.indexSelection.placeholder', {
+    defaultMessage: 'Select an index pattern',
+  });
 
   return (
     <EuiFormRow
@@ -90,9 +52,7 @@ export function IndexSelection() {
       })}
       helpText={i18n.translate(
         'xpack.observability.slo.sloEdit.customKql.indexSelection.helpText',
-        {
-          defaultMessage: 'Use * to broaden your query.',
-        }
+        { defaultMessage: 'Use * to broaden your query.' }
       )}
       isInvalid={getFieldState('indicator.params.index').invalid}
     >
@@ -110,6 +70,7 @@ export function IndexSelection() {
             isClearable
             isInvalid={fieldState.invalid}
             isLoading={isIndicesLoading && isDataViewsLoading}
+            placeholder={placeholder}
             onChange={(selected: EuiComboBoxOptionOption[]) => {
               if (selected.length) {
                 return field.onChange(selected[0].value);
@@ -117,13 +78,18 @@ export function IndexSelection() {
 
               field.onChange('');
             }}
-            onSearchChange={onDataViewSearchChange}
-            options={
-              indexPatternOption ? [...dataViewOptions, indexPatternOption] : dataViewOptions
-            }
-            placeholder={placeholder}
+            options={options}
+            onSearchChange={onSearchChange}
             selectedOptions={
-              !!field.value ? [findSelectedIndexPattern(dataViews, field.value)] : []
+              !!field.value
+                ? [
+                    {
+                      value: field.value,
+                      label: field.value,
+                      'data-test-subj': 'indexSelectionSelectedValue',
+                    },
+                  ]
+                : []
             }
             singleSelection
           />
@@ -133,42 +99,50 @@ export function IndexSelection() {
   );
 }
 
-function findSelectedIndexPattern(dataViews: DataView[], indexPattern: string) {
-  const selectedDataView = dataViews.find((view) => view.getIndexPattern() === indexPattern);
-  if (selectedDataView) {
-    return {
-      value: selectedDataView.getIndexPattern(),
-      label: createDataViewLabel(selectedDataView),
-      'data-test-subj': 'indexSelectionSelectedValue',
-    };
-  }
-
-  return {
-    value: indexPattern,
-    label: indexPattern,
-    'data-test-subj': 'indexSelectionSelectedValue',
-  };
-}
-
 function createDataViewLabel(dataView: DataView) {
   return `${dataView.getName()} (${dataView.getIndexPattern()})`;
 }
 
-function createDataViewOptions(dataViews: DataView[]): Option[] {
-  const options = [];
-
-  options.push({
-    label: i18n.translate(
-      'xpack.observability.slo.sloEdit.customKql.indexSelection.dataViewOptionsLabel',
-      { defaultMessage: 'Select an existing Data View' }
-    ),
+function createDataViewsOption(dataViews: DataView[]): Option {
+  return {
+    label: i18n.translate('xpack.observability.slo.sloEdit.indexSelection.dataViewOptionsLabel', {
+      defaultMessage: 'Select an index pattern from an existing Data View',
+    }),
     options: dataViews
       .map((view) => ({
         label: createDataViewLabel(view),
         value: view.getIndexPattern(),
       }))
       .sort((a, b) => String(a.label).localeCompare(b.label)),
-  });
+  };
+}
+
+function createIndexPatternOption(searchValue: string, indices: string[]): Option {
+  const indexPattern = searchValue.endsWith('*') ? searchValue : `${searchValue}*`;
+  const hasMatchingIndices = indices.length > 0;
 
-  return options;
+  return {
+    label: i18n.translate(
+      'xpack.observability.slo.sloEdit.customKql.indexSelection.indexPatternLabel',
+      { defaultMessage: 'Use the index pattern' }
+    ),
+    options: [
+      {
+        value: indexPattern,
+        label: hasMatchingIndices
+          ? i18n.translate(
+              'xpack.observability.slo.sloEdit.customKql.indexSelection.indexPatternFoundLabel',
+              {
+                defaultMessage:
+                  '{searchPattern} (match {num, plural, one {# index} other {# indices}})',
+                values: { searchPattern: indexPattern, num: indices.length },
+              }
+            )
+          : i18n.translate(
+              'xpack.observability.slo.sloEdit.indexSelection.indexPatternNoMatchLabel',
+              { defaultMessage: '{searchPattern}', values: { searchPattern: indexPattern } }
+            ),
+      },
+    ],
+  };
 }
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/custom_metric/metric_indicator.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/custom_metric/metric_indicator.tsx
index 0c1fbce49d64e..ec413f46df5dd 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/components/custom_metric/metric_indicator.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/custom_metric/metric_indicator.tsx
@@ -101,8 +101,8 @@ export function MetricIndicator({ type, metricFields, isLoadingIndex }: MetricIn
   const equation = watch(`indicator.params.${type}.equation`);
   const indexPattern = watch('indicator.params.index');
 
-  const disableAdd = fields?.length === MAX_VARIABLES;
-  const disableDelete = fields?.length === 1;
+  const disableAdd = fields?.length === MAX_VARIABLES || !indexPattern;
+  const disableDelete = fields?.length === 1 || !indexPattern;
 
   const setDefaultEquationIfUnchanged = (previousNames: string[], nextNames: string[]) => {
     const defaultEquation = createEquationFromMetric(previousNames);
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_indicator_section.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_indicator_section.tsx
index 1be3a5b10e537..3c87168792303 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_indicator_section.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_indicator_section.tsx
@@ -18,6 +18,7 @@ import { CustomKqlIndicatorTypeForm } from './custom_kql/custom_kql_indicator_ty
 import { CustomMetricIndicatorTypeForm } from './custom_metric/custom_metric_type_form';
 import { HistogramIndicatorTypeForm } from './histogram/histogram_indicator_type_form';
 import { maxWidth } from './slo_edit_form';
+import { TimesliceMetricIndicatorTypeForm } from './timeslice_metric/timeslice_metric_indicator';
 
 interface SloEditFormIndicatorSectionProps {
   isEditMode: boolean;
@@ -39,6 +40,8 @@ export function SloEditFormIndicatorSection({ isEditMode }: SloEditFormIndicator
         return <CustomMetricIndicatorTypeForm />;
       case 'sli.histogram.custom':
         return <HistogramIndicatorTypeForm />;
+      case 'sli.metric.timeslice':
+        return <TimesliceMetricIndicatorTypeForm />;
       default:
         return null;
     }
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_objective_section.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_objective_section.tsx
index 951e879f43cf1..ad1f84183a138 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_objective_section.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_objective_section.tsx
@@ -6,6 +6,7 @@
  */
 
 import {
+  EuiCallOut,
   EuiFieldNumber,
   EuiFlexGrid,
   EuiFlexItem,
@@ -20,6 +21,7 @@ import { i18n } from '@kbn/i18n';
 import { TimeWindow } from '@kbn/slo-schema';
 import React, { useEffect, useState } from 'react';
 import { Controller, useFormContext } from 'react-hook-form';
+import { FormattedMessage } from '@kbn/i18n-react';
 import {
   BUDGETING_METHOD_OPTIONS,
   CALENDARALIGNED_TIMEWINDOW_OPTIONS,
@@ -42,6 +44,7 @@ export function SloEditFormObjectiveSection() {
   const timeWindowTypeSelect = useGeneratedHtmlId({ prefix: 'timeWindowTypeSelect' });
   const timeWindowSelect = useGeneratedHtmlId({ prefix: 'timeWindowSelect' });
   const timeWindowType = watch('timeWindow.type');
+  const indicator = watch('indicator.type');
 
   const [timeWindowTypeState, setTimeWindowTypeState] = useState<TimeWindow | undefined>(
     defaultValues?.timeWindow?.type
@@ -169,6 +172,19 @@ export function SloEditFormObjectiveSection() {
       </EuiFlexGrid>
 
       <EuiSpacer size="l" />
+      {indicator === 'sli.metric.timeslice' && (
+        <EuiFlexItem>
+          <EuiCallOut color="warning">
+            <p>
+              <FormattedMessage
+                id="xpack.observability.slo.sloEdit.sliType.timesliceMetric.objectiveMessage"
+                defaultMessage="The timeslice metric requires the budgeting method to be set to 'Timeslices' due to the nature of the statistical aggregations. The 'timeslice target' is also ignored in favor of the 'threshold' set in the metric definition above. The 'timeslice window' will set the size of the window the aggregation is performed on."
+              />
+            </p>
+          </EuiCallOut>
+          <EuiSpacer size="l" />
+        </EuiFlexItem>
+      )}
 
       <EuiFlexGrid columns={3}>
         <EuiFlexItem>
@@ -198,6 +214,7 @@ export function SloEditFormObjectiveSection() {
               render={({ field: { ref, ...field } }) => (
                 <EuiSelect
                   {...field}
+                  disabled={indicator === 'sli.metric.timeslice'}
                   required
                   id={budgetingSelect}
                   data-test-subj="sloFormBudgetingMethodSelect"
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_objective_section_timeslices.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_objective_section_timeslices.tsx
index 2d2648290ba8a..09da4ff9b3222 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_objective_section_timeslices.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/slo_edit_form_objective_section_timeslices.tsx
@@ -12,7 +12,8 @@ import { Controller, useFormContext } from 'react-hook-form';
 import { CreateSLOForm } from '../types';
 
 export function SloEditFormObjectiveSectionTimeslices() {
-  const { control, getFieldState } = useFormContext<CreateSLOForm>();
+  const { control, getFieldState, watch } = useFormContext<CreateSLOForm>();
+  const indicator = watch('indicator.type');
 
   return (
     <>
@@ -47,6 +48,7 @@ export function SloEditFormObjectiveSectionTimeslices() {
               <EuiFieldNumber
                 {...field}
                 required
+                disabled={indicator === 'sli.metric.timeslice'}
                 isInvalid={fieldState.invalid}
                 value={field.value}
                 data-test-subj="sloFormObjectiveTimesliceTargetInput"
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/metric_indicator.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/metric_indicator.tsx
new file mode 100644
index 0000000000000..14cce99bb5d86
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/metric_indicator.tsx
@@ -0,0 +1,303 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import {
+  EuiButtonEmpty,
+  EuiButtonIcon,
+  EuiFieldNumber,
+  EuiFieldText,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiIconTip,
+  EuiSelect,
+  EuiSpacer,
+  EuiText,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { first, range, xor } from 'lodash';
+import React from 'react';
+import { Controller, useFieldArray, useFormContext } from 'react-hook-form';
+import { Field } from '../../../../hooks/slo/use_fetch_index_pattern_fields';
+import { COMPARATOR_OPTIONS } from '../../constants';
+import { CreateSLOForm } from '../../types';
+import { MetricInput } from './metric_input';
+
+interface MetricIndicatorProps {
+  indexFields: Field[];
+  isLoadingIndex: boolean;
+}
+
+export const NEW_TIMESLICE_METRIC = { name: 'A', aggregation: 'avg' as const, field: '' };
+const MAX_VARIABLES = 26;
+const CHAR_CODE_FOR_A = 65;
+const CHAR_CODE_FOR_Z = CHAR_CODE_FOR_A + MAX_VARIABLES;
+const VAR_NAMES = range(CHAR_CODE_FOR_A, CHAR_CODE_FOR_Z).map((c) => String.fromCharCode(c));
+const INVALID_EQUATION_REGEX = /[^A-Z|+|\-|\s|\d+|\.|\(|\)|\/|\*|>|<|=|\?|\:|&|\!|\|]+/;
+
+const validateEquation = (value: string) => {
+  const result = value.match(INVALID_EQUATION_REGEX);
+  return result === null;
+};
+
+function createEquationFromMetric(names: string[]) {
+  return names.join(' + ');
+}
+
+const equationLabel = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.equationLabel',
+  { defaultMessage: 'Equation' }
+);
+
+const equationTooltip = (
+  <EuiIconTip
+    content={i18n.translate(
+      'xpack.observability.slo.sloEdit.sliType.timesliceMetric.totalEquation.tooltip',
+      {
+        defaultMessage: 'This supports basic math (A + B / C) and boolean logic (A < B ? A : B).',
+      }
+    )}
+    position="top"
+  />
+);
+
+const thresholdLabel = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.thresholdLabel',
+  {
+    defaultMessage: 'Threshold',
+  }
+);
+
+const thresholdTooltip = (
+  <EuiIconTip
+    content={i18n.translate(
+      'xpack.observability.slo.sloEdit.sliType.timesliceMetric.threshold.tooltip',
+      {
+        defaultMessage:
+          'This value combined with the comparator will determine if the slice is "good" or "bad".',
+      }
+    )}
+    position="top"
+  />
+);
+
+export function MetricIndicator({ indexFields, isLoadingIndex }: MetricIndicatorProps) {
+  const { control, watch, setValue, register, getFieldState } = useFormContext<CreateSLOForm>();
+
+  const { fields, append, remove } = useFieldArray({
+    control,
+    name: `indicator.params.metric.metrics`,
+  });
+  const equation = watch(`indicator.params.metric.equation`);
+  const indexPattern = watch('indicator.params.index');
+
+  const disableAdd = fields?.length === MAX_VARIABLES || !indexPattern;
+  const disableDelete = fields?.length === 1 || !indexPattern;
+
+  const setDefaultEquationIfUnchanged = (previousNames: string[], nextNames: string[]) => {
+    const defaultEquation = createEquationFromMetric(previousNames);
+    if (defaultEquation === equation) {
+      setValue(`indicator.params.metric.equation`, createEquationFromMetric(nextNames));
+    }
+  };
+
+  const handleDeleteMetric = (index: number) => () => {
+    const currentVars = fields.map((m) => m.name) ?? ['A'];
+    const deletedVar = currentVars[index];
+    setDefaultEquationIfUnchanged(currentVars, xor(currentVars, [deletedVar]));
+    remove(index);
+  };
+
+  const handleAddMetric = () => {
+    const currentVars = fields.map((m) => m.name) ?? ['A'];
+    const name = first(xor(VAR_NAMES, currentVars))!;
+    setDefaultEquationIfUnchanged(currentVars, [...currentVars, name]);
+    append({ ...NEW_TIMESLICE_METRIC, name });
+  };
+
+  return (
+    <>
+      <EuiFlexItem>
+        {fields?.map((metric, index) => (
+          <React.Fragment key={metric.id}>
+            <EuiFlexGroup alignItems="center" gutterSize="xs">
+              <input hidden {...register(`indicator.params.metric.metrics.${index}.name`)} />
+              <MetricInput
+                isLoadingIndex={isLoadingIndex}
+                metricIndex={index}
+                indexPattern={indexPattern}
+                indexFields={indexFields}
+              />
+              <EuiFlexItem grow={0}>
+                <EuiButtonIcon
+                  data-test-subj="o11yMetricIndicatorButton"
+                  iconType="trash"
+                  color="danger"
+                  style={{ marginTop: '1.5em' }}
+                  onClick={handleDeleteMetric(index)}
+                  disabled={disableDelete}
+                  title={i18n.translate(
+                    'xpack.observability.slo.sloEdit.sliType.timesliceMetric.deleteLabel',
+                    { defaultMessage: 'Delete metric' }
+                  )}
+                  aria-label={i18n.translate(
+                    'xpack.observability.slo.sloEdit.sliType.timesliceMetric.deleteLabel',
+                    { defaultMessage: 'Delete metric' }
+                  )}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+            <EuiSpacer size="xs" />
+          </React.Fragment>
+        ))}
+        <EuiFlexGroup>
+          <EuiFlexItem grow={0}>
+            <EuiSpacer size="xs" />
+            <EuiButtonEmpty
+              data-test-subj="timesliceMetricIndicatorAddMetricButton"
+              color={'primary'}
+              size="xs"
+              iconType={'plusInCircleFilled'}
+              onClick={handleAddMetric}
+              isDisabled={disableAdd}
+              aria-label={i18n.translate(
+                'xpack.observability.slo.sloEdit.sliType.timesliceMetric.addMetricAriaLabel',
+                { defaultMessage: 'Add metric' }
+              )}
+            >
+              <FormattedMessage
+                id="xpack.observability.slo.sloEdit.sliType.timesliceMetric.addMetricLabel"
+                defaultMessage="Add metric"
+              />
+            </EuiButtonEmpty>
+            <EuiSpacer size="m" />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <EuiFlexGroup gutterSize="xs">
+          <EuiFlexItem>
+            <Controller
+              name={`indicator.params.metric.equation`}
+              defaultValue=""
+              rules={{
+                required: true,
+                validate: { validateEquation },
+              }}
+              control={control}
+              render={({ field: { ref, ...field }, fieldState }) => (
+                <EuiFormRow
+                  fullWidth
+                  label={
+                    <span>
+                      {equationLabel} {equationTooltip}
+                    </span>
+                  }
+                  isInvalid={fieldState.invalid}
+                  error={[
+                    i18n.translate(
+                      'xpack.observability.slo.sloEdit.sliType.timesliceMetric.equation.invalidCharacters',
+                      {
+                        defaultMessage:
+                          'The equation field only supports the following characters: A-Z, +, -, /, *, (, ), ?, !, &, :, |, >, <, =',
+                      }
+                    ),
+                  ]}
+                >
+                  <EuiFieldText
+                    {...field}
+                    isInvalid={fieldState.invalid}
+                    disabled={!indexPattern}
+                    fullWidth
+                    value={field.value}
+                    data-test-subj="timesliceMetricEquation"
+                    onChange={(event) => field.onChange(event.target.value)}
+                  />
+                </EuiFormRow>
+              )}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem grow={0}>
+            <Controller
+              name={`indicator.params.metric.comparator`}
+              rules={{
+                required: true,
+              }}
+              control={control}
+              render={({ field: { ref, ...field }, fieldState }) => (
+                <EuiFormRow
+                  fullWidth
+                  isInvalid={fieldState.invalid}
+                  label={i18n.translate(
+                    'xpack.observability.slo.sloEdit.sliType.timesliceMetric.comparatorLabel',
+                    {
+                      defaultMessage: 'Comparator',
+                    }
+                  )}
+                >
+                  <EuiSelect
+                    {...field}
+                    data-test-subj="timesliceMetricComparatorSelection"
+                    disabled={!indexPattern}
+                    value={field.value}
+                    options={COMPARATOR_OPTIONS}
+                    onChange={(event) => field.onChange(event.target.value)}
+                  />
+                </EuiFormRow>
+              )}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem grow={0}>
+            <EuiFormRow
+              fullWidth
+              isInvalid={getFieldState('indicator.params.metric.threshold').invalid}
+              label={
+                <span>
+                  {thresholdLabel} {thresholdTooltip}
+                </span>
+              }
+            >
+              <Controller
+                name={'indicator.params.metric.threshold'}
+                control={control}
+                rules={{
+                  required: true,
+                }}
+                defaultValue={0}
+                render={({ field: { ref, ...field }, fieldState }) => (
+                  <EuiFieldNumber
+                    required
+                    isInvalid={fieldState.invalid}
+                    data-test-subj="timesliceMetricThreshold"
+                    value={field.value}
+                    style={{ width: 80 }}
+                    disabled={!indexPattern}
+                    onChange={(event) => field.onChange(Number(event.target.value))}
+                  />
+                )}
+              />
+            </EuiFormRow>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+        <EuiFlexItem>
+          <EuiSpacer size="xs" />
+          <EuiText size="xs" color="subdued">
+            <p>
+              {i18n.translate(
+                'xpack.observability.slo.sloEdit.sliType.timesliceMetric.equationHelpText',
+                {
+                  defaultMessage:
+                    'Supports basic math equations, valid charaters are: A-Z, +, -, /, *, (, ), ?, !, &, :, |, >, <, =',
+                }
+              )}
+            </p>
+          </EuiText>
+        </EuiFlexItem>
+      </EuiFlexItem>
+    </>
+  );
+}
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/metric_input.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/metric_input.tsx
new file mode 100644
index 0000000000000..0db4c1d585782
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/metric_input.tsx
@@ -0,0 +1,263 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import {
+  EuiComboBox,
+  EuiComboBoxOptionOption,
+  EuiFieldNumber,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiIconTip,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { Controller, useFormContext } from 'react-hook-form';
+import { createOptionsFromFields } from '../../helpers/create_options';
+import { QueryBuilder } from '../common/query_builder';
+import { CreateSLOForm } from '../../types';
+import { AGGREGATION_OPTIONS, aggValueToLabel } from '../../helpers/aggregation_options';
+import { Field } from '../../../../hooks/slo/use_fetch_index_pattern_fields';
+
+const fieldLabel = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.fieldLabel',
+  { defaultMessage: 'Field' }
+);
+
+const aggregationLabel = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.aggregationLabel',
+  { defaultMessage: 'Aggregation' }
+);
+
+const filterLabel = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.filterLabel',
+  { defaultMessage: 'Filter' }
+);
+
+const fieldTooltip = (
+  <EuiIconTip
+    content={i18n.translate(
+      'xpack.observability.slo.sloEdit.sliType.timesliceMetric.totalMetric.tooltip',
+      {
+        defaultMessage: 'This is the field used in the aggregation.',
+      }
+    )}
+    position="top"
+  />
+);
+
+const NUMERIC_FIELD_TYPES = ['number', 'histogram'];
+const CARDINALITY_FIELD_TYPES = ['number', 'string'];
+
+interface MetricInputProps {
+  metricIndex: number;
+  indexPattern: string;
+  isLoadingIndex: boolean;
+  indexFields: Field[];
+}
+
+export function MetricInput({
+  metricIndex: index,
+  indexPattern,
+  isLoadingIndex,
+  indexFields,
+}: MetricInputProps) {
+  const { control, watch } = useFormContext<CreateSLOForm>();
+  const metric = watch(`indicator.params.metric.metrics.${index}`);
+  const metricFields = indexFields.filter((field) =>
+    metric.aggregation === 'cardinality'
+      ? CARDINALITY_FIELD_TYPES.includes(field.type)
+      : NUMERIC_FIELD_TYPES.includes(field.type)
+  );
+  return (
+    <>
+      <EuiFlexItem>
+        <Controller
+          name={`indicator.params.metric.metrics.${index}.aggregation`}
+          defaultValue="avg"
+          rules={{ required: true }}
+          control={control}
+          render={({ field: { ref, ...field }, fieldState }) => (
+            <EuiFormRow
+              fullWidth
+              label={
+                <span>
+                  {aggregationLabel} {metric.name}
+                </span>
+              }
+              isInvalid={fieldState.invalid}
+            >
+              <EuiComboBox
+                {...field}
+                async
+                fullWidth
+                isClearable={false}
+                singleSelection={{ asPlainText: true }}
+                placeholder={i18n.translate(
+                  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.aggregationField.placeholder',
+                  { defaultMessage: 'Select an aggregation' }
+                )}
+                aria-label={i18n.translate(
+                  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.aggregationField.placeholder',
+                  { defaultMessage: 'Select an aggregation' }
+                )}
+                isInvalid={fieldState.invalid}
+                isDisabled={!indexPattern}
+                isLoading={!!indexPattern && isLoadingIndex}
+                onChange={(selected: EuiComboBoxOptionOption[]) => {
+                  if (selected.length) {
+                    return field.onChange(selected[0].value);
+                  }
+                  field.onChange('');
+                }}
+                selectedOptions={
+                  !!indexPattern &&
+                  !!field.value &&
+                  AGGREGATION_OPTIONS.some((agg) => agg.value === agg.value)
+                    ? [
+                        {
+                          value: field.value,
+                          label: aggValueToLabel(field.value),
+                        },
+                      ]
+                    : []
+                }
+                options={AGGREGATION_OPTIONS}
+              />
+            </EuiFormRow>
+          )}
+        />
+      </EuiFlexItem>
+      {metric.aggregation === 'percentile' && (
+        <EuiFlexItem grow={0}>
+          <Controller
+            name={`indicator.params.metric.metrics.${index}.percentile`}
+            defaultValue={95}
+            rules={{
+              required: true,
+              min: 0.001,
+              max: 99.999,
+            }}
+            shouldUnregister={true}
+            control={control}
+            render={({ field: { ref, onChange, ...field }, fieldState }) => (
+              <EuiFormRow
+                fullWidth
+                isInvalid={fieldState.invalid}
+                label={
+                  <span>
+                    {i18n.translate(
+                      'xpack.observability.slo.sloEdit.sliType.timesliceMetric.percentileLabel',
+                      { defaultMessage: 'Percentile' }
+                    )}{' '}
+                    {metric.name}
+                  </span>
+                }
+              >
+                <EuiFieldNumber
+                  {...field}
+                  style={{ width: 80 }}
+                  data-test-subj="timesliceMetricPercentileNumber"
+                  required
+                  min={0.1}
+                  max={99.999}
+                  step={0.1}
+                  value={field.value}
+                  isInvalid={fieldState.invalid}
+                  disabled={!indexPattern}
+                  isLoading={!!indexPattern && isLoadingIndex}
+                  onChange={(event) => onChange(Number(event.target.value))}
+                />
+              </EuiFormRow>
+            )}
+          />
+        </EuiFlexItem>
+      )}
+      {metric.aggregation !== 'doc_count' && (
+        <EuiFlexItem>
+          <Controller
+            name={`indicator.params.metric.metrics.${index}.field`}
+            defaultValue=""
+            rules={{ required: true }}
+            shouldUnregister={true}
+            control={control}
+            render={({ field: { ref, ...field }, fieldState }) => (
+              <EuiFormRow
+                fullWidth
+                isInvalid={fieldState.invalid}
+                label={
+                  <span>
+                    {fieldLabel} {metric.name} {fieldTooltip}
+                  </span>
+                }
+              >
+                <EuiComboBox
+                  {...field}
+                  async
+                  fullWidth
+                  singleSelection={{ asPlainText: true }}
+                  placeholder={i18n.translate(
+                    'xpack.observability.slo.sloEdit.sliType.timesliceMetric.metricField.placeholder',
+                    { defaultMessage: 'Select a metric field' }
+                  )}
+                  aria-label={i18n.translate(
+                    'xpack.observability.slo.sloEdit.sliType.timesliceMetric.metricField.placeholder',
+                    { defaultMessage: 'Select a metric field' }
+                  )}
+                  isInvalid={fieldState.invalid}
+                  isDisabled={!indexPattern}
+                  isLoading={!!indexPattern && isLoadingIndex}
+                  onChange={(selected: EuiComboBoxOptionOption[]) => {
+                    if (selected.length) {
+                      return field.onChange(selected[0].value);
+                    }
+                    field.onChange('');
+                  }}
+                  selectedOptions={
+                    !!indexPattern &&
+                    !!field.value &&
+                    metricFields.some((metricField) => metricField.name === field.value)
+                      ? [
+                          {
+                            value: field.value,
+                            label: field.value,
+                          },
+                        ]
+                      : []
+                  }
+                  options={createOptionsFromFields(metricFields)}
+                />
+              </EuiFormRow>
+            )}
+          />
+        </EuiFlexItem>
+      )}
+      <EuiFlexItem>
+        <QueryBuilder
+          dataTestSubj="timesliceMetricIndicatorFormMetricQueryInput"
+          indexPatternString={watch('indicator.params.index')}
+          label={`${filterLabel} ${metric.name}`}
+          name={`indicator.params.metric.metrics.${index}.filter`}
+          placeholder={i18n.translate(
+            'xpack.observability.slo.sloEdit.sliType.timesliceMetric.goodQuery.placeholder',
+            { defaultMessage: 'KQL filter' }
+          )}
+          required={false}
+          tooltip={
+            <EuiIconTip
+              content={i18n.translate(
+                'xpack.observability.slo.sloEdit.sliType.timesliceMetric.goodQuery.tooltip',
+                {
+                  defaultMessage: 'This KQL query should return a subset of events.',
+                }
+              )}
+              position="top"
+            />
+          }
+        />
+      </EuiFlexItem>
+    </>
+  );
+}
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/timeslice_metric_indicator.tsx b/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/timeslice_metric_indicator.tsx
new file mode 100644
index 0000000000000..5d455a601e3d7
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/slo_edit/components/timeslice_metric/timeslice_metric_indicator.tsx
@@ -0,0 +1,163 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiHorizontalRule,
+  EuiIconTip,
+  EuiSpacer,
+  EuiTitle,
+  useEuiTheme,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+import React from 'react';
+import { useFormContext } from 'react-hook-form';
+import { useFetchIndexPatternFields } from '../../../../hooks/slo/use_fetch_index_pattern_fields';
+import { CreateSLOForm } from '../../types';
+import { DataPreviewChart } from '../common/data_preview_chart';
+import { IndexFieldSelector } from '../common/index_field_selector';
+import { QueryBuilder } from '../common/query_builder';
+import { IndexSelection } from '../custom_common/index_selection';
+import { MetricIndicator } from './metric_indicator';
+import { useKibana } from '../../../../utils/kibana_react';
+import { COMPARATOR_MAPPING } from '../../constants';
+
+export { NEW_TIMESLICE_METRIC } from './metric_indicator';
+
+export function TimesliceMetricIndicatorTypeForm() {
+  const { watch } = useFormContext<CreateSLOForm>();
+  const index = watch('indicator.params.index');
+  const { isLoading: isIndexFieldsLoading, data: indexFields = [] } =
+    useFetchIndexPatternFields(index);
+  const timestampFields = indexFields.filter((field) => field.type === 'date');
+  const partitionByFields = indexFields.filter((field) => field.aggregatable);
+  const { uiSettings } = useKibana().services;
+  const threshold = watch('indicator.params.metric.threshold');
+  const comparator = watch('indicator.params.metric.comparator');
+  const { euiTheme } = useEuiTheme();
+
+  return (
+    <>
+      <EuiTitle size="xs">
+        <h3>
+          <FormattedMessage
+            id="xpack.observability.slo.sloEdit.sliType.sourceTitle"
+            defaultMessage="Source"
+          />
+        </h3>
+      </EuiTitle>
+      <EuiSpacer size="s" />
+      <EuiFlexGroup direction="column" gutterSize="l">
+        <EuiFlexGroup direction="row" gutterSize="l">
+          <EuiFlexItem>
+            <IndexSelection />
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <IndexFieldSelector
+              indexFields={timestampFields}
+              name="indicator.params.timestampField"
+              label={i18n.translate('xpack.observability.slo.sloEdit.timestampField.label', {
+                defaultMessage: 'Timestamp field',
+              })}
+              placeholder={i18n.translate(
+                'xpack.observability.slo.sloEdit.timestampField.placeholder',
+                { defaultMessage: 'Select a timestamp field' }
+              )}
+              isLoading={!!index && isIndexFieldsLoading}
+              isDisabled={!index}
+              isRequired
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+
+        <EuiFlexItem>
+          <QueryBuilder
+            dataTestSubj="timesliceMetricIndicatorFormQueryFilterInput"
+            indexPatternString={watch('indicator.params.index')}
+            label={i18n.translate(
+              'xpack.observability.slo.sloEdit.sliType.timesliceMetric.queryFilter',
+              {
+                defaultMessage: 'Query filter',
+              }
+            )}
+            name="indicator.params.filter"
+            placeholder={i18n.translate(
+              'xpack.observability.slo.sloEdit.sliType.timesliceMetric.customFilter',
+              { defaultMessage: 'Custom filter to apply on the index' }
+            )}
+            tooltip={
+              <EuiIconTip
+                content={i18n.translate(
+                  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.customFilter.tooltip',
+                  {
+                    defaultMessage:
+                      'This KQL query can be used to filter the documents with some relevant criteria.',
+                  }
+                )}
+                position="top"
+              />
+            }
+          />
+        </EuiFlexItem>
+
+        <EuiFlexItem>
+          <EuiHorizontalRule margin="none" />
+        </EuiFlexItem>
+
+        <EuiFlexItem>
+          <EuiTitle size="xs">
+            <h3>
+              <FormattedMessage
+                id="xpack.observability.slo.sloEdit.sliType.timesliceMetric.metricTitle"
+                defaultMessage="Metric definition"
+              />
+            </h3>
+          </EuiTitle>
+          <EuiSpacer size="s" />
+          <MetricIndicator indexFields={indexFields} isLoadingIndex={isIndexFieldsLoading} />
+        </EuiFlexItem>
+
+        <EuiFlexItem>
+          <EuiHorizontalRule margin="none" />
+        </EuiFlexItem>
+
+        <IndexFieldSelector
+          indexFields={partitionByFields}
+          name="groupBy"
+          label={
+            <span>
+              {i18n.translate('xpack.observability.slo.sloEdit.groupBy.label', {
+                defaultMessage: 'Partition by',
+              })}{' '}
+              <EuiIconTip
+                content={i18n.translate('xpack.observability.slo.sloEdit.groupBy.tooltip', {
+                  defaultMessage: 'Create individual SLOs for each value of the selected field.',
+                })}
+                position="top"
+              />
+            </span>
+          }
+          placeholder={i18n.translate('xpack.observability.slo.sloEdit.groupBy.placeholder', {
+            defaultMessage: 'Select an optional field to partition by',
+          })}
+          isLoading={!!index && isIndexFieldsLoading}
+          isDisabled={!index}
+        />
+
+        <DataPreviewChart
+          formatPattern={uiSettings.get('format:number:defaultPattern')}
+          threshold={threshold}
+          thresholdDirection={['GT', 'GTE'].includes(comparator) ? 'above' : 'below'}
+          thresholdColor={euiTheme.colors.warning}
+          thresholdMessage={`${COMPARATOR_MAPPING[comparator]} ${threshold}`}
+        />
+      </EuiFlexGroup>
+    </>
+  );
+}
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/constants.ts b/x-pack/plugins/observability/public/pages/slo_edit/constants.ts
index 4c38525784a10..9c5284855c772 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/constants.ts
+++ b/x-pack/plugins/observability/public/pages/slo_edit/constants.ts
@@ -15,6 +15,7 @@ import {
   IndicatorType,
   KQLCustomIndicator,
   MetricCustomIndicator,
+  TimesliceMetricIndicator,
   TimeWindow,
 } from '@kbn/slo-schema';
 import {
@@ -25,6 +26,7 @@ import {
   INDICATOR_CUSTOM_KQL,
   INDICATOR_CUSTOM_METRIC,
   INDICATOR_HISTOGRAM,
+  INDICATOR_TIMESLICE_METRIC,
 } from '../../utils/slo/labels';
 import { CreateSLOForm } from './types';
 
@@ -40,6 +42,10 @@ export const SLI_OPTIONS: Array<{
     value: 'sli.metric.custom',
     text: INDICATOR_CUSTOM_METRIC,
   },
+  {
+    value: 'sli.metric.timeslice',
+    text: INDICATOR_TIMESLICE_METRIC,
+  },
   {
     value: 'sli.histogram.custom',
     text: INDICATOR_HISTOGRAM,
@@ -125,6 +131,21 @@ export const CUSTOM_METRIC_DEFAULT_VALUES: MetricCustomIndicator = {
   },
 };
 
+export const TIMESLICE_METRIC_DEFAULT_VALUES: TimesliceMetricIndicator = {
+  type: 'sli.metric.timeslice' as const,
+  params: {
+    index: '',
+    filter: '',
+    metric: {
+      metrics: [{ name: 'A', aggregation: 'avg' as const, field: '' }],
+      equation: 'A',
+      comparator: 'GT',
+      threshold: 0,
+    },
+    timestampField: '',
+  },
+};
+
 export const HISTOGRAM_DEFAULT_VALUES: HistogramIndicator = {
   type: 'sli.histogram.custom' as const,
   params: {
@@ -198,3 +219,57 @@ export const SLO_EDIT_FORM_DEFAULT_VALUES_CUSTOM_METRIC: CreateSLOForm = {
   },
   groupBy: ALL_VALUE,
 };
+
+export const COMPARATOR_GT = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.gtLabel',
+  {
+    defaultMessage: 'Greater than',
+  }
+);
+
+export const COMPARATOR_GTE = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.gteLabel',
+  {
+    defaultMessage: 'Greater than or equal to',
+  }
+);
+
+export const COMPARATOR_LT = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.ltLabel',
+  {
+    defaultMessage: 'Less than',
+  }
+);
+
+export const COMPARATOR_LTE = i18n.translate(
+  'xpack.observability.slo.sloEdit.sliType.timesliceMetric.lteLabel',
+  {
+    defaultMessage: 'Less than or equal to',
+  }
+);
+
+export const COMPARATOR_MAPPING = {
+  GT: COMPARATOR_GT,
+  GTE: COMPARATOR_GTE,
+  LT: COMPARATOR_LT,
+  LTE: COMPARATOR_LTE,
+};
+
+export const COMPARATOR_OPTIONS = [
+  {
+    text: COMPARATOR_GT,
+    value: 'GT' as const,
+  },
+  {
+    text: COMPARATOR_GTE,
+    value: 'GTE' as const,
+  },
+  {
+    text: COMPARATOR_LT,
+    value: 'LT' as const,
+  },
+  {
+    text: COMPARATOR_LTE,
+    value: 'LTE' as const,
+  },
+];
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/helpers/aggregation_options.ts b/x-pack/plugins/observability/public/pages/slo_edit/helpers/aggregation_options.ts
new file mode 100644
index 0000000000000..4a3a5fb9cf28a
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/slo_edit/helpers/aggregation_options.ts
@@ -0,0 +1,84 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+export const AGGREGATION_OPTIONS = [
+  {
+    value: 'avg',
+    label: i18n.translate('xpack.observability.slo.sloEdit.timesliceMetric.aggregation.average', {
+      defaultMessage: 'Average',
+    }),
+  },
+  {
+    value: 'max',
+    label: i18n.translate('xpack.observability.slo.sloEdit.timesliceMetric.aggregation.max', {
+      defaultMessage: 'Max',
+    }),
+  },
+  {
+    value: 'min',
+    label: i18n.translate('xpack.observability.slo.sloEdit.timesliceMetric.aggregation.min', {
+      defaultMessage: 'Min',
+    }),
+  },
+  {
+    value: 'sum',
+    label: i18n.translate('xpack.observability.slo.sloEdit.timesliceMetric.aggregation.sum', {
+      defaultMessage: 'Sum',
+    }),
+  },
+  {
+    value: 'cardinality',
+    label: i18n.translate(
+      'xpack.observability.slo.sloEdit.timesliceMetric.aggregation.cardinality',
+      {
+        defaultMessage: 'Cardinality',
+      }
+    ),
+  },
+  {
+    value: 'last_value',
+    label: i18n.translate(
+      'xpack.observability.slo.sloEdit.timesliceMetric.aggregation.last_value',
+      {
+        defaultMessage: 'Last value',
+      }
+    ),
+  },
+  {
+    value: 'std_deviation',
+    label: i18n.translate(
+      'xpack.observability.slo.sloEdit.timesliceMetric.aggregation.std_deviation',
+      {
+        defaultMessage: 'Std. Deviation',
+      }
+    ),
+  },
+  {
+    value: 'doc_count',
+    label: i18n.translate('xpack.observability.slo.sloEdit.timesliceMetric.aggregation.doc_count', {
+      defaultMessage: 'Doc count',
+    }),
+  },
+  {
+    value: 'percentile',
+    label: i18n.translate(
+      'xpack.observability.slo.sloEdit.timesliceMetric.aggregation.percentile',
+      {
+        defaultMessage: 'Percentile',
+      }
+    ),
+  },
+];
+
+export function aggValueToLabel(value: string) {
+  const aggregation = AGGREGATION_OPTIONS.find((agg) => agg.value === value);
+  if (aggregation) {
+    return aggregation.label;
+  }
+  return value;
+}
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/helpers/process_slo_form_values.ts b/x-pack/plugins/observability/public/pages/slo_edit/helpers/process_slo_form_values.ts
index c6de2126adacf..f523cc1ce1ce1 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/helpers/process_slo_form_values.ts
+++ b/x-pack/plugins/observability/public/pages/slo_edit/helpers/process_slo_form_values.ts
@@ -15,6 +15,7 @@ import {
   CUSTOM_KQL_DEFAULT_VALUES,
   CUSTOM_METRIC_DEFAULT_VALUES,
   HISTOGRAM_DEFAULT_VALUES,
+  TIMESLICE_METRIC_DEFAULT_VALUES,
 } from '../constants';
 import { CreateSLOForm } from '../types';
 
@@ -132,6 +133,11 @@ function transformPartialIndicatorState(
         type: 'sli.metric.custom' as const,
         params: Object.assign({}, CUSTOM_METRIC_DEFAULT_VALUES.params, indicator.params ?? {}),
       };
+    case 'sli.metric.timeslice':
+      return {
+        type: 'sli.metric.timeslice' as const,
+        params: Object.assign({}, TIMESLICE_METRIC_DEFAULT_VALUES.params, indicator.params ?? {}),
+      };
     default:
       assertNever(indicatorType);
   }
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/hooks/use_section_form_validation.ts b/x-pack/plugins/observability/public/pages/slo_edit/hooks/use_section_form_validation.ts
index e0c2652bfc46d..6fede4552d6f8 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/hooks/use_section_form_validation.ts
+++ b/x-pack/plugins/observability/public/pages/slo_edit/hooks/use_section_form_validation.ts
@@ -5,7 +5,12 @@
  * 2.0.
  */
 
-import { MetricCustomIndicator } from '@kbn/slo-schema';
+import {
+  MetricCustomIndicator,
+  timesliceMetricBasicMetricWithField,
+  TimesliceMetricIndicator,
+  timesliceMetricPercentileMetric,
+} from '@kbn/slo-schema';
 import { FormState, UseFormGetFieldState, UseFormGetValues, UseFormWatch } from 'react-hook-form';
 import { isObject } from 'lodash';
 import { CreateSLOForm } from '../types';
@@ -54,6 +59,39 @@ export function useSectionFormValidation({ getFieldState, getValues, formState,
         isGoodParamsValid() &&
         isTotalParamsValid();
       break;
+    case 'sli.metric.timeslice':
+      const isMetricParamsValid = () => {
+        const data = getValues(
+          'indicator.params.metric'
+        ) as TimesliceMetricIndicator['params']['metric'];
+        const isEquationValid = !getFieldState('indicator.params.metric.equation').invalid;
+        const areMetricsValid =
+          isObject(data) &&
+          (data.metrics ?? []).every((metric) => {
+            if (timesliceMetricBasicMetricWithField.is(metric)) {
+              return Boolean(metric.field);
+            }
+            if (timesliceMetricPercentileMetric.is(metric)) {
+              return Boolean(metric.field) && Boolean(metric.percentile);
+            }
+            return true;
+          });
+        return isEquationValid && areMetricsValid;
+      };
+
+      isIndicatorSectionValid =
+        (
+          [
+            'indicator.params.index',
+            'indicator.params.filter',
+            'indicator.params.timestampField',
+          ] as const
+        ).every((field) => !getFieldState(field).invalid) &&
+        (['indicator.params.index', 'indicator.params.timestampField'] as const).every(
+          (field) => !!getValues(field)
+        ) &&
+        isMetricParamsValid();
+      break;
     case 'sli.histogram.custom':
       const isRangeValid = (type: 'good' | 'total') => {
         const aggregation = getValues(`indicator.params.${type}.aggregation`);
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/hooks/use_unregister_fields.ts b/x-pack/plugins/observability/public/pages/slo_edit/hooks/use_unregister_fields.ts
index c15b5cb7fbbfc..d461c841940a4 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/hooks/use_unregister_fields.ts
+++ b/x-pack/plugins/observability/public/pages/slo_edit/hooks/use_unregister_fields.ts
@@ -14,10 +14,12 @@ import { useFetchApmIndex } from '../../../hooks/slo/use_fetch_apm_indices';
 import {
   APM_AVAILABILITY_DEFAULT_VALUES,
   APM_LATENCY_DEFAULT_VALUES,
+  BUDGETING_METHOD_OPTIONS,
   CUSTOM_KQL_DEFAULT_VALUES,
   CUSTOM_METRIC_DEFAULT_VALUES,
   HISTOGRAM_DEFAULT_VALUES,
   SLO_EDIT_FORM_DEFAULT_VALUES,
+  TIMESLICE_METRIC_DEFAULT_VALUES,
 } from '../constants';
 import { CreateSLOForm } from '../types';
 
@@ -49,6 +51,22 @@ export function useUnregisterFields({ isEditMode }: { isEditMode: boolean }) {
             }
           );
           break;
+        case 'sli.metric.timeslice':
+          reset(
+            Object.assign({}, SLO_EDIT_FORM_DEFAULT_VALUES, {
+              budgetingMethod: BUDGETING_METHOD_OPTIONS[1].value,
+              objective: {
+                target: 99,
+                timesliceTarget: 95,
+                timesliceWindow: 1,
+              },
+              indicator: TIMESLICE_METRIC_DEFAULT_VALUES,
+            }),
+            {
+              keepDefaultValues: true,
+            }
+          );
+          break;
         case 'sli.kql.custom':
           reset(
             Object.assign({}, SLO_EDIT_FORM_DEFAULT_VALUES, {
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/slo_edit.test.tsx b/x-pack/plugins/observability/public/pages/slo_edit/slo_edit.test.tsx
index c38689200a164..b158094a67aab 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/slo_edit.test.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/slo_edit.test.tsx
@@ -147,7 +147,7 @@ describe('SLO Edit Page', () => {
         .spyOn(Router, 'useLocation')
         .mockReturnValue({ pathname: 'foo', search: '', state: '', hash: '' });
 
-      useFetchSloMock.mockReturnValue({ isLoading: false, slo: undefined });
+      useFetchSloMock.mockReturnValue({ isLoading: false, data: undefined });
 
       useFetchIndicesMock.mockReturnValue({
         isLoading: false,
@@ -201,7 +201,7 @@ describe('SLO Edit Page', () => {
           .spyOn(Router, 'useLocation')
           .mockReturnValue({ pathname: 'foo', search: '', state: '', hash: '' });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo: undefined });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: undefined });
 
         useFetchIndicesMock.mockReturnValue({
           isLoading: false,
@@ -237,7 +237,7 @@ describe('SLO Edit Page', () => {
           .spyOn(Router, 'useLocation')
           .mockReturnValue({ pathname: 'foo', search: '', state: '', hash: '' });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo: undefined });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: undefined });
 
         useFetchIndicesMock.mockReturnValue({
           isLoading: false,
@@ -287,7 +287,7 @@ describe('SLO Edit Page', () => {
           data: ['some-index'],
         });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo: undefined });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: undefined });
 
         const mockCreate = jest.fn();
         const mockUpdate = jest.fn();
@@ -377,7 +377,7 @@ describe('SLO Edit Page', () => {
           .spyOn(Router, 'useLocation')
           .mockReturnValue({ pathname: 'foo', search: '', state: '', hash: '' });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo: undefined });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: undefined });
 
         useFetchApmSuggestionsMock.mockReturnValue({
           suggestions: ['cartService'],
@@ -428,7 +428,7 @@ describe('SLO Edit Page', () => {
           .spyOn(Router, 'useLocation')
           .mockReturnValue({ pathname: 'foo', search: '', state: '', hash: '' });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: slo });
 
         useFetchIndicesMock.mockReturnValue({
           isLoading: false,
@@ -496,7 +496,7 @@ describe('SLO Edit Page', () => {
           data: ['some-index'],
         });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: slo });
 
         const mockCreate = jest.fn();
         const mockUpdate = jest.fn();
@@ -537,7 +537,7 @@ describe('SLO Edit Page', () => {
           .spyOn(Router, 'useLocation')
           .mockReturnValue({ pathname: 'foo', search: '', state: '', hash: '' });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: slo });
 
         useFetchApmSuggestionsMock.mockReturnValue({
           suggestions: ['cartService'],
@@ -607,7 +607,7 @@ describe('SLO Edit Page', () => {
           .spyOn(Router, 'useLocation')
           .mockReturnValue({ pathname: 'foo', search: '', state: '', hash: '' });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: slo });
 
         useFetchIndicesMock.mockReturnValue({
           isLoading: false,
@@ -648,7 +648,7 @@ describe('SLO Edit Page', () => {
           .spyOn(Router, 'useLocation')
           .mockReturnValue({ pathname: 'foo', search: '', state: '', hash: '' });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: slo });
 
         useFetchIndicesMock.mockReturnValue({
           isLoading: false,
@@ -693,7 +693,7 @@ describe('SLO Edit Page', () => {
           .spyOn(Router, 'useLocation')
           .mockReturnValue({ pathname: 'foo', search: 'create-rule=true', state: '', hash: '' });
 
-        useFetchSloMock.mockReturnValue({ isLoading: false, slo });
+        useFetchSloMock.mockReturnValue({ isLoading: false, data: slo });
 
         useFetchIndicesMock.mockReturnValue({
           isLoading: false,
diff --git a/x-pack/plugins/observability/public/pages/slo_edit/slo_edit.tsx b/x-pack/plugins/observability/public/pages/slo_edit/slo_edit.tsx
index a9da5c0c0ee97..1f5cc7f38ed3c 100644
--- a/x-pack/plugins/observability/public/pages/slo_edit/slo_edit.tsx
+++ b/x-pack/plugins/observability/public/pages/slo_edit/slo_edit.tsx
@@ -33,7 +33,7 @@ export function SloEditPage() {
   const { sloId } = useParams<{ sloId: string | undefined }>();
   const { hasAtLeast } = useLicense();
   const hasRightLicense = hasAtLeast('platinum');
-  const { slo, isInitialLoading } = useFetchSloDetails({ sloId });
+  const { data: slo, isInitialLoading } = useFetchSloDetails({ sloId });
 
   useBreadcrumbs([
     {
diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_list.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_list.tsx
index 651a97d364439..380d0100db1a1 100644
--- a/x-pack/plugins/observability/public/pages/slos/components/slo_list.tsx
+++ b/x-pack/plugins/observability/public/pages/slos/components/slo_list.tsx
@@ -9,27 +9,35 @@ import { EuiFlexGroup, EuiFlexItem, EuiPagination } from '@elastic/eui';
 import { useIsMutating } from '@tanstack/react-query';
 import React, { useState } from 'react';
 import { useFetchSloList } from '../../../hooks/slo/use_fetch_slo_list';
+import { useUrlSearchState } from '../hooks/use_url_search_state';
 import { SloListItems } from './slo_list_items';
-import { SloListSearchFilterSortBar, SortField } from './slo_list_search_filter_sort_bar';
+import { SloListSearchBar, SortField } from './slo_list_search_bar';
 
 export interface Props {
   autoRefresh: boolean;
 }
 
 export function SloList({ autoRefresh }: Props) {
-  const [activePage, setActivePage] = useState(0);
-  const [query, setQuery] = useState('');
-  const [sort, setSort] = useState<SortField | undefined>('status');
+  const { state, store: storeState } = useUrlSearchState();
+  const [page, setPage] = useState(state.page);
+  const [query, setQuery] = useState(state.kqlQuery);
+  const [sort, setSort] = useState<SortField>(state.sort.by);
+  const [direction] = useState<'asc' | 'desc'>(state.sort.direction);
 
-  const { isLoading, isRefetching, isError, sloList } = useFetchSloList({
-    page: activePage + 1,
+  const {
+    isLoading,
+    isRefetching,
+    isError,
+    data: sloList,
+  } = useFetchSloList({
+    page: page + 1,
     kqlQuery: query,
     sortBy: sort,
-    sortDirection: 'desc',
+    sortDirection: direction,
     shouldRefetch: autoRefresh,
   });
 
-  const { results = [], total = 0, perPage = 0 } = sloList || {};
+  const { results = [], total = 0, perPage = 0 } = sloList ?? {};
 
   const isCreatingSlo = Boolean(useIsMutating(['creatingSlo']));
   const isCloningSlo = Boolean(useIsMutating(['cloningSlo']));
@@ -37,40 +45,43 @@ export function SloList({ autoRefresh }: Props) {
   const isDeletingSlo = Boolean(useIsMutating(['deleteSlo']));
 
   const handlePageClick = (pageNumber: number) => {
-    setActivePage(pageNumber);
+    setPage(pageNumber);
+    storeState({ page: pageNumber });
   };
 
   const handleChangeQuery = (newQuery: string) => {
-    setActivePage(0);
+    setPage(0);
     setQuery(newQuery);
+    storeState({ page: 0, kqlQuery: newQuery });
   };
 
-  const handleChangeSort = (newSort: SortField | undefined) => {
-    setActivePage(0);
+  const handleChangeSort = (newSort: SortField) => {
+    setPage(0);
     setSort(newSort);
+    storeState({ page: 0, sort: { by: newSort, direction: state.sort.direction } });
   };
 
   return (
     <EuiFlexGroup direction="column" gutterSize="m" data-test-subj="sloList">
       <EuiFlexItem grow>
-        <SloListSearchFilterSortBar
+        <SloListSearchBar
           loading={isLoading || isCreatingSlo || isCloningSlo || isUpdatingSlo || isDeletingSlo}
           onChangeQuery={handleChangeQuery}
           onChangeSort={handleChangeSort}
+          initialState={state}
         />
       </EuiFlexItem>
-
       <EuiFlexItem>
         <SloListItems sloList={results} loading={isLoading || isRefetching} error={isError} />
       </EuiFlexItem>
 
-      {results.length ? (
+      {total > 0 ? (
         <EuiFlexItem>
           <EuiFlexGroup direction="column" gutterSize="s" alignItems="flexEnd">
             <EuiFlexItem>
               <EuiPagination
                 pageCount={Math.ceil(total / perPage)}
-                activePage={activePage}
+                activePage={page}
                 onPageClick={handlePageClick}
               />
             </EuiFlexItem>
diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_list_search_filter_sort_bar.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_list_search_bar.stories.tsx
similarity index 55%
rename from x-pack/plugins/observability/public/pages/slos/components/slo_list_search_filter_sort_bar.stories.tsx
rename to x-pack/plugins/observability/public/pages/slos/components/slo_list_search_bar.stories.tsx
index 4b1c31209de3b..fb39f46e81e96 100644
--- a/x-pack/plugins/observability/public/pages/slos/components/slo_list_search_filter_sort_bar.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/slos/components/slo_list_search_bar.stories.tsx
@@ -9,26 +9,23 @@ import React from 'react';
 import { ComponentStory } from '@storybook/react';
 
 import { KibanaReactStorybookDecorator } from '../../../utils/kibana_react.storybook_decorator';
-import {
-  SloListSearchFilterSortBar as Component,
-  SloListSearchFilterSortBarProps,
-} from './slo_list_search_filter_sort_bar';
+import { SloListSearchBar as Component, Props } from './slo_list_search_bar';
+import { DEFAULT_STATE } from '../hooks/use_url_search_state';
 
 export default {
   component: Component,
-  title: 'app/SLO/ListPage/SloListSearchFilterSortBar',
+  title: 'app/SLO/ListPage/SloListSearchBar',
   decorators: [KibanaReactStorybookDecorator],
 };
 
-const Template: ComponentStory<typeof Component> = (props: SloListSearchFilterSortBarProps) => (
-  <Component {...props} />
-);
+const Template: ComponentStory<typeof Component> = (props: Props) => <Component {...props} />;
 
-const defaultProps: SloListSearchFilterSortBarProps = {
+const defaultProps: Props = {
   loading: false,
   onChangeQuery: () => {},
   onChangeSort: () => {},
+  initialState: DEFAULT_STATE,
 };
 
-export const SloListSearchFilterSortBar = Template.bind({});
-SloListSearchFilterSortBar.args = defaultProps;
+export const SloListSearchBar = Template.bind({});
+SloListSearchBar.args = defaultProps;
diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_list_search_filter_sort_bar.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_list_search_bar.tsx
similarity index 88%
rename from x-pack/plugins/observability/public/pages/slos/components/slo_list_search_filter_sort_bar.tsx
rename to x-pack/plugins/observability/public/pages/slos/components/slo_list_search_bar.tsx
index c1d9c6b3c3a07..dc6aebfd3eae7 100644
--- a/x-pack/plugins/observability/public/pages/slos/components/slo_list_search_filter_sort_bar.tsx
+++ b/x-pack/plugins/observability/public/pages/slos/components/slo_list_search_bar.tsx
@@ -22,11 +22,13 @@ import { QueryStringInput } from '@kbn/unified-search-plugin/public';
 import React, { useState } from 'react';
 import { useCreateDataView } from '../../../hooks/use_create_data_view';
 import { useKibana } from '../../../utils/kibana_react';
+import { SearchState } from '../hooks/use_url_search_state';
 
-export interface SloListSearchFilterSortBarProps {
+export interface Props {
   loading: boolean;
+  initialState: SearchState;
   onChangeQuery: (query: string) => void;
-  onChangeSort: (sort: SortField | undefined) => void;
+  onChangeSort: (sort: SortField) => void;
 }
 
 export type SortField = 'sli_value' | 'error_budget_consumed' | 'error_budget_remaining' | 'status';
@@ -49,7 +51,6 @@ const SORT_OPTIONS: Array<Item<SortField>> = [
       defaultMessage: 'SLO status',
     }),
     type: 'status',
-    checked: 'on',
   },
   {
     label: i18n.translate('xpack.observability.slo.list.sortBy.errorBudgetConsumed', {
@@ -65,26 +66,26 @@ const SORT_OPTIONS: Array<Item<SortField>> = [
   },
 ];
 
-export function SloListSearchFilterSortBar({
-  loading,
-  onChangeQuery,
-  onChangeSort,
-}: SloListSearchFilterSortBarProps) {
+export function SloListSearchBar({ loading, onChangeQuery, onChangeSort, initialState }: Props) {
   const { data, dataViews, docLinks, http, notifications, storage, uiSettings, unifiedSearch } =
     useKibana().services;
   const { dataView } = useCreateDataView({ indexPatternString: '.slo-observability.summary-*' });
 
+  const [query, setQuery] = useState(initialState.kqlQuery);
   const [isSortPopoverOpen, setSortPopoverOpen] = useState(false);
-  const [sortOptions, setSortOptions] = useState(SORT_OPTIONS);
-  const [query, setQuery] = useState('');
-
+  const [sortOptions, setSortOptions] = useState<Array<Item<SortField>>>(
+    SORT_OPTIONS.map((option) => ({
+      ...option,
+      checked: option.type === initialState.sort.by ? 'on' : undefined,
+    }))
+  );
   const selectedSort = sortOptions.find((option) => option.checked === 'on');
-  const handleToggleSortButton = () => setSortPopoverOpen(!isSortPopoverOpen);
 
+  const handleToggleSortButton = () => setSortPopoverOpen(!isSortPopoverOpen);
   const handleChangeSort = (newOptions: Array<Item<SortField>>) => {
     setSortOptions(newOptions);
     setSortPopoverOpen(false);
-    onChangeSort(newOptions.find((o) => o.checked)?.type);
+    onChangeSort(newOptions.find((o) => o.checked)!.type);
   };
 
   return (
@@ -133,7 +134,7 @@ export function SloListSearchFilterSortBar({
               >
                 {i18n.translate('xpack.observability.slo.list.sortByType', {
                   defaultMessage: 'Sort by {type}',
-                  values: { type: selectedSort?.label.toLowerCase() || '' },
+                  values: { type: selectedSort?.label.toLowerCase() ?? '' },
                 })}
               </EuiFilterButton>
             }
@@ -149,7 +150,7 @@ export function SloListSearchFilterSortBar({
                 })}
               </EuiPopoverTitle>
               <EuiSelectable<Item<SortField>>
-                singleSelection
+                singleSelection="always"
                 options={sortOptions}
                 onChange={handleChangeSort}
                 isLoading={loading}
diff --git a/x-pack/plugins/observability/public/pages/slos/hooks/use_url_search_state.ts b/x-pack/plugins/observability/public/pages/slos/hooks/use_url_search_state.ts
new file mode 100644
index 0000000000000..2d7fb860900fa
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/slos/hooks/use_url_search_state.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useHistory } from 'react-router-dom';
+import { createKbnUrlStateStorage } from '@kbn/kibana-utils-plugin/public';
+import deepmerge from 'deepmerge';
+import { SortField } from '../components/slo_list_search_bar';
+
+export interface SearchState {
+  kqlQuery: string;
+  page: number;
+  sort: {
+    by: SortField;
+    direction: 'asc' | 'desc';
+  };
+}
+
+export const DEFAULT_STATE = {
+  kqlQuery: '',
+  page: 0,
+  sort: { by: 'status' as const, direction: 'desc' as const },
+};
+
+export function useUrlSearchState(): {
+  state: SearchState;
+  store: (state: Partial<SearchState>) => Promise<string | undefined>;
+} {
+  const history = useHistory();
+  const urlStateStorage = createKbnUrlStateStorage({
+    history,
+    useHash: false,
+    useHashQuery: false,
+  });
+
+  const searchState = urlStateStorage.get<SearchState>('search') ?? DEFAULT_STATE;
+
+  return {
+    state: deepmerge(DEFAULT_STATE, searchState),
+    store: (state: Partial<SearchState>) =>
+      urlStateStorage.set('search', deepmerge(searchState, state), { replace: true }),
+  };
+}
diff --git a/x-pack/plugins/observability/public/pages/slos/slos.test.tsx b/x-pack/plugins/observability/public/pages/slos/slos.test.tsx
index 09d5af66b55dc..3e19b7a466be5 100644
--- a/x-pack/plugins/observability/public/pages/slos/slos.test.tsx
+++ b/x-pack/plugins/observability/public/pages/slos/slos.test.tsx
@@ -5,25 +5,25 @@
  * 2.0.
  */
 
+import { act, screen, waitFor } from '@testing-library/react';
 import React from 'react';
-import { screen, act, waitFor } from '@testing-library/react';
 
-import { chartPluginMock } from '@kbn/charts-plugin/public/mocks';
 import { waitForEuiPopoverOpen } from '@elastic/eui/lib/test/rtl';
+import { chartPluginMock } from '@kbn/charts-plugin/public/mocks';
 
-import { render } from '../../utils/test_helper';
-import { useKibana } from '../../utils/kibana_react';
-import { useCreateSlo } from '../../hooks/slo/use_create_slo';
+import { paths } from '../../../common/locators/paths';
+import { historicalSummaryData } from '../../data/slo/historical_summary_data';
+import { emptySloList, sloList } from '../../data/slo/slo';
+import { useCapabilities } from '../../hooks/slo/use_capabilities';
 import { useCloneSlo } from '../../hooks/slo/use_clone_slo';
+import { useCreateSlo } from '../../hooks/slo/use_create_slo';
 import { useDeleteSlo } from '../../hooks/slo/use_delete_slo';
-import { useFetchSloList } from '../../hooks/slo/use_fetch_slo_list';
 import { useFetchHistoricalSummary } from '../../hooks/slo/use_fetch_historical_summary';
+import { useFetchSloList } from '../../hooks/slo/use_fetch_slo_list';
 import { useLicense } from '../../hooks/use_license';
+import { useKibana } from '../../utils/kibana_react';
+import { render } from '../../utils/test_helper';
 import { SlosPage } from './slos';
-import { emptySloList, sloList } from '../../data/slo/slo';
-import { historicalSummaryData } from '../../data/slo/historical_summary_data';
-import { useCapabilities } from '../../hooks/slo/use_capabilities';
-import { paths } from '../../../common/locators/paths';
 
 jest.mock('react-router-dom', () => ({
   ...jest.requireActual('react-router-dom'),
@@ -51,11 +51,10 @@ const useCapabilitiesMock = useCapabilities as jest.Mock;
 
 const mockCreateSlo = jest.fn();
 const mockCloneSlo = jest.fn();
+const mockDeleteSlo = jest.fn();
 
 useCreateSloMock.mockReturnValue({ mutate: mockCreateSlo });
 useCloneSloMock.mockReturnValue({ mutate: mockCloneSlo });
-
-const mockDeleteSlo = jest.fn();
 useDeleteSloMock.mockReturnValue({ mutate: mockDeleteSlo });
 
 const mockNavigate = jest.fn();
@@ -155,7 +154,7 @@ describe('SLOs Page', () => {
     });
 
     it('navigates to the SLOs Welcome Page when the API has finished loading and there are no results', async () => {
-      useFetchSloListMock.mockReturnValue({ isLoading: false, sloList: emptySloList });
+      useFetchSloListMock.mockReturnValue({ isLoading: false, data: emptySloList });
       useFetchHistoricalSummaryMock.mockReturnValue({
         isLoading: false,
         data: {},
@@ -171,7 +170,7 @@ describe('SLOs Page', () => {
     });
 
     it('should have a create new SLO button', async () => {
-      useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+      useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
 
       useFetchHistoricalSummaryMock.mockReturnValue({
         isLoading: false,
@@ -186,7 +185,7 @@ describe('SLOs Page', () => {
     });
 
     it('should have an Auto Refresh button', async () => {
-      useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+      useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
 
       useFetchHistoricalSummaryMock.mockReturnValue({
         isLoading: false,
@@ -202,7 +201,7 @@ describe('SLOs Page', () => {
 
     describe('when API has returned results', () => {
       it('renders the SLO list with SLO items', async () => {
-        useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+        useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
 
         useFetchHistoricalSummaryMock.mockReturnValue({
           isLoading: false,
@@ -220,7 +219,7 @@ describe('SLOs Page', () => {
       });
 
       it('allows editing an SLO', async () => {
-        useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+        useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
 
         useFetchHistoricalSummaryMock.mockReturnValue({
           isLoading: false,
@@ -247,7 +246,7 @@ describe('SLOs Page', () => {
       });
 
       it('allows creating a new rule for an SLO', async () => {
-        useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+        useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
 
         useFetchHistoricalSummaryMock.mockReturnValue({
           isLoading: false,
@@ -272,7 +271,7 @@ describe('SLOs Page', () => {
       });
 
       it('allows managing rules for an SLO', async () => {
-        useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+        useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
 
         useFetchHistoricalSummaryMock.mockReturnValue({
           isLoading: false,
@@ -297,7 +296,7 @@ describe('SLOs Page', () => {
       });
 
       it('allows deleting an SLO', async () => {
-        useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+        useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
 
         useFetchHistoricalSummaryMock.mockReturnValue({
           isLoading: false,
@@ -327,7 +326,7 @@ describe('SLOs Page', () => {
       });
 
       it('allows cloning an SLO', async () => {
-        useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+        useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
 
         useFetchHistoricalSummaryMock.mockReturnValue({
           isLoading: false,
diff --git a/x-pack/plugins/observability/public/pages/slos/slos.tsx b/x-pack/plugins/observability/public/pages/slos/slos.tsx
index a183d7941f7e1..18fa418e4358b 100644
--- a/x-pack/plugins/observability/public/pages/slos/slos.tsx
+++ b/x-pack/plugins/observability/public/pages/slos/slos.tsx
@@ -32,8 +32,8 @@ export function SlosPage() {
   const { hasWriteCapabilities } = useCapabilities();
   const { hasAtLeast } = useLicense();
 
-  const { isInitialLoading, isLoading, isError, sloList } = useFetchSloList();
-  const { total } = sloList || { total: 0 };
+  const { isInitialLoading, isLoading, isError, data: sloList } = useFetchSloList();
+  const { total } = sloList ?? { total: 0 };
 
   const { storeAutoRefreshState, getAutoRefreshState } = useAutoRefreshStorage();
   const [isAutoRefreshing, setIsAutoRefreshing] = useState<boolean>(getAutoRefreshState());
diff --git a/x-pack/plugins/observability/public/pages/slos_welcome/slos_welcome.test.tsx b/x-pack/plugins/observability/public/pages/slos_welcome/slos_welcome.test.tsx
index fbeae4cb872b2..a6b4f671d306c 100644
--- a/x-pack/plugins/observability/public/pages/slos_welcome/slos_welcome.test.tsx
+++ b/x-pack/plugins/observability/public/pages/slos_welcome/slos_welcome.test.tsx
@@ -56,7 +56,7 @@ describe('SLOs Welcome Page', () => {
 
   describe('when the incorrect license is found', () => {
     it('renders the welcome message with subscription buttons', async () => {
-      useFetchSloListMock.mockReturnValue({ isLoading: false, sloList: emptySloList });
+      useFetchSloListMock.mockReturnValue({ isLoading: false, data: emptySloList });
       useLicenseMock.mockReturnValue({ hasAtLeast: () => false });
       useGlobalDiagnosisMock.mockReturnValue({
         data: {
@@ -82,7 +82,7 @@ describe('SLOs Welcome Page', () => {
 
     describe('when loading is done and no results are found', () => {
       beforeEach(() => {
-        useFetchSloListMock.mockReturnValue({ isLoading: false, emptySloList });
+        useFetchSloListMock.mockReturnValue({ isLoading: false, data: emptySloList });
       });
 
       it('disables the create slo button when no write capabilities', async () => {
@@ -146,7 +146,7 @@ describe('SLOs Welcome Page', () => {
 
     describe('when loading is done and results are found', () => {
       beforeEach(() => {
-        useFetchSloListMock.mockReturnValue({ isLoading: false, sloList });
+        useFetchSloListMock.mockReturnValue({ isLoading: false, data: sloList });
         useGlobalDiagnosisMock.mockReturnValue({
           data: {
             userPrivileges: {
diff --git a/x-pack/plugins/observability/public/pages/slos_welcome/slos_welcome.tsx b/x-pack/plugins/observability/public/pages/slos_welcome/slos_welcome.tsx
index 5c4317cd4e138..16f4a75974453 100644
--- a/x-pack/plugins/observability/public/pages/slos_welcome/slos_welcome.tsx
+++ b/x-pack/plugins/observability/public/pages/slos_welcome/slos_welcome.tsx
@@ -40,8 +40,8 @@ export function SlosWelcomePage() {
   const { hasAtLeast } = useLicense();
   const hasRightLicense = hasAtLeast('platinum');
 
-  const { isLoading, sloList } = useFetchSloList();
-  const { total } = sloList || { total: 0 };
+  const { isLoading, data: sloList } = useFetchSloList();
+  const { total } = sloList ?? { total: 0 };
 
   const hasRequiredWritePrivileges = !!globalDiagnosis?.userPrivileges.write.has_all_requested;
   const hasRequiredReadPrivileges = !!globalDiagnosis?.userPrivileges.read.has_all_requested;
diff --git a/x-pack/plugins/observability/public/utils/slo/labels.ts b/x-pack/plugins/observability/public/utils/slo/labels.ts
index 40c58e624bb2b..43ed455f5a9e3 100644
--- a/x-pack/plugins/observability/public/utils/slo/labels.ts
+++ b/x-pack/plugins/observability/public/utils/slo/labels.ts
@@ -21,6 +21,13 @@ export const INDICATOR_CUSTOM_METRIC = i18n.translate(
   }
 );
 
+export const INDICATOR_TIMESLICE_METRIC = i18n.translate(
+  'xpack.observability.slo.indicators.timesliceMetric',
+  {
+    defaultMessage: 'Timeslice Metric',
+  }
+);
+
 export const INDICATOR_HISTOGRAM = i18n.translate('xpack.observability.slo.indicators.histogram', {
   defaultMessage: 'Histogram Metric',
 });
@@ -54,6 +61,9 @@ export function toIndicatorTypeLabel(
     case 'sli.histogram.custom':
       return INDICATOR_HISTOGRAM;
 
+    case 'sli.metric.timeslice':
+      return INDICATOR_TIMESLICE_METRIC;
+
     default:
       assertNever(indicatorType as never);
   }
diff --git a/x-pack/plugins/observability/server/routes/slo/route.ts b/x-pack/plugins/observability/server/routes/slo/route.ts
index 2dfdcb2308ee3..ade3f1714ddfb 100644
--- a/x-pack/plugins/observability/server/routes/slo/route.ts
+++ b/x-pack/plugins/observability/server/routes/slo/route.ts
@@ -49,6 +49,7 @@ import {
   KQLCustomTransformGenerator,
   MetricCustomTransformGenerator,
   TransformGenerator,
+  TimesliceMetricTransformGenerator,
 } from '../../services/slo/transform_generators';
 import type { ObservabilityRequestHandlerContext } from '../../types';
 import { createObservabilityServerRoute } from '../create_observability_server_route';
@@ -59,6 +60,7 @@ const transformGenerators: Record<IndicatorTypes, TransformGenerator> = {
   'sli.kql.custom': new KQLCustomTransformGenerator(),
   'sli.metric.custom': new MetricCustomTransformGenerator(),
   'sli.histogram.custom': new HistogramTransformGenerator(),
+  'sli.metric.timeslice': new TimesliceMetricTransformGenerator(),
 };
 
 const assertPlatinumLicense = async (context: ObservabilityRequestHandlerContext) => {
diff --git a/x-pack/plugins/observability/server/services/slo/aggregations/__snapshots__/get_timeslice_metric_indicator_aggregation.test.ts.snap b/x-pack/plugins/observability/server/services/slo/aggregations/__snapshots__/get_timeslice_metric_indicator_aggregation.test.ts.snap
new file mode 100644
index 0000000000000..8288087ce3327
--- /dev/null
+++ b/x-pack/plugins/observability/server/services/slo/aggregations/__snapshots__/get_timeslice_metric_indicator_aggregation.test.ts.snap
@@ -0,0 +1,213 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`GetTimesliceMetricIndicatorAggregation should generate an aggregation for basic metrics 1`] = `
+Object {
+  "_A": Object {
+    "aggs": Object {
+      "metric": Object {
+        "avg": Object {
+          "field": "test.field",
+        },
+      },
+    },
+    "filter": Object {
+      "bool": Object {
+        "minimum_should_match": 1,
+        "should": Array [
+          Object {
+            "match": Object {
+              "test.category": "test",
+            },
+          },
+        ],
+      },
+    },
+  },
+  "_B": Object {
+    "aggs": Object {
+      "metric": Object {
+        "max": Object {
+          "field": "test.field",
+        },
+      },
+    },
+    "filter": Object {
+      "match_all": Object {},
+    },
+  },
+  "_C": Object {
+    "aggs": Object {
+      "metric": Object {
+        "min": Object {
+          "field": "test.field",
+        },
+      },
+    },
+    "filter": Object {
+      "match_all": Object {},
+    },
+  },
+  "_D": Object {
+    "aggs": Object {
+      "metric": Object {
+        "sum": Object {
+          "field": "test.field",
+        },
+      },
+    },
+    "filter": Object {
+      "match_all": Object {},
+    },
+  },
+  "_E": Object {
+    "aggs": Object {
+      "metric": Object {
+        "cardinality": Object {
+          "field": "test.field",
+        },
+      },
+    },
+    "filter": Object {
+      "match_all": Object {},
+    },
+  },
+  "_metric": Object {
+    "bucket_script": Object {
+      "buckets_path": Object {
+        "A": "_A>metric",
+        "B": "_B>metric",
+        "C": "_C>metric",
+        "D": "_D>metric",
+        "E": "_E>metric",
+      },
+      "script": Object {
+        "lang": "painless",
+        "source": "(params.A + params.B + params.C + params.D + params.E) / params.A",
+      },
+    },
+  },
+}
+`;
+
+exports[`GetTimesliceMetricIndicatorAggregation should generate an aggregation for doc_count 1`] = `
+Object {
+  "_A": Object {
+    "filter": Object {
+      "bool": Object {
+        "minimum_should_match": 1,
+        "should": Array [
+          Object {
+            "match": Object {
+              "test.category": "test",
+            },
+          },
+        ],
+      },
+    },
+  },
+  "_metric": Object {
+    "bucket_script": Object {
+      "buckets_path": Object {
+        "A": "_A>_count",
+      },
+      "script": Object {
+        "lang": "painless",
+        "source": "params.A",
+      },
+    },
+  },
+}
+`;
+
+exports[`GetTimesliceMetricIndicatorAggregation should generate an aggregation for last_value 1`] = `
+Object {
+  "_A": Object {
+    "aggs": Object {
+      "metric": Object {
+        "top_metrics": Object {
+          "metrics": Object {
+            "field": "test.field",
+          },
+          "sort": Object {
+            "@timestamp": "desc",
+          },
+        },
+      },
+    },
+    "filter": Object {
+      "match_all": Object {},
+    },
+  },
+  "_metric": Object {
+    "bucket_script": Object {
+      "buckets_path": Object {
+        "A": "_A>metric[test.field]",
+      },
+      "script": Object {
+        "lang": "painless",
+        "source": "params.A",
+      },
+    },
+  },
+}
+`;
+
+exports[`GetTimesliceMetricIndicatorAggregation should generate an aggregation for percentile 1`] = `
+Object {
+  "_A": Object {
+    "aggs": Object {
+      "metric": Object {
+        "percentiles": Object {
+          "field": "test.field",
+          "keyed": true,
+          "percents": Array [
+            97,
+          ],
+        },
+      },
+    },
+    "filter": Object {
+      "match_all": Object {},
+    },
+  },
+  "_metric": Object {
+    "bucket_script": Object {
+      "buckets_path": Object {
+        "A": "_A>metric[97]",
+      },
+      "script": Object {
+        "lang": "painless",
+        "source": "params.A",
+      },
+    },
+  },
+}
+`;
+
+exports[`GetTimesliceMetricIndicatorAggregation should generate an aggregation for std_deviation 1`] = `
+Object {
+  "_A": Object {
+    "aggs": Object {
+      "metric": Object {
+        "extended_stats": Object {
+          "field": "test.field",
+        },
+      },
+    },
+    "filter": Object {
+      "match_all": Object {},
+    },
+  },
+  "_metric": Object {
+    "bucket_script": Object {
+      "buckets_path": Object {
+        "A": "_A>metric[std_deviation]",
+      },
+      "script": Object {
+        "lang": "painless",
+        "source": "params.A",
+      },
+    },
+  },
+}
+`;
diff --git a/x-pack/plugins/observability/server/services/slo/aggregations/get_custom_metric_indicator_aggregation.ts b/x-pack/plugins/observability/server/services/slo/aggregations/get_custom_metric_indicator_aggregation.ts
index ceb51bdfef199..73bbb91b1041f 100644
--- a/x-pack/plugins/observability/server/services/slo/aggregations/get_custom_metric_indicator_aggregation.ts
+++ b/x-pack/plugins/observability/server/services/slo/aggregations/get_custom_metric_indicator_aggregation.ts
@@ -37,7 +37,7 @@ export class GetCustomMetricIndicatorAggregation {
   private convertEquationToPainless(bucketsPath: Record<string, string>, equation: string) {
     const workingEquation = equation || Object.keys(bucketsPath).join(' + ');
     return Object.keys(bucketsPath).reduce((acc, key) => {
-      return acc.replace(key, `params.${key}`);
+      return acc.replaceAll(key, `params.${key}`);
     }, workingEquation);
   }
 
diff --git a/x-pack/plugins/observability/server/services/slo/aggregations/get_timeslice_metric_indicator_aggregation.test.ts b/x-pack/plugins/observability/server/services/slo/aggregations/get_timeslice_metric_indicator_aggregation.test.ts
new file mode 100644
index 0000000000000..4f73f186fd343
--- /dev/null
+++ b/x-pack/plugins/observability/server/services/slo/aggregations/get_timeslice_metric_indicator_aggregation.test.ts
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTimesliceMetricIndicator } from '../fixtures/slo';
+import { GetTimesliceMetricIndicatorAggregation } from './get_timeslice_metric_indicator_aggregation';
+
+describe('GetTimesliceMetricIndicatorAggregation', () => {
+  it('should generate an aggregation for basic metrics', () => {
+    const indicator = createTimesliceMetricIndicator(
+      [
+        {
+          name: 'A',
+          aggregation: 'avg' as const,
+          field: 'test.field',
+          filter: 'test.category: test',
+        },
+        {
+          name: 'B',
+          aggregation: 'max' as const,
+          field: 'test.field',
+        },
+        {
+          name: 'C',
+          aggregation: 'min' as const,
+          field: 'test.field',
+        },
+        {
+          name: 'D',
+          aggregation: 'sum' as const,
+          field: 'test.field',
+        },
+        {
+          name: 'E',
+          aggregation: 'cardinality' as const,
+          field: 'test.field',
+        },
+      ],
+      '(A + B + C + D + E) / A'
+    );
+    const getIndicatorAggregation = new GetTimesliceMetricIndicatorAggregation(indicator);
+    expect(getIndicatorAggregation.execute('_metric')).toMatchSnapshot();
+  });
+
+  it('should generate an aggregation for doc_count', () => {
+    const indicator = createTimesliceMetricIndicator(
+      [
+        {
+          name: 'A',
+          aggregation: 'doc_count' as const,
+          filter: 'test.category: test',
+        },
+      ],
+      'A'
+    );
+    const getIndicatorAggregation = new GetTimesliceMetricIndicatorAggregation(indicator);
+    expect(getIndicatorAggregation.execute('_metric')).toMatchSnapshot();
+  });
+
+  it('should generate an aggregation for std_deviation', () => {
+    const indicator = createTimesliceMetricIndicator(
+      [
+        {
+          name: 'A',
+          aggregation: 'std_deviation' as const,
+          field: 'test.field',
+        },
+      ],
+      'A'
+    );
+    const getIndicatorAggregation = new GetTimesliceMetricIndicatorAggregation(indicator);
+    expect(getIndicatorAggregation.execute('_metric')).toMatchSnapshot();
+  });
+
+  it('should generate an aggregation for percentile', () => {
+    const indicator = createTimesliceMetricIndicator(
+      [
+        {
+          name: 'A',
+          aggregation: 'percentile' as const,
+          field: 'test.field',
+          percentile: 97,
+        },
+      ],
+      'A'
+    );
+    const getIndicatorAggregation = new GetTimesliceMetricIndicatorAggregation(indicator);
+    expect(getIndicatorAggregation.execute('_metric')).toMatchSnapshot();
+  });
+
+  it('should generate an aggregation for last_value', () => {
+    const indicator = createTimesliceMetricIndicator(
+      [
+        {
+          name: 'A',
+          aggregation: 'last_value' as const,
+          field: 'test.field',
+        },
+      ],
+      'A'
+    );
+    const getIndicatorAggregation = new GetTimesliceMetricIndicatorAggregation(indicator);
+    expect(getIndicatorAggregation.execute('_metric')).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/plugins/observability/server/services/slo/aggregations/get_timeslice_metric_indicator_aggregation.ts b/x-pack/plugins/observability/server/services/slo/aggregations/get_timeslice_metric_indicator_aggregation.ts
new file mode 100644
index 0000000000000..e715038e324f0
--- /dev/null
+++ b/x-pack/plugins/observability/server/services/slo/aggregations/get_timeslice_metric_indicator_aggregation.ts
@@ -0,0 +1,130 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TimesliceMetricIndicator, timesliceMetricMetricDef } from '@kbn/slo-schema';
+import * as t from 'io-ts';
+import { assertNever } from '@kbn/std';
+
+import { getElastichsearchQueryOrThrow } from '../transform_generators';
+
+type TimesliceMetricDef = TimesliceMetricIndicator['params']['metric'];
+type TimesliceMetricMetricDef = t.TypeOf<typeof timesliceMetricMetricDef>;
+
+export class GetTimesliceMetricIndicatorAggregation {
+  constructor(private indicator: TimesliceMetricIndicator) {}
+
+  private buildAggregation(metric: TimesliceMetricMetricDef) {
+    const { aggregation } = metric;
+    switch (aggregation) {
+      case 'doc_count':
+        return {};
+      case 'std_deviation':
+        return {
+          extended_stats: { field: metric.field },
+        };
+      case 'percentile':
+        if (metric.percentile == null) {
+          throw new Error('You must provide a percentile value for percentile aggregations.');
+        }
+        return {
+          percentiles: {
+            field: metric.field,
+            percents: [metric.percentile],
+            keyed: true,
+          },
+        };
+      case 'last_value':
+        return {
+          top_metrics: {
+            metrics: { field: metric.field },
+            sort: { [this.indicator.params.timestampField]: 'desc' },
+          },
+        };
+      case 'avg':
+      case 'max':
+      case 'min':
+      case 'sum':
+      case 'cardinality':
+        if (metric.field == null) {
+          throw new Error('You must provide a field for basic metric aggregations.');
+        }
+        return {
+          [aggregation]: { field: metric.field },
+        };
+      default:
+        assertNever(aggregation);
+    }
+  }
+
+  private buildBucketPath(prefix: string, metric: TimesliceMetricMetricDef) {
+    const { aggregation } = metric;
+    switch (aggregation) {
+      case 'doc_count':
+        return `${prefix}>_count`;
+      case 'std_deviation':
+        return `${prefix}>metric[std_deviation]`;
+      case 'percentile':
+        return `${prefix}>metric[${metric.percentile}]`;
+      case 'last_value':
+        return `${prefix}>metric[${metric.field}]`;
+      case 'avg':
+      case 'max':
+      case 'min':
+      case 'sum':
+      case 'cardinality':
+        return `${prefix}>metric`;
+      default:
+        assertNever(aggregation);
+    }
+  }
+
+  private buildMetricAggregations(metricDef: TimesliceMetricDef) {
+    return metricDef.metrics.reduce((acc, metric) => {
+      const filter = metric.filter
+        ? getElastichsearchQueryOrThrow(metric.filter)
+        : { match_all: {} };
+      const aggs = { metric: this.buildAggregation(metric) };
+      return {
+        ...acc,
+        [`_${metric.name}`]: {
+          filter,
+          ...(metric.aggregation !== 'doc_count' ? { aggs } : {}),
+        },
+      };
+    }, {});
+  }
+
+  private convertEquationToPainless(bucketsPath: Record<string, string>, equation: string) {
+    const workingEquation = equation || Object.keys(bucketsPath).join(' + ');
+    return Object.keys(bucketsPath).reduce((acc, key) => {
+      return acc.replaceAll(key, `params.${key}`);
+    }, workingEquation);
+  }
+
+  private buildMetricEquation(definition: TimesliceMetricDef) {
+    const bucketsPath = definition.metrics.reduce(
+      (acc, metric) => ({ ...acc, [metric.name]: this.buildBucketPath(`_${metric.name}`, metric) }),
+      {}
+    );
+    return {
+      bucket_script: {
+        buckets_path: bucketsPath,
+        script: {
+          source: this.convertEquationToPainless(bucketsPath, definition.equation),
+          lang: 'painless',
+        },
+      },
+    };
+  }
+
+  public execute(aggregationKey: string) {
+    return {
+      ...this.buildMetricAggregations(this.indicator.params.metric),
+      [aggregationKey]: this.buildMetricEquation(this.indicator.params.metric),
+    };
+  }
+}
diff --git a/x-pack/plugins/observability/server/services/slo/aggregations/index.ts b/x-pack/plugins/observability/server/services/slo/aggregations/index.ts
index b814152a4fcd5..6df05b4b2eac5 100644
--- a/x-pack/plugins/observability/server/services/slo/aggregations/index.ts
+++ b/x-pack/plugins/observability/server/services/slo/aggregations/index.ts
@@ -7,3 +7,4 @@
 
 export * from './get_histogram_indicator_aggregation';
 export * from './get_custom_metric_indicator_aggregation';
+export * from './get_timeslice_metric_indicator_aggregation';
diff --git a/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts b/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts
index 494c54cd65741..e423a0441f9d5 100644
--- a/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts
+++ b/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts
@@ -6,7 +6,13 @@
  */
 
 import { SavedObject } from '@kbn/core-saved-objects-server';
-import { ALL_VALUE, CreateSLOParams, HistogramIndicator, sloSchema } from '@kbn/slo-schema';
+import {
+  ALL_VALUE,
+  CreateSLOParams,
+  HistogramIndicator,
+  sloSchema,
+  TimesliceMetricIndicator,
+} from '@kbn/slo-schema';
 import { cloneDeep } from 'lodash';
 import { v1 as uuidv1 } from 'uuid';
 import {
@@ -90,6 +96,25 @@ export const createMetricCustomIndicator = (
   },
 });
 
+export const createTimesliceMetricIndicator = (
+  metrics: TimesliceMetricIndicator['params']['metric']['metrics'] = [],
+  equation: TimesliceMetricIndicator['params']['metric']['equation'] = '',
+  queryFilter = ''
+): TimesliceMetricIndicator => ({
+  type: 'sli.metric.timeslice',
+  params: {
+    index: 'test-*',
+    timestampField: '@timestamp',
+    filter: queryFilter,
+    metric: {
+      metrics,
+      equation,
+      threshold: 100,
+      comparator: 'GTE',
+    },
+  },
+});
+
 export const createHistogramIndicator = (
   params: Partial<HistogramIndicator['params']> = {}
 ): HistogramIndicator => ({
diff --git a/x-pack/plugins/observability/server/services/slo/get_preview_data.ts b/x-pack/plugins/observability/server/services/slo/get_preview_data.ts
index 98f07e1f8ed5e..2fd80c09d3875 100644
--- a/x-pack/plugins/observability/server/services/slo/get_preview_data.ts
+++ b/x-pack/plugins/observability/server/services/slo/get_preview_data.ts
@@ -15,6 +15,7 @@ import {
   HistogramIndicator,
   KQLCustomIndicator,
   MetricCustomIndicator,
+  TimesliceMetricIndicator,
 } from '@kbn/slo-schema';
 import { assertNever } from '@kbn/std';
 import { APMTransactionDurationIndicator } from '../../domain/models';
@@ -23,6 +24,7 @@ import { InvalidQueryError } from '../../errors';
 import {
   GetCustomMetricIndicatorAggregation,
   GetHistogramIndicatorAggregation,
+  GetTimesliceMetricIndicatorAggregation,
 } from './aggregations';
 
 export class GetPreviewData {
@@ -55,6 +57,7 @@ export class GetPreviewData {
 
     const result = await this.esClient.search({
       index: indicator.params.index,
+      size: 0,
       query: {
         bool: {
           filter: [
@@ -130,6 +133,7 @@ export class GetPreviewData {
 
     const result = await this.esClient.search({
       index: indicator.params.index,
+      size: 0,
       query: {
         bool: {
           filter: [
@@ -186,6 +190,7 @@ export class GetPreviewData {
     const timestampField = indicator.params.timestampField;
     const options = {
       index: indicator.params.index,
+      size: 0,
       query: {
         bool: {
           filter: [{ range: { [timestampField]: { gte: 'now-60m' } } }, filterQuery],
@@ -228,6 +233,7 @@ export class GetPreviewData {
     const getCustomMetricIndicatorAggregation = new GetCustomMetricIndicatorAggregation(indicator);
     const result = await this.esClient.search({
       index: indicator.params.index,
+      size: 0,
       query: {
         bool: {
           filter: [{ range: { [timestampField]: { gte: 'now-60m' } } }, filterQuery],
@@ -261,6 +267,42 @@ export class GetPreviewData {
     }));
   }
 
+  private async getTimesliceMetricPreviewData(
+    indicator: TimesliceMetricIndicator
+  ): Promise<GetPreviewDataResponse> {
+    const timestampField = indicator.params.timestampField;
+    const filterQuery = getElastichsearchQueryOrThrow(indicator.params.filter);
+    const getCustomMetricIndicatorAggregation = new GetTimesliceMetricIndicatorAggregation(
+      indicator
+    );
+    const result = await this.esClient.search({
+      index: indicator.params.index,
+      size: 0,
+      query: {
+        bool: {
+          filter: [{ range: { [timestampField]: { gte: 'now-60m' } } }, filterQuery],
+        },
+      },
+      aggs: {
+        perMinute: {
+          date_histogram: {
+            field: timestampField,
+            fixed_interval: '1m',
+          },
+          aggs: {
+            ...getCustomMetricIndicatorAggregation.execute('metric'),
+          },
+        },
+      },
+    });
+
+    // @ts-ignore buckets is not improperly typed
+    return result.aggregations?.perMinute.buckets.map((bucket) => ({
+      date: bucket.key_as_string,
+      sliValue: !!bucket.metric ? bucket.metric.value : null,
+    }));
+  }
+
   private async getCustomKQLPreviewData(
     indicator: KQLCustomIndicator
   ): Promise<GetPreviewDataResponse> {
@@ -270,6 +312,7 @@ export class GetPreviewData {
     const timestampField = indicator.params.timestampField;
     const result = await this.esClient.search({
       index: indicator.params.index,
+      size: 0,
       query: {
         bool: {
           filter: [{ range: { [timestampField]: { gte: 'now-60m' } } }, filterQuery],
@@ -313,6 +356,8 @@ export class GetPreviewData {
           return this.getHistogramPreviewData(params.indicator);
         case 'sli.metric.custom':
           return this.getCustomMetricPreviewData(params.indicator);
+        case 'sli.metric.timeslice':
+          return this.getTimesliceMetricPreviewData(params.indicator);
         default:
           assertNever(type);
       }
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/timeslice_metric.test.ts.snap b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/timeslice_metric.test.ts.snap
new file mode 100644
index 0000000000000..e2698ba3e1793
--- /dev/null
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/__snapshots__/timeslice_metric.test.ts.snap
@@ -0,0 +1,697 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Timeslice Metric Transform Generator filters the source using the kql query 1`] = `
+Object {
+  "bool": Object {
+    "filter": Array [
+      Object {
+        "range": Object {
+          "@timestamp": Object {
+            "gte": "now-7d/d",
+          },
+        },
+      },
+      Object {
+        "bool": Object {
+          "minimum_should_match": 1,
+          "should": Array [
+            Object {
+              "match_phrase": Object {
+                "test.category": "test",
+              },
+            },
+          ],
+        },
+      },
+    ],
+  },
+}
+`;
+
+exports[`Timeslice Metric Transform Generator returns the expected transform params for timeslices slo 1`] = `
+Object {
+  "_meta": Object {
+    "managed": true,
+    "managed_by": "observability",
+    "version": 2,
+  },
+  "description": "Rolled-up SLI data for SLO: irrelevant",
+  "dest": Object {
+    "index": ".slo-observability.sli-v2",
+    "pipeline": ".slo-observability.sli.pipeline",
+  },
+  "frequency": "1m",
+  "pivot": Object {
+    "aggregations": Object {
+      "_A": Object {
+        "aggs": Object {
+          "metric": Object {
+            "avg": Object {
+              "field": "test.field",
+            },
+          },
+        },
+        "filter": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "test.category": "test",
+                },
+              },
+            ],
+          },
+        },
+      },
+      "_B": Object {
+        "filter": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "test.category": "test",
+                },
+              },
+            ],
+          },
+        },
+      },
+      "_C": Object {
+        "aggs": Object {
+          "metric": Object {
+            "top_metrics": Object {
+              "metrics": Object {
+                "field": "test.field",
+              },
+              "sort": Object {
+                "@timestamp": "desc",
+              },
+            },
+          },
+        },
+        "filter": Object {
+          "match_all": Object {},
+        },
+      },
+      "_D": Object {
+        "aggs": Object {
+          "metric": Object {
+            "extended_stats": Object {
+              "field": "test.field",
+            },
+          },
+        },
+        "filter": Object {
+          "match_all": Object {},
+        },
+      },
+      "_E": Object {
+        "aggs": Object {
+          "metric": Object {
+            "percentiles": Object {
+              "field": "test.field",
+              "keyed": true,
+              "percents": Array [
+                97,
+              ],
+            },
+          },
+        },
+        "filter": Object {
+          "match_all": Object {},
+        },
+      },
+      "_metric": Object {
+        "bucket_script": Object {
+          "buckets_path": Object {
+            "A": "_A>metric",
+            "B": "_B>_count",
+            "C": "_C>metric[test.field]",
+            "D": "_D>metric[std_deviation]",
+            "E": "_E>metric[97]",
+          },
+          "script": Object {
+            "lang": "painless",
+            "source": "(params.A + params.B + params.C + params.D + params.E) / params.B",
+          },
+        },
+      },
+      "slo.denominator": Object {
+        "bucket_script": Object {
+          "buckets_path": Object {},
+          "script": "1",
+        },
+      },
+      "slo.isGoodSlice": Object {
+        "bucket_script": Object {
+          "buckets_path": Object {
+            "goodEvents": "slo.numerator>value",
+          },
+          "script": "params.goodEvents == 1 ? 1 : 0",
+        },
+      },
+      "slo.numerator": Object {
+        "bucket_script": Object {
+          "buckets_path": Object {
+            "value": "_metric>value",
+          },
+          "script": Object {
+            "params": Object {
+              "threshold": 100,
+            },
+            "source": "params.value >= params.threshold ? 1 : 0",
+          },
+        },
+      },
+    },
+    "group_by": Object {
+      "@timestamp": Object {
+        "date_histogram": Object {
+          "field": "@timestamp",
+          "fixed_interval": "2m",
+        },
+      },
+      "slo.budgetingMethod": Object {
+        "terms": Object {
+          "field": "slo.budgetingMethod",
+        },
+      },
+      "slo.description": Object {
+        "terms": Object {
+          "field": "slo.description",
+        },
+      },
+      "slo.groupBy": Object {
+        "terms": Object {
+          "field": "slo.groupBy",
+        },
+      },
+      "slo.id": Object {
+        "terms": Object {
+          "field": "slo.id",
+        },
+      },
+      "slo.indicator.type": Object {
+        "terms": Object {
+          "field": "slo.indicator.type",
+        },
+      },
+      "slo.instanceId": Object {
+        "terms": Object {
+          "field": "slo.instanceId",
+        },
+      },
+      "slo.name": Object {
+        "terms": Object {
+          "field": "slo.name",
+        },
+      },
+      "slo.objective.sliceDurationInSeconds": Object {
+        "terms": Object {
+          "field": "slo.objective.sliceDurationInSeconds",
+        },
+      },
+      "slo.objective.target": Object {
+        "terms": Object {
+          "field": "slo.objective.target",
+        },
+      },
+      "slo.revision": Object {
+        "terms": Object {
+          "field": "slo.revision",
+        },
+      },
+      "slo.tags": Object {
+        "terms": Object {
+          "field": "slo.tags",
+        },
+      },
+      "slo.timeWindow.duration": Object {
+        "terms": Object {
+          "field": "slo.timeWindow.duration",
+        },
+      },
+      "slo.timeWindow.type": Object {
+        "terms": Object {
+          "field": "slo.timeWindow.type",
+        },
+      },
+    },
+  },
+  "settings": Object {
+    "deduce_mappings": false,
+    "unattended": true,
+  },
+  "source": Object {
+    "index": "test-*",
+    "query": Object {
+      "bool": Object {
+        "filter": Array [
+          Object {
+            "range": Object {
+              "@timestamp": Object {
+                "gte": "now-7d/d",
+              },
+            },
+          },
+          Object {
+            "bool": Object {
+              "minimum_should_match": 1,
+              "should": Array [
+                Object {
+                  "match_phrase": Object {
+                    "test.category": "test",
+                  },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+    "runtime_mappings": Object {
+      "slo.budgetingMethod": Object {
+        "script": Object {
+          "source": "emit('timeslices')",
+        },
+        "type": "keyword",
+      },
+      "slo.description": Object {
+        "script": Object {
+          "source": "emit('irrelevant')",
+        },
+        "type": "keyword",
+      },
+      "slo.groupBy": Object {
+        "script": Object {
+          "source": "emit('*')",
+        },
+        "type": "keyword",
+      },
+      "slo.id": Object {
+        "script": Object {
+          "source": Any<String>,
+        },
+        "type": "keyword",
+      },
+      "slo.indicator.type": Object {
+        "script": Object {
+          "source": "emit('sli.metric.timeslice')",
+        },
+        "type": "keyword",
+      },
+      "slo.instanceId": Object {
+        "script": Object {
+          "source": "emit('*')",
+        },
+        "type": "keyword",
+      },
+      "slo.name": Object {
+        "script": Object {
+          "source": "emit('irrelevant')",
+        },
+        "type": "keyword",
+      },
+      "slo.objective.sliceDurationInSeconds": Object {
+        "script": Object {
+          "source": "emit(120)",
+        },
+        "type": "long",
+      },
+      "slo.objective.target": Object {
+        "script": Object {
+          "source": "emit(0.98)",
+        },
+        "type": "double",
+      },
+      "slo.revision": Object {
+        "script": Object {
+          "source": "emit(1)",
+        },
+        "type": "long",
+      },
+      "slo.tags": Object {
+        "script": Object {
+          "source": "emit('critical,k8s')",
+        },
+        "type": "keyword",
+      },
+      "slo.timeWindow.duration": Object {
+        "script": Object {
+          "source": "emit('7d')",
+        },
+        "type": "keyword",
+      },
+      "slo.timeWindow.type": Object {
+        "script": Object {
+          "source": "emit('rolling')",
+        },
+        "type": "keyword",
+      },
+    },
+  },
+  "sync": Object {
+    "time": Object {
+      "delay": "1m",
+      "field": "@timestamp",
+    },
+  },
+  "transform_id": Any<String>,
+}
+`;
+
+exports[`Timeslice Metric Transform Generator returns the expected transform params with every specified indicator params 1`] = `
+Object {
+  "_meta": Object {
+    "managed": true,
+    "managed_by": "observability",
+    "version": 2,
+  },
+  "description": "Rolled-up SLI data for SLO: irrelevant",
+  "dest": Object {
+    "index": ".slo-observability.sli-v2",
+    "pipeline": ".slo-observability.sli.pipeline",
+  },
+  "frequency": "1m",
+  "pivot": Object {
+    "aggregations": Object {
+      "_A": Object {
+        "aggs": Object {
+          "metric": Object {
+            "avg": Object {
+              "field": "test.field",
+            },
+          },
+        },
+        "filter": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "test.category": "test",
+                },
+              },
+            ],
+          },
+        },
+      },
+      "_B": Object {
+        "filter": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "test.category": "test",
+                },
+              },
+            ],
+          },
+        },
+      },
+      "_C": Object {
+        "aggs": Object {
+          "metric": Object {
+            "top_metrics": Object {
+              "metrics": Object {
+                "field": "test.field",
+              },
+              "sort": Object {
+                "@timestamp": "desc",
+              },
+            },
+          },
+        },
+        "filter": Object {
+          "match_all": Object {},
+        },
+      },
+      "_D": Object {
+        "aggs": Object {
+          "metric": Object {
+            "extended_stats": Object {
+              "field": "test.field",
+            },
+          },
+        },
+        "filter": Object {
+          "match_all": Object {},
+        },
+      },
+      "_E": Object {
+        "aggs": Object {
+          "metric": Object {
+            "percentiles": Object {
+              "field": "test.field",
+              "keyed": true,
+              "percents": Array [
+                97,
+              ],
+            },
+          },
+        },
+        "filter": Object {
+          "match_all": Object {},
+        },
+      },
+      "_metric": Object {
+        "bucket_script": Object {
+          "buckets_path": Object {
+            "A": "_A>metric",
+            "B": "_B>_count",
+            "C": "_C>metric[test.field]",
+            "D": "_D>metric[std_deviation]",
+            "E": "_E>metric[97]",
+          },
+          "script": Object {
+            "lang": "painless",
+            "source": "(params.A + params.B + params.C + params.D + params.E) / params.B",
+          },
+        },
+      },
+      "slo.denominator": Object {
+        "bucket_script": Object {
+          "buckets_path": Object {},
+          "script": "1",
+        },
+      },
+      "slo.isGoodSlice": Object {
+        "bucket_script": Object {
+          "buckets_path": Object {
+            "goodEvents": "slo.numerator>value",
+          },
+          "script": "params.goodEvents == 1 ? 1 : 0",
+        },
+      },
+      "slo.numerator": Object {
+        "bucket_script": Object {
+          "buckets_path": Object {
+            "value": "_metric>value",
+          },
+          "script": Object {
+            "params": Object {
+              "threshold": 100,
+            },
+            "source": "params.value >= params.threshold ? 1 : 0",
+          },
+        },
+      },
+    },
+    "group_by": Object {
+      "@timestamp": Object {
+        "date_histogram": Object {
+          "field": "@timestamp",
+          "fixed_interval": "2m",
+        },
+      },
+      "slo.budgetingMethod": Object {
+        "terms": Object {
+          "field": "slo.budgetingMethod",
+        },
+      },
+      "slo.description": Object {
+        "terms": Object {
+          "field": "slo.description",
+        },
+      },
+      "slo.groupBy": Object {
+        "terms": Object {
+          "field": "slo.groupBy",
+        },
+      },
+      "slo.id": Object {
+        "terms": Object {
+          "field": "slo.id",
+        },
+      },
+      "slo.indicator.type": Object {
+        "terms": Object {
+          "field": "slo.indicator.type",
+        },
+      },
+      "slo.instanceId": Object {
+        "terms": Object {
+          "field": "slo.instanceId",
+        },
+      },
+      "slo.name": Object {
+        "terms": Object {
+          "field": "slo.name",
+        },
+      },
+      "slo.objective.sliceDurationInSeconds": Object {
+        "terms": Object {
+          "field": "slo.objective.sliceDurationInSeconds",
+        },
+      },
+      "slo.objective.target": Object {
+        "terms": Object {
+          "field": "slo.objective.target",
+        },
+      },
+      "slo.revision": Object {
+        "terms": Object {
+          "field": "slo.revision",
+        },
+      },
+      "slo.tags": Object {
+        "terms": Object {
+          "field": "slo.tags",
+        },
+      },
+      "slo.timeWindow.duration": Object {
+        "terms": Object {
+          "field": "slo.timeWindow.duration",
+        },
+      },
+      "slo.timeWindow.type": Object {
+        "terms": Object {
+          "field": "slo.timeWindow.type",
+        },
+      },
+    },
+  },
+  "settings": Object {
+    "deduce_mappings": false,
+    "unattended": true,
+  },
+  "source": Object {
+    "index": "test-*",
+    "query": Object {
+      "bool": Object {
+        "filter": Array [
+          Object {
+            "range": Object {
+              "@timestamp": Object {
+                "gte": "now-7d/d",
+              },
+            },
+          },
+          Object {
+            "bool": Object {
+              "minimum_should_match": 1,
+              "should": Array [
+                Object {
+                  "match_phrase": Object {
+                    "test.category": "test",
+                  },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    },
+    "runtime_mappings": Object {
+      "slo.budgetingMethod": Object {
+        "script": Object {
+          "source": "emit('timeslices')",
+        },
+        "type": "keyword",
+      },
+      "slo.description": Object {
+        "script": Object {
+          "source": "emit('irrelevant')",
+        },
+        "type": "keyword",
+      },
+      "slo.groupBy": Object {
+        "script": Object {
+          "source": "emit('*')",
+        },
+        "type": "keyword",
+      },
+      "slo.id": Object {
+        "script": Object {
+          "source": Any<String>,
+        },
+        "type": "keyword",
+      },
+      "slo.indicator.type": Object {
+        "script": Object {
+          "source": "emit('sli.metric.timeslice')",
+        },
+        "type": "keyword",
+      },
+      "slo.instanceId": Object {
+        "script": Object {
+          "source": "emit('*')",
+        },
+        "type": "keyword",
+      },
+      "slo.name": Object {
+        "script": Object {
+          "source": "emit('irrelevant')",
+        },
+        "type": "keyword",
+      },
+      "slo.objective.sliceDurationInSeconds": Object {
+        "script": Object {
+          "source": "emit(120)",
+        },
+        "type": "long",
+      },
+      "slo.objective.target": Object {
+        "script": Object {
+          "source": "emit(0.98)",
+        },
+        "type": "double",
+      },
+      "slo.revision": Object {
+        "script": Object {
+          "source": "emit(1)",
+        },
+        "type": "long",
+      },
+      "slo.tags": Object {
+        "script": Object {
+          "source": "emit('critical,k8s')",
+        },
+        "type": "keyword",
+      },
+      "slo.timeWindow.duration": Object {
+        "script": Object {
+          "source": "emit('7d')",
+        },
+        "type": "keyword",
+      },
+      "slo.timeWindow.type": Object {
+        "script": Object {
+          "source": "emit('rolling')",
+        },
+        "type": "keyword",
+      },
+    },
+  },
+  "sync": Object {
+    "time": Object {
+      "delay": "1m",
+      "field": "@timestamp",
+    },
+  },
+  "transform_id": Any<String>,
+}
+`;
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/index.ts b/x-pack/plugins/observability/server/services/slo/transform_generators/index.ts
index 2b9337546d796..8bfaf865f340c 100644
--- a/x-pack/plugins/observability/server/services/slo/transform_generators/index.ts
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/index.ts
@@ -11,4 +11,5 @@ export * from './apm_transaction_duration';
 export * from './kql_custom';
 export * from './metric_custom';
 export * from './histogram';
+export * from './timeslice_metric';
 export * from './common';
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/timeslice_metric.test.ts b/x-pack/plugins/observability/server/services/slo/transform_generators/timeslice_metric.test.ts
new file mode 100644
index 0000000000000..aa21f7e0ceb0e
--- /dev/null
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/timeslice_metric.test.ts
@@ -0,0 +1,178 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  createTimesliceMetricIndicator,
+  createSLOWithTimeslicesBudgetingMethod,
+  createSLO,
+} from '../fixtures/slo';
+import { TimesliceMetricTransformGenerator } from './timeslice_metric';
+
+const generator = new TimesliceMetricTransformGenerator();
+const everythingIndicator = createTimesliceMetricIndicator(
+  [
+    { name: 'A', aggregation: 'avg', field: 'test.field', filter: 'test.category: "test"' },
+    { name: 'B', aggregation: 'doc_count', filter: 'test.category: "test"' },
+    { name: 'C', aggregation: 'last_value', field: 'test.field' },
+    { name: 'D', aggregation: 'std_deviation', field: 'test.field' },
+    { name: 'E', aggregation: 'percentile', field: 'test.field', percentile: 97 },
+  ],
+  '(A + B + C + D + E) / B',
+  'test.category: "test"'
+);
+
+describe('Timeslice Metric Transform Generator', () => {
+  describe('validation', () => {
+    it('throws when the budgeting method is occurrences', () => {
+      const anSLO = createSLO({
+        indicator: createTimesliceMetricIndicator(
+          [{ name: 'A', aggregation: 'avg', field: 'test.field' }],
+          '(A / 200) + A'
+        ),
+      });
+      expect(() => generator.getTransformParams(anSLO)).toThrow(
+        'The sli.metric.timeslice indicator MUST have a timeslice budgeting method.'
+      );
+    });
+    it('throws when the metric equation is invalid', () => {
+      const anSLO = createSLOWithTimeslicesBudgetingMethod({
+        indicator: createTimesliceMetricIndicator(
+          [{ name: 'A', aggregation: 'avg', field: 'test.field' }],
+          '(a / 200) + A'
+        ),
+      });
+      expect(() => generator.getTransformParams(anSLO)).toThrow(/Invalid equation/);
+    });
+    it('throws when the metric filter is invalid', () => {
+      const anSLO = createSLOWithTimeslicesBudgetingMethod({
+        indicator: createTimesliceMetricIndicator(
+          [{ name: 'A', aggregation: 'avg', field: 'test.field', filter: 'test:' }],
+          '(A / 200) + A'
+        ),
+      });
+      expect(() => generator.getTransformParams(anSLO)).toThrow(/Invalid KQL: test:/);
+    });
+    it('throws when the query_filter is invalid', () => {
+      const anSLO = createSLOWithTimeslicesBudgetingMethod({
+        indicator: createTimesliceMetricIndicator(
+          [{ name: 'A', aggregation: 'avg', field: 'test.field', filter: 'test.category: "test"' }],
+          '(A / 200) + A',
+          'test:'
+        ),
+      });
+      expect(() => generator.getTransformParams(anSLO)).toThrow(/Invalid KQL/);
+    });
+  });
+
+  it('returns the expected transform params with every specified indicator params', async () => {
+    const anSLO = createSLOWithTimeslicesBudgetingMethod({
+      indicator: everythingIndicator,
+    });
+    const transform = generator.getTransformParams(anSLO);
+
+    expect(transform).toMatchSnapshot({
+      transform_id: expect.any(String),
+      source: { runtime_mappings: { 'slo.id': { script: { source: expect.any(String) } } } },
+    });
+    expect(transform.transform_id).toEqual(`slo-${anSLO.id}-${anSLO.revision}`);
+    expect(transform.source.runtime_mappings!['slo.id']).toMatchObject({
+      script: { source: `emit('${anSLO.id}')` },
+    });
+    expect(transform.source.runtime_mappings!['slo.revision']).toMatchObject({
+      script: { source: `emit(${anSLO.revision})` },
+    });
+  });
+
+  it('returns the expected transform params for timeslices slo', async () => {
+    const anSLO = createSLOWithTimeslicesBudgetingMethod({
+      indicator: everythingIndicator,
+    });
+    const transform = generator.getTransformParams(anSLO);
+
+    expect(transform).toMatchSnapshot({
+      transform_id: expect.any(String),
+      source: { runtime_mappings: { 'slo.id': { script: { source: expect.any(String) } } } },
+    });
+  });
+
+  it('filters the source using the kql query', async () => {
+    const anSLO = createSLOWithTimeslicesBudgetingMethod({
+      indicator: everythingIndicator,
+    });
+    const transform = generator.getTransformParams(anSLO);
+
+    expect(transform.source.query).toMatchSnapshot();
+  });
+
+  it('uses the provided index', async () => {
+    const anSLO = createSLOWithTimeslicesBudgetingMethod({
+      indicator: {
+        ...everythingIndicator,
+        params: { ...everythingIndicator.params, index: 'my-own-index*' },
+      },
+    });
+    const transform = generator.getTransformParams(anSLO);
+
+    expect(transform.source.index).toBe('my-own-index*');
+  });
+
+  it('uses the provided timestampField', async () => {
+    const anSLO = createSLOWithTimeslicesBudgetingMethod({
+      indicator: {
+        ...everythingIndicator,
+        params: { ...everythingIndicator.params, timestampField: 'my-date-field' },
+      },
+    });
+    const transform = generator.getTransformParams(anSLO);
+
+    expect(transform.sync?.time?.field).toBe('my-date-field');
+    // @ts-ignore
+    expect(transform.pivot?.group_by['@timestamp'].date_histogram.field).toBe('my-date-field');
+  });
+
+  it('aggregates using the _metric equation', async () => {
+    const anSLO = createSLOWithTimeslicesBudgetingMethod({
+      indicator: everythingIndicator,
+    });
+    const transform = generator.getTransformParams(anSLO);
+
+    expect(transform.pivot!.aggregations!._metric).toEqual({
+      bucket_script: {
+        buckets_path: {
+          A: '_A>metric',
+          B: '_B>_count',
+          C: '_C>metric[test.field]',
+          D: '_D>metric[std_deviation]',
+          E: '_E>metric[97]',
+        },
+        script: {
+          lang: 'painless',
+          source: '(params.A + params.B + params.C + params.D + params.E) / params.B',
+        },
+      },
+    });
+    expect(transform.pivot!.aggregations!['slo.numerator']).toEqual({
+      bucket_script: {
+        buckets_path: {
+          value: '_metric>value',
+        },
+        script: {
+          params: {
+            threshold: 100,
+          },
+          source: 'params.value >= params.threshold ? 1 : 0',
+        },
+      },
+    });
+    expect(transform.pivot!.aggregations!['slo.denominator']).toEqual({
+      bucket_script: {
+        buckets_path: {},
+        script: '1',
+      },
+    });
+  });
+});
diff --git a/x-pack/plugins/observability/server/services/slo/transform_generators/timeslice_metric.ts b/x-pack/plugins/observability/server/services/slo/transform_generators/timeslice_metric.ts
new file mode 100644
index 0000000000000..944b7d0622aad
--- /dev/null
+++ b/x-pack/plugins/observability/server/services/slo/transform_generators/timeslice_metric.ts
@@ -0,0 +1,116 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TransformPutTransformRequest } from '@elastic/elasticsearch/lib/api/types';
+import {
+  timesliceMetricComparatorMapping,
+  TimesliceMetricIndicator,
+  timesliceMetricIndicatorSchema,
+  timeslicesBudgetingMethodSchema,
+} from '@kbn/slo-schema';
+
+import { InvalidTransformError } from '../../../errors';
+import { getSLOTransformTemplate } from '../../../assets/transform_templates/slo_transform_template';
+import { getElastichsearchQueryOrThrow, parseIndex, TransformGenerator } from '.';
+import {
+  SLO_DESTINATION_INDEX_NAME,
+  SLO_INGEST_PIPELINE_NAME,
+  getSLOTransformId,
+} from '../../../assets/constants';
+import { SLO } from '../../../domain/models';
+import { GetTimesliceMetricIndicatorAggregation } from '../aggregations';
+
+const INVALID_EQUATION_REGEX = /[^A-Z|+|\-|\s|\d+|\.|\(|\)|\/|\*|>|<|=|\?|\:|&|\!|\|]+/g;
+
+export class TimesliceMetricTransformGenerator extends TransformGenerator {
+  public getTransformParams(slo: SLO): TransformPutTransformRequest {
+    if (!timesliceMetricIndicatorSchema.is(slo.indicator)) {
+      throw new InvalidTransformError(`Cannot handle SLO of indicator type: ${slo.indicator.type}`);
+    }
+
+    return getSLOTransformTemplate(
+      this.buildTransformId(slo),
+      this.buildDescription(slo),
+      this.buildSource(slo, slo.indicator),
+      this.buildDestination(),
+      this.buildCommonGroupBy(slo, slo.indicator.params.timestampField),
+      this.buildAggregations(slo, slo.indicator),
+      this.buildSettings(slo, slo.indicator.params.timestampField)
+    );
+  }
+
+  private buildTransformId(slo: SLO): string {
+    return getSLOTransformId(slo.id, slo.revision);
+  }
+
+  private buildSource(slo: SLO, indicator: TimesliceMetricIndicator) {
+    return {
+      index: parseIndex(indicator.params.index),
+      runtime_mappings: this.buildCommonRuntimeMappings(slo),
+      query: {
+        bool: {
+          filter: [
+            {
+              range: {
+                [indicator.params.timestampField]: {
+                  gte: `now-${slo.timeWindow.duration.format()}/d`,
+                },
+              },
+            },
+            getElastichsearchQueryOrThrow(indicator.params.filter),
+          ],
+        },
+      },
+    };
+  }
+
+  private buildDestination() {
+    return {
+      pipeline: SLO_INGEST_PIPELINE_NAME,
+      index: SLO_DESTINATION_INDEX_NAME,
+    };
+  }
+
+  private buildAggregations(slo: SLO, indicator: TimesliceMetricIndicator) {
+    if (indicator.params.metric.equation.match(INVALID_EQUATION_REGEX)) {
+      throw new Error(`Invalid equation: ${indicator.params.metric.equation}`);
+    }
+
+    if (!timeslicesBudgetingMethodSchema.is(slo.budgetingMethod)) {
+      throw new Error('The sli.metric.timeslice indicator MUST have a timeslice budgeting method.');
+    }
+
+    const getIndicatorAggregation = new GetTimesliceMetricIndicatorAggregation(indicator);
+    const comparator = timesliceMetricComparatorMapping[indicator.params.metric.comparator];
+    return {
+      ...getIndicatorAggregation.execute('_metric'),
+      'slo.numerator': {
+        bucket_script: {
+          buckets_path: { value: '_metric>value' },
+          script: {
+            source: `params.value ${comparator} params.threshold ? 1 : 0`,
+            params: { threshold: indicator.params.metric.threshold },
+          },
+        },
+      },
+      'slo.denominator': {
+        bucket_script: {
+          buckets_path: {},
+          script: '1',
+        },
+      },
+      'slo.isGoodSlice': {
+        bucket_script: {
+          buckets_path: {
+            goodEvents: 'slo.numerator>value',
+          },
+          script: `params.goodEvents == 1 ? 1 : 0`,
+        },
+      },
+    };
+  }
+}
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_actions_menu.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_actions_menu.tsx
index d33d622d4a0f8..457106d474806 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_actions_menu.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_actions_menu.tsx
@@ -170,28 +170,26 @@ export function ChatActionsMenu({
             content: (
               <EuiPanel>
                 <EuiText size="s">
-                  <p>
+                  {i18n.translate(
+                    'xpack.observabilityAiAssistant.chatHeader.actions.knowledgeBase.description.paragraph',
+                    {
+                      defaultMessage:
+                        'Using a knowledge base is optional but improves the experience of using the Assistant significantly.',
+                    }
+                  )}{' '}
+                  <EuiLink
+                    data-test-subj="observabilityAiAssistantChatActionsMenuLearnMoreLink"
+                    external
+                    target="_blank"
+                    href="https://www.elastic.co/guide/en/machine-learning/current/ml-nlp-elser.html"
+                  >
                     {i18n.translate(
-                      'xpack.observabilityAiAssistant.chatHeader.actions.knowledgeBase.description.paragraph',
+                      'xpack.observabilityAiAssistant.chatHeader.actions.knowledgeBase.elser.learnMore',
                       {
-                        defaultMessage:
-                          'Using a knowledge base is optional but improves the experience of using the Assistant significantly.',
+                        defaultMessage: 'Learn more',
                       }
-                    )}{' '}
-                    <EuiLink
-                      data-test-subj="observabilityAiAssistantChatActionsMenuLearnMoreLink"
-                      external
-                      target="_blank"
-                      href="https://www.elastic.co/guide/en/machine-learning/current/ml-nlp-elser.html"
-                    >
-                      {i18n.translate(
-                        'xpack.observabilityAiAssistant.chatHeader.actions.knowledgeBase.elser.learnMore',
-                        {
-                          defaultMessage: 'Learn more',
-                        }
-                      )}
-                    </EuiLink>
-                  </p>
+                    )}
+                  </EuiLink>
                 </EuiText>
 
                 <EuiSpacer size="l" />
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_body.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_body.tsx
index f49ebe8c62b92..5e4aa5e0659eb 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_body.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_body.tsx
@@ -6,7 +6,7 @@
  */
 
 import React, { useEffect, useRef, useState } from 'react';
-import { last } from 'lodash';
+import { flatten, last } from 'lodash';
 import {
   EuiFlexGroup,
   EuiFlexItem,
@@ -94,7 +94,7 @@ export function ChatBody({
   let footer: React.ReactNode;
 
   const isLoading = Boolean(
-    connectors.loading || knowledgeBase.status.loading || last(timeline.items)?.loading
+    connectors.loading || knowledgeBase.status.loading || last(flatten(timeline.items))?.loading
   );
 
   const containerClassName = css`
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_consolidated_items.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_consolidated_items.tsx
new file mode 100644
index 0000000000000..346ccfe501f37
--- /dev/null
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_consolidated_items.tsx
@@ -0,0 +1,136 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiAvatar, EuiButtonIcon, EuiComment, EuiLink } from '@elastic/eui';
+import { css } from '@emotion/css';
+import { ChatItem } from './chat_item';
+import type { ChatTimelineItem, ChatTimelineProps } from './chat_timeline';
+
+const noPanelStyle = css`
+  .euiCommentEvent {
+    border: none;
+  }
+
+  .euiCommentEvent__header {
+    background: transparent;
+    border-block-end: none;
+  }
+
+  .euiCommentEvent__body {
+    display: none;
+  }
+
+  .euiLink {
+    padding: 0 8px;
+  }
+
+  .euiLink:focus {
+    text-decoration: none;
+  }
+
+  .euiLink:hover {
+    text-decoration: underline;
+  }
+`;
+
+const avatarStyle = css`
+  cursor: 'pointer';
+`;
+
+export function ChatConsolidatedItems({
+  consolidatedItem,
+  onFeedback,
+  onRegenerate,
+  onEditSubmit,
+  onStopGenerating,
+  onActionClick,
+}: {
+  consolidatedItem: ChatTimelineItem[];
+  onFeedback: ChatTimelineProps['onFeedback'];
+  onRegenerate: ChatTimelineProps['onRegenerate'];
+  onEditSubmit: ChatTimelineProps['onEdit'];
+  onStopGenerating: ChatTimelineProps['onStopGenerating'];
+  onActionClick: ChatTimelineProps['onActionClick'];
+}) {
+  const [expanded, setExpanded] = useState(false);
+
+  const handleToggleExpand = () => {
+    setExpanded(!expanded);
+  };
+
+  return (
+    <>
+      <EuiComment
+        className={noPanelStyle}
+        timelineAvatar={
+          <EuiAvatar
+            color="subdued"
+            css={avatarStyle}
+            name="inspect"
+            iconType="layers"
+            onClick={handleToggleExpand}
+          />
+        }
+        event={
+          <EuiLink
+            color="subdued"
+            data-test-subj="observabilityAiAssistantChatCollapsedItemsCollapsedItemsLink"
+            onClick={handleToggleExpand}
+          >
+            <em>
+              {!expanded
+                ? i18n.translate('xpack.observabilityAiAssistant.chatCollapsedItems.showEvents', {
+                    defaultMessage: 'Show {count} events',
+                    values: { count: consolidatedItem.length },
+                  })
+                : i18n.translate('xpack.observabilityAiAssistant.chatCollapsedItems.hideEvents', {
+                    defaultMessage: 'Hide {count} events',
+                    values: { count: consolidatedItem.length },
+                  })}
+            </em>
+          </EuiLink>
+        }
+        username=""
+        actions={
+          <EuiButtonIcon
+            aria-label={i18n.translate(
+              'xpack.observabilityAiAssistant.chatCollapsedItems.toggleButtonLabel',
+              {
+                defaultMessage: 'Show / hide items',
+              }
+            )}
+            color="text"
+            data-test-subj="observabilityAiAssistantChatCollapsedItemsButton"
+            iconType={expanded ? 'arrowUp' : 'arrowDown'}
+            onClick={handleToggleExpand}
+          />
+        }
+      />
+
+      {expanded
+        ? consolidatedItem.map((item, index) => (
+            <ChatItem
+              // use index, not id to prevent unmounting of component when message is persisted
+              key={index}
+              {...item}
+              onFeedbackClick={(feedback) => {
+                onFeedback(item, feedback);
+              }}
+              onRegenerateClick={() => {
+                onRegenerate(item);
+              }}
+              onEditSubmit={(message) => onEditSubmit(item, message)}
+              onStopGeneratingClick={onStopGenerating}
+              onActionClick={onActionClick}
+            />
+          ))
+        : null}
+    </>
+  );
+}
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_item_actions.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_item_actions.tsx
index 64585d2f52ecc..4995b0163b7be 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_item_actions.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_item_actions.tsx
@@ -101,14 +101,12 @@ export function ChatItemActions({
           closePopover={() => setIsPopoverOpen(undefined)}
         >
           <EuiText size="s">
-            <p>
-              {i18n.translate(
-                'xpack.observabilityAiAssistant.chatTimeline.actions.copyMessageSuccessful',
-                {
-                  defaultMessage: 'Copied message',
-                }
-              )}
-            </p>
+            {i18n.translate(
+              'xpack.observabilityAiAssistant.chatTimeline.actions.copyMessageSuccessful',
+              {
+                defaultMessage: 'Copied message',
+              }
+            )}
           </EuiText>
         </EuiPopover>
       ) : null}
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_prompt_editor.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_prompt_editor.tsx
index 124927564eec1..21e9e3871205c 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_prompt_editor.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_prompt_editor.tsx
@@ -102,7 +102,7 @@ export function ChatPromptEditor({
   }, [functionEditorLineCount, model]);
 
   const handleSubmit = useCallback(async () => {
-    if (loading || !prompt?.trim()) {
+    if (loading || (!prompt?.trim() && !selectedFunctionName)) {
       return;
     }
     const currentPrompt = prompt;
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_timeline.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_timeline.tsx
index a50a9984cf40e..e42924e765609 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_timeline.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_timeline.tsx
@@ -6,16 +6,16 @@
  */
 
 import React, { ReactNode } from 'react';
-import { css } from '@emotion/react';
-import { compact } from 'lodash';
+import { css } from '@emotion/css';
 import { EuiCommentList } from '@elastic/eui';
 import type { AuthenticatedUser } from '@kbn/security-plugin/common';
 import { ChatItem } from './chat_item';
 import { ChatWelcomePanel } from './chat_welcome_panel';
+import { ChatConsolidatedItems } from './chat_consolidated_items';
 import type { Feedback } from '../feedback_buttons';
-import type { Message } from '../../../common';
-import { UseKnowledgeBaseResult } from '../../hooks/use_knowledge_base';
-import { ChatActionClickHandler } from './types';
+import { type Message } from '../../../common';
+import type { UseKnowledgeBaseResult } from '../../hooks/use_knowledge_base';
+import type { ChatActionClickHandler } from './types';
 
 export interface ChatTimelineItem
   extends Pick<Message['message'], 'role' | 'content' | 'function_call'> {
@@ -38,7 +38,7 @@ export interface ChatTimelineItem
 }
 
 export interface ChatTimelineProps {
-  items: ChatTimelineItem[];
+  items: Array<ChatTimelineItem | ChatTimelineItem[]>;
   knowledgeBase: UseKnowledgeBaseResult;
   onEdit: (item: ChatTimelineItem, message: Message) => Promise<void>;
   onFeedback: (item: ChatTimelineItem, feedback: Feedback) => void;
@@ -56,35 +56,44 @@ export function ChatTimeline({
   onStopGenerating,
   onActionClick,
 }: ChatTimelineProps) {
-  const filteredItems = items.filter((item) => !item.display.hide);
-
   return (
     <EuiCommentList
       css={css`
         padding-bottom: 32px;
       `}
     >
-      {compact(
-        filteredItems.map((item, index) => (
-          <ChatItem
-            // use index, not id to prevent unmounting of component when message is persisted
-            key={index}
-            {...item}
-            onFeedbackClick={(feedback) => {
-              onFeedback(item, feedback);
-            }}
-            onRegenerateClick={() => {
-              onRegenerate(item);
-            }}
-            onEditSubmit={(message) => {
-              return onEdit(item, message);
-            }}
-            onStopGeneratingClick={onStopGenerating}
-            onActionClick={onActionClick}
-          />
-        ))
+      {items.length <= 1 ? (
+        <ChatWelcomePanel knowledgeBase={knowledgeBase} />
+      ) : (
+        items.map((item, index) =>
+          Array.isArray(item) ? (
+            <ChatConsolidatedItems
+              key={index}
+              consolidatedItem={item}
+              onFeedback={onFeedback}
+              onRegenerate={onRegenerate}
+              onEditSubmit={onEdit}
+              onStopGenerating={onStopGenerating}
+              onActionClick={onActionClick}
+            />
+          ) : (
+            <ChatItem
+              // use index, not id to prevent unmounting of component when message is persisted
+              key={index}
+              {...item}
+              onFeedbackClick={(feedback) => {
+                onFeedback(item, feedback);
+              }}
+              onRegenerateClick={() => {
+                onRegenerate(item);
+              }}
+              onEditSubmit={(message) => onEdit(item, message)}
+              onStopGeneratingClick={onStopGenerating}
+              onActionClick={onActionClick}
+            />
+          )
+        )
       )}
-      {filteredItems.length === 1 ? <ChatWelcomePanel knowledgeBase={knowledgeBase} /> : null}
     </EuiCommentList>
   );
 }
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_welcome_panel.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_welcome_panel.tsx
index 8240c6fef4054..2ad5054a254c8 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_welcome_panel.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/chat_welcome_panel.tsx
@@ -36,17 +36,15 @@ export function ChatWelcomePanel({ knowledgeBase }: { knowledgeBase: UseKnowledg
           </h2>
         </EuiTitle>
         <EuiText color="subdued" textAlign="center">
-          <p>
-            {knowledgeBase.status.value?.ready
-              ? i18n.translate('xpack.observabilityAiAssistant.chatWelcomePanel.body.kbReady', {
-                  defaultMessage:
-                    'Keep in mind that Elastic AI Assistant is a technical preview feature. Please provide feedback at any time.',
-                })
-              : i18n.translate('xpack.observabilityAiAssistant.chatWelcomePanel.body.kbNotReady', {
-                  defaultMessage:
-                    'We recommend you enable the knowledge base for a better experience. It will provide the assistant with the ability to learn from your interaction with it. Keep in mind that Elastic AI Assistant is a technical preview feature. Please provide feedback at any time.',
-                })}
-          </p>
+          {knowledgeBase.status.value?.ready
+            ? i18n.translate('xpack.observabilityAiAssistant.chatWelcomePanel.body.kbReady', {
+                defaultMessage:
+                  'Keep in mind that Elastic AI Assistant is a technical preview feature. Please provide feedback at any time.',
+              })
+            : i18n.translate('xpack.observabilityAiAssistant.chatWelcomePanel.body.kbNotReady', {
+                defaultMessage:
+                  'We recommend you enable the knowledge base for a better experience. It will provide the assistant with the ability to learn from your interaction with it. Keep in mind that Elastic AI Assistant is a technical preview feature. Please provide feedback at any time.',
+              })}
         </EuiText>
 
         {!knowledgeBase.status.value?.ready ? (
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/conversation_list.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/conversation_list.tsx
index 08cb45387a9ef..1551c744d4561 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/conversation_list.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/conversation_list.tsx
@@ -119,6 +119,12 @@ export function ConversationList({
                         conversation.id
                           ? {
                               iconType: 'trash',
+                              'aria-label': i18n.translate(
+                                'xpack.observabilityAiAssistant.conversationList.deleteConversationIconLabel',
+                                {
+                                  defaultMessage: 'Delete',
+                                }
+                              ),
                               onClick: () => {
                                 onClickDeleteConversation(conversation.id);
                               },
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/function_list_popover.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/function_list_popover.tsx
index a9cf8146e020d..a82ece36739d9 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/function_list_popover.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/function_list_popover.tsx
@@ -88,17 +88,13 @@ export function FunctionListPopover({
     return (
       <>
         <EuiText size="s">
-          <p>
-            <strong>
-              <EuiHighlight search={searchValue}>{option.label}</EuiHighlight>{' '}
-            </strong>
-          </p>
+          <strong>
+            <EuiHighlight search={searchValue}>{option.label}</EuiHighlight>{' '}
+          </strong>
         </EuiText>
         <EuiSpacer size="xs" />
-        <EuiText size="s">
-          <p style={{ textOverflow: 'ellipsis', overflow: 'hidden' }}>
-            <EuiHighlight search={searchValue}>{option.searchableLabel || ''}</EuiHighlight>
-          </p>
+        <EuiText size="s" style={{ textOverflow: 'ellipsis', overflow: 'hidden' }}>
+          <EuiHighlight search={searchValue}>{option.searchableLabel || ''}</EuiHighlight>
         </EuiText>
       </>
     );
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/incorrect_license_panel.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/incorrect_license_panel.tsx
index 4897389da005d..ccb30b1e23383 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/incorrect_license_panel.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/incorrect_license_panel.tsx
@@ -44,11 +44,9 @@ export function IncorrectLicensePanel() {
           <h2>{UPGRADE_LICENSE_TITLE}</h2>
         </EuiTitle>
         <EuiText color="subdued">
-          <p>
-            {i18n.translate('xpack.observabilityAiAssistant.incorrectLicense.body', {
-              defaultMessage: 'You need an Enterprise license to use the Elastic AI Assistant.',
-            })}
-          </p>
+          {i18n.translate('xpack.observabilityAiAssistant.incorrectLicense.body', {
+            defaultMessage: 'You need an Enterprise license to use the Elastic AI Assistant.',
+          })}
         </EuiText>
         <EuiFlexItem>
           <EuiFlexGroup>
diff --git a/x-pack/plugins/observability_ai_assistant/public/components/chat/initial_setup_panel.tsx b/x-pack/plugins/observability_ai_assistant/public/components/chat/initial_setup_panel.tsx
index b8c99bbfa7cd4..dc6b23a94c1bc 100644
--- a/x-pack/plugins/observability_ai_assistant/public/components/chat/initial_setup_panel.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/components/chat/initial_setup_panel.tsx
@@ -44,12 +44,9 @@ export function InitialSetupPanel({
         <EuiSpacer size="s" />
 
         <EuiText color="subdued" size="s">
-          <p>
-            {i18n.translate('xpack.observabilityAiAssistant.initialSetupPanel.title', {
-              defaultMessage:
-                'Start your Al experience with Elastic by completing the steps below.',
-            })}
-          </p>
+          {i18n.translate('xpack.observabilityAiAssistant.initialSetupPanel.title', {
+            defaultMessage: 'Start your Al experience with Elastic by completing the steps below.',
+          })}
         </EuiText>
 
         <EuiSpacer size="l" />
@@ -65,8 +62,8 @@ export function InitialSetupPanel({
                 }
               )}
               description={
-                <EuiText size="s">
-                  <p>
+                <>
+                  <EuiText size="s">
                     {i18n.translate(
                       'xpack.observabilityAiAssistant.initialSetupPanel.knowledgeBase.description.paragraph1',
                       {
@@ -74,16 +71,16 @@ export function InitialSetupPanel({
                           'We recommend you enable the knowledge base for a better experience. It will provide the assistant with the ability to learn from your interaction with it.',
                       }
                     )}
-                  </p>
-                  <p>
+                  </EuiText>
+                  <EuiText size="s">
                     {i18n.translate(
                       'xpack.observabilityAiAssistant.initialSetupPanel.knowledgeBase.description.paragraph2',
                       {
                         defaultMessage: 'This step is optional, you can always do it later.',
                       }
                     )}
-                  </p>
-                </EuiText>
+                  </EuiText>
+                </>
               }
               footer={
                 knowledgeBase.status.value?.ready ? (
@@ -138,17 +135,17 @@ export function InitialSetupPanel({
               )}
               description={
                 !connectors.connectors?.length ? (
-                  <EuiText size="s">
-                    <p>
+                  <>
+                    <EuiText size="s">
                       {i18n.translate(
                         'xpack.observabilityAiAssistant.initialSetupPanel.setupConnector.description1',
                         {
                           defaultMessage: 'Set up an OpenAI connector with your AI provider.',
                         }
                       )}
-                    </p>
+                    </EuiText>
 
-                    <p>
+                    <EuiText size="s">
                       {i18n.translate(
                         'xpack.observabilityAiAssistant.initialSetupPanel.setupConnector.description2',
                         {
@@ -169,18 +166,16 @@ export function InitialSetupPanel({
                         iconType="iInCircle"
                         size="s"
                       />
-                    </p>
-                  </EuiText>
+                    </EuiText>
+                  </>
                 ) : connectors.connectors.length && !connectors.selectedConnector ? (
                   <EuiText size="s">
-                    <p>
-                      {i18n.translate(
-                        'xpack.observabilityAiAssistant.initialSetupPanel.setupConnector.description',
-                        {
-                          defaultMessage: 'Please select a provider.',
-                        }
-                      )}
-                    </p>
+                    {i18n.translate(
+                      'xpack.observabilityAiAssistant.initialSetupPanel.setupConnector.description',
+                      {
+                        defaultMessage: 'Please select a provider.',
+                      }
+                    )}
                   </EuiText>
                 ) : (
                   ''
@@ -212,12 +207,10 @@ export function InitialSetupPanel({
         <EuiSpacer size="xxl" />
 
         <EuiText color="subdued" size="s">
-          <p>
-            {i18n.translate('xpack.observabilityAiAssistant.initialSetupPanel.disclaimer', {
-              defaultMessage:
-                'The AI provider that is configured may collect telemetry when using the Elastic AI Assistant. Contact your AI provider for information on how data is collected.',
-            })}
-          </p>
+          {i18n.translate('xpack.observabilityAiAssistant.initialSetupPanel.disclaimer', {
+            defaultMessage:
+              'The AI provider that is configured may collect telemetry when using the Elastic AI Assistant. Contact your AI provider for information on how data is collected.',
+          })}
         </EuiText>
       </EuiPanel>
     </>
diff --git a/x-pack/plugins/observability_ai_assistant/public/hooks/use_timeline.test.ts b/x-pack/plugins/observability_ai_assistant/public/hooks/use_timeline.test.ts
index 299164e6f52e6..8d8afe6fb9cca 100644
--- a/x-pack/plugins/observability_ai_assistant/public/hooks/use_timeline.test.ts
+++ b/x-pack/plugins/observability_ai_assistant/public/hooks/use_timeline.test.ts
@@ -14,6 +14,7 @@ import {
 } from '@testing-library/react-hooks';
 import { BehaviorSubject, Subject } from 'rxjs';
 import { MessageRole } from '../../common';
+import { ChatTimelineItem } from '../components/chat/chat_timeline';
 import type { PendingMessage } from '../types';
 import { useTimeline, UseTimelineResult } from './use_timeline';
 
@@ -83,13 +84,35 @@ describe('useTimeline', () => {
             {
               message: {
                 role: MessageRole.User,
-                content: 'Hello',
+                content: 'hello',
               },
             },
             {
               message: {
                 role: MessageRole.Assistant,
-                content: 'Goodbye',
+                content: '',
+                function_call: {
+                  name: 'recall',
+                  trigger: MessageRole.User,
+                },
+              },
+            },
+            {
+              message: {
+                name: 'recall',
+                role: MessageRole.User,
+                content: '',
+              },
+            },
+            {
+              message: {
+                content: 'goodbye',
+                function_call: {
+                  name: '',
+                  arguments: '',
+                  trigger: MessageRole.Assistant,
+                },
+                role: MessageRole.Assistant,
               },
             },
           ],
@@ -98,48 +121,98 @@ describe('useTimeline', () => {
           },
           chatService: {
             chat: () => {},
+            hasRenderFunction: () => {},
           },
         } as unknown as HookProps,
       });
     });
     it('renders the correct timeline items', () => {
-      expect(hookResult.result.current.items.length).toEqual(3);
+      expect(hookResult.result.current.items.length).toEqual(4);
 
       expect(hookResult.result.current.items[1]).toEqual({
-        actions: {
-          canCopy: true,
-          canEdit: true,
-          canRegenerate: false,
-          canGiveFeedback: false,
-        },
-        display: {
-          collapsed: false,
-          hide: false,
-        },
-        role: MessageRole.User,
-        content: 'Hello',
-        loading: false,
+        actions: { canCopy: true, canEdit: true, canGiveFeedback: false, canRegenerate: false },
+        content: 'hello',
+        currentUser: undefined,
+        display: { collapsed: false, hide: false },
+        element: undefined,
+        function_call: undefined,
         id: expect.any(String),
+        loading: false,
+        role: MessageRole.User,
         title: '',
       });
 
-      expect(hookResult.result.current.items[2]).toEqual({
-        display: {
-          collapsed: false,
-          hide: false,
-        },
-        actions: {
-          canCopy: true,
-          canEdit: false,
-          canRegenerate: true,
-          canGiveFeedback: false,
+      expect(hookResult.result.current.items[3]).toEqual({
+        actions: { canCopy: true, canEdit: false, canGiveFeedback: false, canRegenerate: true },
+        content: 'goodbye',
+        currentUser: undefined,
+        display: { collapsed: false, hide: false },
+        element: undefined,
+        function_call: {
+          arguments: '',
+          name: '',
+          trigger: MessageRole.Assistant,
         },
-        role: MessageRole.Assistant,
-        content: 'Goodbye',
-        loading: false,
         id: expect.any(String),
+        loading: false,
+        role: MessageRole.Assistant,
         title: '',
       });
+
+      // Items that are function calls are collapsed into an array.
+
+      // 'title' is a <FormattedMessage /> component. This throws Jest for a loop.
+      const collapsedItemsWithoutTitle = (
+        hookResult.result.current.items[2] as ChatTimelineItem[]
+      ).map(({ title, ...rest }) => rest);
+
+      expect(collapsedItemsWithoutTitle).toEqual([
+        {
+          display: {
+            collapsed: true,
+            hide: false,
+          },
+          actions: {
+            canCopy: true,
+            canEdit: true,
+            canRegenerate: false,
+            canGiveFeedback: false,
+          },
+          currentUser: undefined,
+          function_call: {
+            name: 'recall',
+            trigger: MessageRole.User,
+          },
+          role: MessageRole.User,
+          content: `\`\`\`
+{
+  \"name\": \"recall\"
+}
+\`\`\``,
+          loading: false,
+          id: expect.any(String),
+        },
+        {
+          display: {
+            collapsed: true,
+            hide: false,
+          },
+          actions: {
+            canCopy: true,
+            canEdit: false,
+            canRegenerate: false,
+            canGiveFeedback: false,
+          },
+          currentUser: undefined,
+          function_call: undefined,
+          role: MessageRole.User,
+          content: `\`\`\`
+{}
+\`\`\``,
+          loading: false,
+          id: expect.any(String),
+        },
+      ]);
     });
   });
 
@@ -197,10 +270,16 @@ describe('useTimeline', () => {
       });
 
       it('adds two items of which the last one is loading', async () => {
-        expect(hookResult.result.current.items[0].role).toEqual(MessageRole.User);
-        expect(hookResult.result.current.items[1].role).toEqual(MessageRole.User);
+        expect((hookResult.result.current.items[0] as ChatTimelineItem).role).toEqual(
+          MessageRole.User
+        );
+        expect((hookResult.result.current.items[1] as ChatTimelineItem).role).toEqual(
+          MessageRole.User
+        );
 
-        expect(hookResult.result.current.items[2].role).toEqual(MessageRole.Assistant);
+        expect((hookResult.result.current.items[2] as ChatTimelineItem).role).toEqual(
+          MessageRole.Assistant
+        );
 
         expect(hookResult.result.current.items[1]).toMatchObject({
           role: MessageRole.User,
@@ -303,7 +382,9 @@ describe('useTimeline', () => {
         describe('and it being regenerated', () => {
           beforeEach(() => {
             act(() => {
-              hookResult.result.current.onRegenerate(hookResult.result.current.items[2]);
+              hookResult.result.current.onRegenerate(
+                hookResult.result.current.items[2] as ChatTimelineItem
+              );
               subject.next({ message: { role: MessageRole.Assistant, content: '' } });
             });
           });
@@ -335,7 +416,9 @@ describe('useTimeline', () => {
               });
 
               act(() => {
-                hookResult.result.current.onRegenerate(hookResult.result.current.items[2]);
+                hookResult.result.current.onRegenerate(
+                  hookResult.result.current.items[2] as ChatTimelineItem
+                );
               });
             });
 
@@ -445,7 +528,7 @@ describe('useTimeline', () => {
                 '@timestamp': expect.any(String),
                 message: {
                   content: 'Hello',
-                  role: 'user',
+                  role: MessageRole.User,
                 },
               },
             ],
diff --git a/x-pack/plugins/observability_ai_assistant/public/hooks/use_timeline.ts b/x-pack/plugins/observability_ai_assistant/public/hooks/use_timeline.ts
index 93f1cec5d6c14..7db568a07a99e 100644
--- a/x-pack/plugins/observability_ai_assistant/public/hooks/use_timeline.ts
+++ b/x-pack/plugins/observability_ai_assistant/public/hooks/use_timeline.ts
@@ -19,7 +19,7 @@ import {
   type Message,
 } from '../../common/types';
 import type { ChatPromptEditorProps } from '../components/chat/chat_prompt_editor';
-import type { ChatTimelineProps } from '../components/chat/chat_timeline';
+import type { ChatTimelineItem, ChatTimelineProps } from '../components/chat/chat_timeline';
 import { ChatActionClickType } from '../components/chat/types';
 import { EMPTY_CONVERSATION_TITLE } from '../i18n';
 import type { ObservabilityAIAssistantChatService, PendingMessage } from '../types';
@@ -101,6 +101,7 @@ export function useTimeline({
   const [isFunctionLoading, setIsFunctionLoading] = useState(false);
 
   const prevConversationId = usePrevious(conversationId);
+
   useEffect(() => {
     if (prevConversationId !== conversationId && pendingMessage?.error) {
       setPendingMessage(undefined);
@@ -257,26 +258,27 @@ export function useTimeline({
     });
   }
 
-  const items = useMemo(() => {
-    if (pendingMessage) {
+  const itemsWithAddedLoadingStates = useMemo(() => {
+    // While we're loading we add an empty loading chat item:
+    if (pendingMessage || isFunctionLoading) {
       const nextItems = conversationItems.concat({
         id: '',
         actions: {
           canCopy: true,
           canEdit: false,
           canGiveFeedback: false,
-          canRegenerate: pendingMessage.aborted || !!pendingMessage.error,
+          canRegenerate: pendingMessage?.aborted || !!pendingMessage?.error,
         },
         display: {
           collapsed: false,
-          hide: pendingMessage.message.role === MessageRole.System,
+          hide: pendingMessage?.message.role === MessageRole.System,
         },
-        content: pendingMessage.message.content,
+        content: pendingMessage?.message.content,
         currentUser,
-        error: pendingMessage.error,
-        function_call: pendingMessage.message.function_call,
-        loading: !pendingMessage.aborted && !pendingMessage.error,
-        role: pendingMessage.message.role,
+        error: pendingMessage?.error,
+        function_call: pendingMessage?.message.function_call,
+        loading: !pendingMessage?.aborted && !pendingMessage?.error,
+        role: pendingMessage?.message.role || MessageRole.Assistant,
         title: '',
       });
 
@@ -288,6 +290,7 @@ export function useTimeline({
     }
 
     return conversationItems.map((item, index) => {
+      // When we're done loading we remove the placeholder item again
       if (index < conversationItems.length - 1) {
         return item;
       }
@@ -298,6 +301,29 @@ export function useTimeline({
     });
   }, [conversationItems, pendingMessage, currentUser, isFunctionLoading]);
 
+  const items = useMemo(() => {
+    const consolidatedChatItems: Array<ChatTimelineItem | ChatTimelineItem[]> = [];
+    let currentGroup: ChatTimelineItem[] | null = null;
+
+    for (const item of itemsWithAddedLoadingStates) {
+      if (item.display.hide || !item) continue;
+
+      if (item.display.collapsed) {
+        if (currentGroup) {
+          currentGroup.push(item);
+        } else {
+          currentGroup = [item];
+          consolidatedChatItems.push(currentGroup);
+        }
+      } else {
+        consolidatedChatItems.push(item);
+        currentGroup = null;
+      }
+    }
+
+    return consolidatedChatItems;
+  }, [itemsWithAddedLoadingStates]);
+
   useEffect(() => {
     return () => {
       subscription?.unsubscribe();
diff --git a/x-pack/plugins/observability_ai_assistant/public/utils/get_timeline_items_from_conversation.tsx b/x-pack/plugins/observability_ai_assistant/public/utils/get_timeline_items_from_conversation.tsx
index 6d8d8ed8fee13..61f2a4fcbd383 100644
--- a/x-pack/plugins/observability_ai_assistant/public/utils/get_timeline_items_from_conversation.tsx
+++ b/x-pack/plugins/observability_ai_assistant/public/utils/get_timeline_items_from_conversation.tsx
@@ -92,7 +92,7 @@ export function getTimelineItemsfromConversation({
           ? messages[index - 1].message.function_call
           : undefined;
 
-      const role = message.message.function_call?.trigger || message.message.role;
+      let role = message.message.function_call?.trigger || message.message.role;
 
       const actions = {
         canCopy: false,
@@ -159,8 +159,12 @@ export function getTimelineItemsfromConversation({
 
             content = !element ? convertMessageToMarkdownCodeBlock(message.message) : undefined;
 
+            if (prevFunctionCall?.trigger === MessageRole.Assistant) {
+              role = MessageRole.Assistant;
+            }
+
             actions.canEdit = false;
-            display.collapsed = !isError && !element;
+            display.collapsed = !element;
           } else if (message.message.function_call) {
             // User suggested a function
             title = (
diff --git a/x-pack/plugins/observability_ai_assistant/server/routes/chat/route.ts b/x-pack/plugins/observability_ai_assistant/server/routes/chat/route.ts
index 19ebdcbaedc95..90620156acf37 100644
--- a/x-pack/plugins/observability_ai_assistant/server/routes/chat/route.ts
+++ b/x-pack/plugins/observability_ai_assistant/server/routes/chat/route.ts
@@ -5,10 +5,10 @@
  * 2.0.
  */
 import { notImplemented } from '@hapi/boom';
-import { IncomingMessage } from 'http';
 import * as t from 'io-ts';
 import { toBooleanRt } from '@kbn/io-ts-utils';
 import type { CreateChatCompletionResponse } from 'openai';
+import { Readable } from 'stream';
 import { createObservabilityAIAssistantServerRoute } from '../create_observability_ai_assistant_server_route';
 import { messageRt } from '../runtime_types';
 
@@ -38,7 +38,7 @@ const chatRoute = createObservabilityAIAssistantServerRoute({
     }),
     t.partial({ query: t.type({ stream: toBooleanRt }) }),
   ]),
-  handler: async (resources): Promise<IncomingMessage | CreateChatCompletionResponse> => {
+  handler: async (resources): Promise<Readable | CreateChatCompletionResponse> => {
     const { request, params, service } = resources;
 
     const client = await service.getClient({ request });
diff --git a/x-pack/plugins/observability_ai_assistant/server/service/client/index.ts b/x-pack/plugins/observability_ai_assistant/server/service/client/index.ts
index 3a99e293cd5e2..f0df01d87168d 100644
--- a/x-pack/plugins/observability_ai_assistant/server/service/client/index.ts
+++ b/x-pack/plugins/observability_ai_assistant/server/service/client/index.ts
@@ -10,7 +10,6 @@ import type { ActionsClient } from '@kbn/actions-plugin/server';
 import type { ElasticsearchClient } from '@kbn/core/server';
 import type { Logger } from '@kbn/logging';
 import type { PublicMethodsOf } from '@kbn/utility-types';
-import type { IncomingMessage } from 'http';
 import { compact, isEmpty, merge, omit } from 'lodash';
 import type {
   ChatCompletionFunctions,
@@ -18,10 +17,11 @@ import type {
   CreateChatCompletionRequest,
   CreateChatCompletionResponse,
 } from 'openai';
+import { PassThrough, Readable } from 'stream';
 import { v4 } from 'uuid';
 import {
-  type CompatibleJSONSchema,
   MessageRole,
+  type CompatibleJSONSchema,
   type Conversation,
   type ConversationCreateRequest,
   type ConversationUpdateRequest,
@@ -116,7 +116,7 @@ export class ObservabilityAIAssistantClient {
     functions?: Array<{ name: string; description: string; parameters: CompatibleJSONSchema }>;
     functionCall?: string;
     stream?: TStream;
-  }): Promise<TStream extends false ? CreateChatCompletionResponse : IncomingMessage> => {
+  }): Promise<TStream extends false ? CreateChatCompletionResponse : Readable> => {
     const messagesForOpenAI: ChatCompletionRequestMessage[] = compact(
       messages
         .filter((message) => message.message.content || message.message.function_call?.name)
@@ -195,7 +195,11 @@ export class ObservabilityAIAssistantClient {
       throw internal(`${executeResult?.message} - ${executeResult?.serviceMessage}`);
     }
 
-    return executeResult.data as any;
+    const response = stream
+      ? ((executeResult.data as Readable).pipe(new PassThrough()) as Readable)
+      : (executeResult.data as CreateChatCompletionResponse);
+
+    return response as any;
   };
 
   find = async (options?: { query?: string }): Promise<{ conversations: Conversation[] }> => {
diff --git a/x-pack/plugins/observability_ai_assistant/server/service/index.ts b/x-pack/plugins/observability_ai_assistant/server/service/index.ts
index 978a8a2de6111..e2f6354725f1a 100644
--- a/x-pack/plugins/observability_ai_assistant/server/service/index.ts
+++ b/x-pack/plugins/observability_ai_assistant/server/service/index.ts
@@ -119,6 +119,7 @@ export class ObservabilityAIAssistantService {
             number_of_shards: 1,
             auto_expand_replicas: '0-1',
             refresh_interval: '1s',
+            hidden: true,
           },
         },
       });
@@ -176,6 +177,7 @@ export class ObservabilityAIAssistantService {
             number_of_shards: 1,
             auto_expand_replicas: '0-1',
             refresh_interval: '1s',
+            hidden: true,
           },
         },
       });
diff --git a/x-pack/plugins/observability_shared/dev_docs/how_we_manage_dependencies.md b/x-pack/plugins/observability_shared/dev_docs/how_we_manage_dependencies.md
new file mode 100644
index 0000000000000..5cd525e97954f
--- /dev/null
+++ b/x-pack/plugins/observability_shared/dev_docs/how_we_manage_dependencies.md
@@ -0,0 +1,70 @@
+# Dependency Management in Observability Kibana
+
+Our goal in observability is to provide as seamless of an experience as possible for our observability users, especially when it comes to navigating between areas owned by different teams. In Kibana, these different teams each own their own experiences inside of a Kibana plugin that provides a public UI interface and, optionally, a back-end server interface. As these plugins begin to share more components, utilities, data clients, and more, the Kibana architecture requires them to depend on each other using runtime dependencies. These dependencies can only be single-direction, which severely limits the types of sharing our plugins can do with one another. 
+
+## Problem summary
+
+For years, the APM plugin has declared a single-direction runtime dependency on the Infra plugin, allowing APM to make use of components and utilities made available by Infra. Because of this existing dependency, the infra plugin can never make use of similar shared items that could be made available from APM. As Logs+ grows and evolves, Synthetics and Profiling both continue to grow beyond GA, and Elastic begins to fully embrace a unified Observability user experience, we expect this problem to multiply quickly.
+
+To solve this problem, we need a clear approach for how to organize plugins, packages, and the dependencies between them.
+
+## Plan summary
+
+This is the plan we aim to follow, summarized. More details about this plan are found below.
+
+1. **Resist over-abstraction, but abstract when needed.** If something doesn't need to be shared yet, it's not necessarily good to break it out into its own plugin _or_ package. That said, we will need to break items out of our end user plugins and/or rearrange them, and we shouldn't be scared of doing this because of longtime technical limitations.
+    - TODO: Add information about possible Kibana event system to consider as a first sharing step, prior to abstraction.
+1. **Prefer packages to plugins.** A stateless package is easier to bootstrap, test, and maintain in most cases. If you don't need access to stateful dependencies from core or other plugins, or if you can accept a reasonable number of injected dependencies, make a package.
+    - TODO: Add link to docs/examples of how to make a Kibana package
+    - TODO: Add more clarity on the trade-offs between plugin vs package
+1. **If you need to make a new plugin, be sure to carefully consider the plugin tiers and how your new plugin will fit.**. In most cases, we should avoid new plugins (with the exception of data access plugins which should only depend on Kibana core.)
+1. **Never introduce or add to existing dependencies between plugins in the same tier.** This is the main problem we need to avoid, especially between end user plugins. 
+
+## Plugin tier system
+
+The system we'll embrace revolves around a "tier system" to help us organize different types of plugins. The plugin tiers look like this:
+
+<img width="661" alt="Screenshot 2023-09-14 at 3 27 56 PM" src="https://github.com/elastic/kibana/assets/159370/6d6ff7ab-0f2d-416b-9400-9760f62f84bc">
+
+Within this system, a plugin in any tier may ONLY introduce dependencies on other plugins that are in a tier below theirs. They may NOT depend on plugins in the same tier or in tiers above their own. Packages, on the other hand, may be depended on from _any_ plugin, as well as from _any other_ package.
+
+**Note:** Tiers are NOT currently enforced by any lint rule or other rule. Tiers are a convention that allow us to structure our code in such a way as to avoid the circular dependency problem, but they require manual enforcement via code review. In the near future, we should explore simple ways to codify and enforce this system, either in linting rules, Kibana bundling enforcement, precommit hooks, etc.
+
+### Tier 1: End user tier
+
+End user plugins are the plugins that provide visible sections of the Observability UI in Kibana. Each of these plugins may provide one or more navigational areas inside of the Observability product, and they each may provide one or more Kibana server APIs as well. 
+
+These plugins should stop introducing dependencies on each other immediately, and should also stop introducing new functionality that relies on existing dependencies immediately, as well. As soon as possible, existing dependencies between these plugins should be removed and replaced with extracted functionality.
+
+<img width="722" alt="Screenshot 2023-09-14 at 3 32 17 PM" src="https://github.com/elastic/kibana/assets/159370/ef5af3f7-58b1-4618-a972-50439fb53485">
+
+### Tier 2: Share tier
+
+"Share plugins" provide shared functionality (UI components, utility functions, shared logic, etc.) that can be used by multiple end user plugins. Being plugins, they still take advantage of the Kibana runtime lifecycle (setup, start, stop) and have access to Kibana's core functionality and core plugin system.
+
+This tier is where we would move any shared items, business logic, and stateful dependencies that need access to the plugin lifecycle and, for whatever reason, can't or don't want to accept runtime dependencies as injected parameters. These share plugins can make use of the core-only plugins that typically provide encapsulated access to observability data of other kinds. 
+
+<img width="589" alt="Screenshot 2023-09-14 at 3 32 25 PM" src="https://github.com/elastic/kibana/assets/159370/f2dd422f-cf85-4fc3-b072-c68316db007d">
+
+### Tier 3: Core-only tier (aka data access tier)
+
+This tier is for plugins that ONLY depend on Kibana core functionality such as scoped ES clients, saved object clients, etc. The main examples of these for now are the new "data access client" plugins which encapsulate the logic for accessing our various types of signal data in observability. By keeping this tier isolated from the other code and only allowing for it to depend on Kibana core, we make data access safely available to any other plugin in the end user or share tiers.
+
+<img width="717" alt="Screenshot 2023-09-14 at 3 32 30 PM" src="https://github.com/elastic/kibana/assets/159370/36175bf2-de9e-477b-81d5-d004d599471f">
+
+### Core: Kibana core
+
+Anything made available by Kibana core, either in the CoreSetup, CoreStart, or one of the core-maintained plugins such as saved objects, etc. is fair game as a dependency of any observability plugin in any tier.
+
+### Packages
+
+Kibana packages are stateless and therefore can be imported into any plugin in any tier. If your shareable item is stateless, or if it can be simply built to accept strongly-typed items using dependency injection, using a package is almost always the best choice.
+
+## Putting it all together
+
+<img width="1061" alt="Screenshot 2023-09-14 at 3 37 35 PM" src="https://github.com/elastic/kibana/assets/159370/106de340-3ec4-4cff-88db-af51857d865d">
+
+With the exception of package dependencies, all plugin-to-plugin dependencies may only flow _downward_ in the tier diagram.
+
+<img width="1071" alt="Screenshot 2023-09-14 at 3 37 42 PM" src="https://github.com/elastic/kibana/assets/159370/2746d3b1-aacc-4b86-b61f-40f72236403b">
+
diff --git a/x-pack/plugins/osquery/cypress/cypress.config.ts b/x-pack/plugins/osquery/cypress/cypress.config.ts
index 26b1d9b67850d..e3321d7ff6865 100644
--- a/x-pack/plugins/osquery/cypress/cypress.config.ts
+++ b/x-pack/plugins/osquery/cypress/cypress.config.ts
@@ -20,6 +20,11 @@ const ROLES_YAML_FILE_PATH = path.join(
 const roleDefinitions = loadYaml(readFileSync(ROLES_YAML_FILE_PATH, 'utf8')) as YamlRoleDefinitions;
 
 export default defineCypressConfig({
+  reporter: '../../../node_modules/cypress-multi-reporters',
+  reporterOptions: {
+    configFile: './cypress/reporter_config.json',
+  },
+
   defaultCommandTimeout: 60000,
   execTimeout: 120000,
   pageLoadTimeout: 12000,
diff --git a/x-pack/plugins/osquery/cypress/reporter_config.json b/x-pack/plugins/osquery/cypress/reporter_config.json
new file mode 100644
index 0000000000000..c472bd0bb643e
--- /dev/null
+++ b/x-pack/plugins/osquery/cypress/reporter_config.json
@@ -0,0 +1,10 @@
+{
+  "reporterEnabled": "mochawesome, mocha-junit-reporter",
+  "reporterOptions": {
+    "html": false,
+    "json": true,
+    "mochaFile": "../../../target/kibana-osquery/cypress/results/TEST-osquery-cypress-[hash].xml",
+    "overwrite": false,
+    "reportDir": "../../../target/kibana-osquery/cypress/results"
+  }
+}
diff --git a/x-pack/plugins/osquery/cypress/serverless_cypress.config.ts b/x-pack/plugins/osquery/cypress/serverless_cypress.config.ts
index fff0d4431df52..506204de66aa2 100644
--- a/x-pack/plugins/osquery/cypress/serverless_cypress.config.ts
+++ b/x-pack/plugins/osquery/cypress/serverless_cypress.config.ts
@@ -10,6 +10,11 @@ import { setupUserDataLoader } from '../../../test_serverless/functional/test_su
 
 // eslint-disable-next-line import/no-default-export
 export default defineCypressConfig({
+  reporter: '../../../node_modules/cypress-multi-reporters',
+  reporterOptions: {
+    configFile: './cypress/reporter_config.json',
+  },
+
   defaultCommandTimeout: 60000,
   execTimeout: 60000,
   pageLoadTimeout: 60000,
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_edit/remote_cluster_edit.js b/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_edit/remote_cluster_edit.js
index 02ae974380683..04daad5dee8fc 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_edit/remote_cluster_edit.js
+++ b/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_edit/remote_cluster_edit.js
@@ -96,55 +96,51 @@ export class RemoteClusterEdit extends Component {
 
     if (isLoading) {
       return (
-        <EuiPageTemplate minHeight={0} panelled paddingSize="none" offset={0}>
-          <SectionLoading>
-            <FormattedMessage
-              id="xpack.remoteClusters.edit.loadingLabel"
-              defaultMessage="Loading remote cluster…"
-            />
-          </SectionLoading>
-        </EuiPageTemplate>
+        <SectionLoading>
+          <FormattedMessage
+            id="xpack.remoteClusters.edit.loadingLabel"
+            defaultMessage="Loading remote cluster…"
+          />
+        </SectionLoading>
       );
     }
 
     if (!cluster) {
       return (
-        <EuiPageTemplate minHeight={0} panelled paddingSize="none" offset={0}>
-          <EuiPageTemplate.EmptyPrompt
-            iconType="warning"
-            color="danger"
-            title={
-              <h2>
-                <FormattedMessage
-                  id="xpack.remoteClusters.edit.loadingErrorTitle"
-                  defaultMessage="Error loading remote cluster"
-                />
-              </h2>
-            }
-            body={
-              <p>
-                <FormattedMessage
-                  id="xpack.remoteClusters.edit.loadingErrorMessage"
-                  defaultMessage="The remote cluster '{name}' does not exist."
-                  values={{ name: clusterName }}
-                />
-              </p>
-            }
-            actions={
-              <EuiButton
-                {...reactRouterNavigate(this.props.history, '/list')}
-                color="danger"
-                iconType="arrowLeft"
-                flush="left"
-              >
-                <FormattedMessage
-                  id="xpack.remoteClusters.edit.viewRemoteClustersButtonLabel"
-                  defaultMessage="View remote clusters"
-                />
-              </EuiButton>
-            }
-          />
-        </EuiPageTemplate>
+        <EuiPageTemplate.EmptyPrompt
+          iconType="warning"
+          color="danger"
+          title={
+            <h2>
+              <FormattedMessage
+                id="xpack.remoteClusters.edit.loadingErrorTitle"
+                defaultMessage="Error loading remote cluster"
+              />
+            </h2>
+          }
+          body={
+            <p>
+              <FormattedMessage
+                id="xpack.remoteClusters.edit.loadingErrorMessage"
+                defaultMessage="The remote cluster '{name}' does not exist."
+                values={{ name: clusterName }}
+              />
+            </p>
+          }
+          actions={
+            <EuiButton
+              {...reactRouterNavigate(this.props.history, '/list')}
+              color="danger"
+              iconType="arrowLeft"
+              flush="left"
+            >
+              <FormattedMessage
+                id="xpack.remoteClusters.edit.viewRemoteClustersButtonLabel"
+                defaultMessage="View remote clusters"
+              />
+            </EuiButton>
+          }
+        />
       );
     }
 
@@ -152,36 +148,34 @@ export class RemoteClusterEdit extends Component {
 
     if (isConfiguredByNode) {
       return (
-        <EuiPageTemplate minHeight={0} panelled paddingSize="none" offset={0}>
-          <EuiPageTemplate.EmptyPrompt
-            iconType="iInCircle"
-            title={
-              <h2>
-                <FormattedMessage
-                  id="xpack.remoteClusters.edit.configuredByNodeWarningTitle"
-                  defaultMessage="Defined in configuration"
-                />
-              </h2>
-            }
-            body={
-              <p>
-                <FormattedMessage
-                  id="xpack.remoteClusters.configuredByNodeWarningBody"
-                  defaultMessage="You can't edit or delete this remote cluster because it's defined in a node's
+        <EuiPageTemplate.EmptyPrompt
+          iconType="iInCircle"
+          title={
+            <h2>
+              <FormattedMessage
+                id="xpack.remoteClusters.edit.configuredByNodeWarningTitle"
+                defaultMessage="Defined in configuration"
+              />
+            </h2>
+          }
+          body={
+            <p>
+              <FormattedMessage
+                id="xpack.remoteClusters.configuredByNodeWarningBody"
+                defaultMessage="You can't edit or delete this remote cluster because it's defined in a node's
                   elasticsearch.yml configuration file."
-                />
-              </p>
-            }
-            actions={
-              <EuiButton color="primary" iconType="arrowLeft" flush="left" onClick={this.cancel}>
-                <FormattedMessage
-                  id="xpack.remoteClusters.edit.backToRemoteClustersButtonLabel"
-                  defaultMessage="Back to remote clusters"
-                />
-              </EuiButton>
-            }
-          />
-        </EuiPageTemplate>
+              />
+            </p>
+          }
+          actions={
+            <EuiButton color="primary" iconType="arrowLeft" flush="left" onClick={this.cancel}>
+              <FormattedMessage
+                id="xpack.remoteClusters.edit.backToRemoteClustersButtonLabel"
+                defaultMessage="Back to remote clusters"
+              />
+            </EuiButton>
+          }
+        />
       );
     }
 
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/remote_cluster_list.js b/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/remote_cluster_list.js
index 06948e25a0583..21ed52d08fa83 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/remote_cluster_list.js
+++ b/x-pack/plugins/remote_clusters/public/application/sections/remote_cluster_list/remote_cluster_list.js
@@ -93,28 +93,26 @@ export class RemoteClusterList extends Component {
 
   renderNoPermission() {
     return (
-      <EuiPageTemplate minHeight={0} panelled paddingSize="none" offset={0}>
-        <EuiPageTemplate.EmptyPrompt
-          iconType="warning"
-          color="danger"
-          title={
-            <h2>
-              <FormattedMessage
-                id="xpack.remoteClusters.remoteClusterList.noPermissionTitle"
-                defaultMessage="Permission error"
-              />
-            </h2>
-          }
-          body={
-            <p>
-              <FormattedMessage
-                id="xpack.remoteClusters.remoteClusterList.noPermissionText"
-                defaultMessage="You do not have permission to view or add remote clusters."
-              />
-            </p>
-          }
-        />
-      </EuiPageTemplate>
+      <EuiPageTemplate.EmptyPrompt
+        iconType="warning"
+        color="danger"
+        title={
+          <h2>
+            <FormattedMessage
+              id="xpack.remoteClusters.remoteClusterList.noPermissionTitle"
+              defaultMessage="Permission error"
+            />
+          </h2>
+        }
+        body={
+          <p>
+            <FormattedMessage
+              id="xpack.remoteClusters.remoteClusterList.noPermissionText"
+              defaultMessage="You do not have permission to view or add remote clusters."
+            />
+          </p>
+        }
+      />
     );
   }
 
@@ -124,103 +122,91 @@ export class RemoteClusterList extends Component {
     const { statusCode, error: errorString } = error.body;
 
     return (
-      <EuiPageTemplate minHeight={0} panelled paddingSize="none" offset={0}>
-        <EuiPageTemplate.EmptyPrompt
-          iconType="warning"
-          color="danger"
-          title={
-            <h2>
-              <FormattedMessage
-                id="xpack.remoteClusters.remoteClusterList.loadingErrorTitle"
-                defaultMessage="Error loading remote clusters"
-              />
-            </h2>
-          }
-          body={
-            <p>
-              {statusCode} {errorString}
-            </p>
-          }
-        />
-      </EuiPageTemplate>
+      <EuiPageTemplate.EmptyPrompt
+        iconType="warning"
+        color="danger"
+        title={
+          <h2>
+            <FormattedMessage
+              id="xpack.remoteClusters.remoteClusterList.loadingErrorTitle"
+              defaultMessage="Error loading remote clusters"
+            />
+          </h2>
+        }
+        body={
+          <p>
+            {statusCode} {errorString}
+          </p>
+        }
+      />
     );
   }
 
   renderEmpty() {
     return (
-      <EuiPageTemplate minHeight={0} panelled paddingSize="none" offset={0}>
-        <EuiPageTemplate.EmptyPrompt
-          data-test-subj="remoteClusterListEmptyPrompt"
-          iconType="managementApp"
-          title={
-            <h2>
-              <FormattedMessage
-                id="xpack.remoteClusters.remoteClusterList.emptyPromptTitle"
-                defaultMessage="Add your first remote cluster"
-              />
-            </h2>
-          }
-          body={
-            <p>
-              <FormattedMessage
-                id="xpack.remoteClusters.remoteClusterList.emptyPromptDescription"
-                defaultMessage="Remote clusters create a uni-directional connection from your
+      <EuiPageTemplate.EmptyPrompt
+        data-test-subj="remoteClusterListEmptyPrompt"
+        iconType="managementApp"
+        title={
+          <h2>
+            <FormattedMessage
+              id="xpack.remoteClusters.remoteClusterList.emptyPromptTitle"
+              defaultMessage="Add your first remote cluster"
+            />
+          </h2>
+        }
+        body={
+          <p>
+            <FormattedMessage
+              id="xpack.remoteClusters.remoteClusterList.emptyPromptDescription"
+              defaultMessage="Remote clusters create a uni-directional connection from your
                 local cluster to other clusters."
-              />
-            </p>
-          }
-          actions={
-            <EuiButton
-              {...reactRouterNavigate(this.props.history, '/add')}
-              fill
-              iconType="plusInCircle"
-              data-test-subj="remoteClusterEmptyPromptCreateButton"
-            >
-              <FormattedMessage
-                id="xpack.remoteClusters.remoteClusterList.emptyPrompt.connectButtonLabel"
-                defaultMessage="Add a remote cluster"
-              />
-            </EuiButton>
-          }
-          footer={
-            <>
-              <EuiTitle size="xxs">
-                <span>
-                  <FormattedMessage
-                    id="xpack.remoteClusters.remoteClusters.emptyState.docsDescription"
-                    defaultMessage="Want to learn more?"
-                  />
-                </span>
-              </EuiTitle>{' '}
-              <EuiLink href={remoteClustersUrl} target="_blank">
+            />
+          </p>
+        }
+        actions={
+          <EuiButton
+            {...reactRouterNavigate(this.props.history, '/add')}
+            fill
+            iconType="plusInCircle"
+            data-test-subj="remoteClusterEmptyPromptCreateButton"
+          >
+            <FormattedMessage
+              id="xpack.remoteClusters.remoteClusterList.emptyPrompt.connectButtonLabel"
+              defaultMessage="Add a remote cluster"
+            />
+          </EuiButton>
+        }
+        footer={
+          <>
+            <EuiTitle size="xxs">
+              <span>
                 <FormattedMessage
-                  id="xpack.remoteClusters.remoteClusters.emptyState.docsLink"
-                  defaultMessage="Read documentation"
+                  id="xpack.remoteClusters.remoteClusters.emptyState.docsDescription"
+                  defaultMessage="Want to learn more?"
                 />
-              </EuiLink>
-            </>
-          }
-        />
-      </EuiPageTemplate>
+              </span>
+            </EuiTitle>{' '}
+            <EuiLink href={remoteClustersUrl} target="_blank">
+              <FormattedMessage
+                id="xpack.remoteClusters.remoteClusters.emptyState.docsLink"
+                defaultMessage="Read documentation"
+              />
+            </EuiLink>
+          </>
+        }
+      />
     );
   }
 
   renderLoading() {
     return (
-      <EuiPageTemplate
-        minHeight={0}
-        panelled
-        paddingSize="none"
-        offset={0}
-        data-test-subj="remoteClustersTableLoading"
-      >
-        <SectionLoading>
-          <FormattedMessage
-            id="xpack.remoteClusters.remoteClusterList.loadingTitle"
-            defaultMessage="Loading remote clusters…"
-          />
-        </SectionLoading>
-      </EuiPageTemplate>
+      <SectionLoading data-test-subj="remoteClustersTableLoading">
+        <FormattedMessage
+          id="xpack.remoteClusters.remoteClusterList.loadingTitle"
+          defaultMessage="Loading remote clusters…"
+        />
+      </SectionLoading>
     );
   }
 
diff --git a/x-pack/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/installation_and_upgrade.md b/x-pack/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/installation_and_upgrade.md
index b8ae0c85c82e6..cca0f27be0708 100644
--- a/x-pack/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/installation_and_upgrade.md
+++ b/x-pack/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules/installation_and_upgrade.md
@@ -45,6 +45,83 @@ Status: `in progress`. The current test plan matches `Milestone 2` of the [Rule
 - Kibana should not crash with Out Of Memory exception during package installation.
 - For test purposes, it should be possible to use detection rules package versions lower than the latest.
 
+### Functional requirements
+
+- User should be able to install prebuilt rules with and without previewing what exactly they would install (rule properties).
+- User should be able to upgrade prebuilt rules with and without previewing what updates they would apply (rule properties of target rule versions).
+- If user chooses to preview a prebuilt rule to be installed/upgraded, we currently show this preview in a flyout.
+- In the prebuilt rule preview a tab that doesn't have any sections should not be displayed and a section that doesn't have any properties also should not be displayed.
+
+Examples of rule properties we show in the prebuilt rule preview flyout:
+
+```Gherkin
+Examples:
+| rule_type         | property                          | tab                 | section             |
+│ All rule types    │ Author                            │ Overview            │ About               │
+│ All rule types    │ Building block                    │ Overview            │ About               │
+│ All rule types    │ Severity                          │ Overview            │ About               │
+│ All rule types    │ Severity override                 │ Overview            │ About               │
+│ All rule types    │ Risk score                        │ Overview            │ About               │
+│ All rule types    │ Risk score override               │ Overview            │ About               │
+│ All rule types    │ Reference URLs                    │ Overview            │ About               │
+│ All rule types    │ False positive examples           │ Overview            │ About               │
+│ All rule types    │ Custom highlighted fields         │ Overview            │ About               │
+│ All rule types    │ License                           │ Overview            │ About               │
+│ All rule types    │ Rule name override                │ Overview            │ About               │
+│ All rule types    │ MITRE ATT&CK™                     │ Overview            │ About               │
+│ All rule types    │ Timestamp override                │ Overview            │ About               │
+│ All rule types    │ Tags                              │ Overview            │ About               │
+│ All rule types    │ Type                              │ Overview            │ Definition          │
+│ All rule types    │ Related integrations              │ Overview            │ Definition          │
+│ All rule types    │ Required fields                   │ Overview            │ Definition          │
+│ All rule types    │ Timeline template                 │ Overview            │ Definition          │
+│ All rule types    │ Runs every                        │ Overview            │ Schedule            │
+│ All rule types    │ Additional look-back time         │ Overview            │ Schedule            │
+│ All rule types    │ Setup guide                       │ Overview            │ Setup guide         │
+│ All rule types    │ Investigation guide               │ Investigation guide │ Investigation guide │
+│ Custom Query      │ Index patterns                    │ Overview            │ Definition          │
+│ Custom Query      │ Data view ID                      │ Overview            │ Definition          │
+│ Custom Query      │ Data view index pattern           │ Overview            │ Definition          │
+│ Custom Query      │ Custom query                      │ Overview            │ Definition          │
+│ Custom Query      │ Filters                           │ Overview            │ Definition          │
+│ Custom Query      │ Saved query name                  │ Overview            │ Definition          │
+│ Custom Query      │ Saved query filters               │ Overview            │ Definition          │
+│ Custom Query      │ Saved query                       │ Overview            │ Definition          │
+│ Custom Query      │ Suppress alerts by                │ Overview            │ Definition          │
+│ Custom Query      │ Suppress alerts for               │ Overview            │ Definition          │
+│ Custom Query      │ If a suppression field is missing │ Overview            │ Definition          │
+│ Machine Learning  │ Anomaly score threshold           │ Overview            │ Definition          │
+│ Machine Learning  │ Machine Learning job              │ Overview            │ Definition          │
+│ Threshold         │ Threshold                         │ Overview            │ Definition          │
+│ Threshold         │ Index patterns                    │ Overview            │ Definition          │
+│ Threshold         │ Data view ID                      │ Overview            │ Definition          │
+│ Threshold         │ Data view index pattern           │ Overview            │ Definition          │
+│ Threshold         │ Custom query                      │ Overview            │ Definition          │
+│ Threshold         │ Filters                           │ Overview            │ Definition          │
+│ Event Correlation │ EQL query                         │ Overview            │ Definition          │
+│ Event Correlation │ Filters                           │ Overview            │ Definition          │
+│ Event Correlation │ Index patterns                    │ Overview            │ Definition          │
+│ Event Correlation │ Data view ID                      │ Overview            │ Definition          │
+│ Event Correlation │ Data view index pattern           │ Overview            │ Definition          │
+│ Indicator Match   │ Indicator index patterns          │ Overview            │ Definition          │
+│ Indicator Match   │ Indicator mapping                 │ Overview            │ Definition          │
+│ Indicator Match   │ Indicator filters                 │ Overview            │ Definition          │
+│ Indicator Match   │ Indicator index query             │ Overview            │ Definition          │
+│ Indicator Match   │ Index patterns                    │ Overview            │ Definition          │
+│ Indicator Match   │ Data view ID                      │ Overview            │ Definition          │
+│ Indicator Match   │ Data view index pattern           │ Overview            │ Definition          │
+│ Indicator Match   │ Custom query                      │ Overview            │ Definition          │
+│ Indicator Match   │ Filters                           │ Overview            │ Definition          │
+│ New Terms         │ Fields                            │ Overview            │ Definition          │
+│ New Terms         │ History Window Size               │ Overview            │ Definition          │
+│ New Terms         │ Index patterns                    │ Overview            │ Definition          │
+│ New Terms         │ Data view ID                      │ Overview            │ Definition          │
+│ New Terms         │ Data view index pattern           │ Overview            │ Definition          │
+│ New Terms         │ Custom query                      │ Overview            │ Definition          │
+│ New Terms         │ Filters                           │ Overview            │ Definition          │
+│ ESQL              │ ESQL query                        │ Overview            │ Definition          │
+```
+
 ## Scenarios
 
 ### Package installation
@@ -366,7 +443,7 @@ Given no prebuilt rules are installed in Kibana
 And there are X prebuilt rules available to install
 When user opens the Add Rules page
 Then prebuilt rules available for installation should be displayed in the table
-When user installs one individual rule
+When user installs one individual rule without previewing it
 Then success message should be displayed after installation
 And the installed rule should be removed from the table
 When user navigates back to the Rule Management page
@@ -429,6 +506,64 @@ Then user should see a message indicating that all available rules have been ins
 And user should see a CTA that leads to the Rule Management page
 ```
 
+#### **Scenario: User can preview a rule before installing**
+
+**Automation**: 1 e2e test
+
+```Gherkin
+Given no prebuilt rules are installed in Kibana
+And there are 2 rules available to install
+When user opens the Add Rules page
+Then all rules available for installation should be displayed in the table
+When user opens the rule preview for the 1st rule
+Then the preview should open
+When user closes the preview
+Then it should disappear
+When user opens the rule preview for the 2nd rule
+Then the preview should open
+When user installs the rule using a CTA in the rule preview
+Then the 2nd rule should be installed
+And a success message should be displayed after installation
+And the 2nd rule should be removed from the Add Rules table
+When user navigates back to the Rule Management page
+Then user should see a CTA to install prebuilt rules
+And user should see the number of rules available to install as 1
+```
+
+#### **Scenario: User can see correct rule information in preview before installing**
+
+**Automation**: 1 e2e test
+
+```Gherkin
+Given no prebuilt rules are installed in Kibana
+And there are X prebuilt rules of all types available to install
+When user opens the Add Rules page
+Then all X rules available for installation should be displayed in the table
+When user opens the rule preview for the 1st rule
+Then the preview should open
+And all properties of the 1st rule should be displayed in the correct tab and section of the preview (see examples of rule properties above)
+When user selects the 2nd rule in the table
+Then the preview should be updated
+And all properties of the 2nd rule should be displayed in the correct tab and section of the preview (see examples of rule properties above)
+And user should be able to repeat this for all X rules
+```
+
+#### **Scenario: Tabs and sections without content should be hidden in preview before installing**
+
+**Automation**: 1 e2e test
+
+```Gherkin
+Given no prebuilt rules are installed in Kibana
+And there is at least 1 rule available to install
+And this rule has neither Setup guide nor Investigation guide
+When user opens the Add Rules page
+Then all rules available for installation should be displayed in the table
+When user opens the rule preview for this rule
+Then the preview should open
+And the Setup Guide section should NOT be displayed in the Overview tab
+And the Investigation Guide tab should NOT be displayed
+```
+
 ### Rule installation workflow: filtering, sorting, pagination
 
 TODO: add scenarios https://github.com/elastic/kibana/issues/166215
@@ -467,7 +602,7 @@ And for Y of the installed rules there are new versions available
 And user is on the Rule Management page
 When user opens the Rule Updates table
 Then Y rules available for upgrade should be displayed in the table
-When user upgrades one individual rule
+When user upgrades one individual rule without previewing it
 Then success message should be displayed after upgrade
 And the upgraded rule should be removed from the table
 And user should see the number of rules available to upgrade decreased by 1
@@ -513,6 +648,65 @@ And user should NOT see a number of rules available to upgrade
 And user should NOT see the Rule Updates table
 ```
 
+#### **Scenario: User can preview a rule before upgrading**
+
+**Automation**: 1 e2e test
+
+```Gherkin
+Given 2 prebuilt rules are installed in Kibana
+And for these 2 installed rules there are new versions available
+And user is on the Rule Management page
+When user opens the Rule Updates table
+Then all rules available for upgrade should be displayed in the table
+When user opens the rule preview for the 1st rule
+Then the preview should open
+When user closes the preview
+Then it should disappear
+When user opens the rule preview for the 2nd rule
+Then the preview should open
+When user upgrades the rule using a CTA in the rule preview
+Then the 2nd rule should be upgraded to the latest version
+And a success message should be displayed after upgrade
+And the 2nd rule should be removed from the Rule Updates table
+And user should see the number of rules available to upgrade as 1
+```
+
+#### **Scenario: User can see correct rule information in preview before upgrading**
+
+**Automation**: 1 e2e test
+
+```Gherkin
+Given X prebuilt rules of all types are installed in Kibana
+And for all of the installed rules there are new versions available
+And user is on the Rule Management page
+When user opens the Rule Updates table
+Then all X rules available for upgrade should be displayed in the table
+When user opens the rule preview for the 1st rule
+Then the preview should open
+And all properties of the new version of the 1st rule should be displayed in the correct tab and section of the preview (see examples of rule properties above)
+When user selects the 2nd rule in the table
+Then the preview should be updated
+And all properties of the new version of the 2nd rule should be displayed in the correct tab and section of the preview (see examples of rule properties above)
+And user should be able to repeat this for all X rules
+```
+
+#### **Scenario: Tabs and sections without content should be hidden in preview before upgrading**
+
+**Automation**: 1 e2e test
+
+```Gherkin
+Given at least 1 prebuilt rule is installed in Kibana
+And for this rule there is a new version available
+And the updated version of a rule has neither Setup guide nor Investigation guide
+And user is on the Rule Management page
+When user opens the Rule Updates table
+Then all rules available for upgrade should be displayed in the table
+When user opens the rule preview for a rule without Setup guide and Investigation guide
+Then the preview should open
+And the Setup Guide section should NOT be displayed in the Overview tab
+And the Investigation Guide tab should NOT be displayed
+```
+
 ### Rule upgrade workflow: filtering, sorting, pagination
 
 TODO: add scenarios https://github.com/elastic/kibana/issues/166215
diff --git a/x-pack/plugins/security_solution/public/assistant/get_comments/index.tsx b/x-pack/plugins/security_solution/public/assistant/get_comments/index.tsx
index d91caae855d22..b87de5bc64874 100644
--- a/x-pack/plugins/security_solution/public/assistant/get_comments/index.tsx
+++ b/x-pack/plugins/security_solution/public/assistant/get_comments/index.tsx
@@ -11,7 +11,7 @@ import { EuiAvatar, EuiMarkdownFormat, EuiText, tint } from '@elastic/eui';
 import React from 'react';
 
 import { AssistantAvatar } from '@kbn/elastic-assistant';
-import { css } from '@emotion/react/dist/emotion-react.cjs';
+import { css } from '@emotion/react';
 import { euiThemeVars } from '@kbn/ui-theme';
 import { CommentActions } from '../comment_actions';
 import * as i18n from './translations';
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/esql_info_icon/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/esql_info_icon/index.tsx
index 0130b8eed78b8..d0b4cee6752ad 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/esql_info_icon/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/esql_info_icon/index.tsx
@@ -6,16 +6,13 @@
  */
 
 import React from 'react';
-import { EuiPopover, EuiText, EuiButtonIcon } from '@elastic/eui';
-import { Markdown } from '@kbn/kibana-react-plugin/public';
+import { EuiPopover, EuiText, EuiButtonIcon, EuiLink } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
 import * as i18n from './translations';
 
 import { useBoolState } from '../../../../common/hooks/use_bool_state';
-
 import { useKibana } from '../../../../common/lib/kibana';
 
-const POPOVER_WIDTH = 640;
-
 /**
  * Icon and popover that gives hint to users how to get started with ES|QL rules
  */
@@ -30,14 +27,20 @@ const EsqlInfoIconComponent = () => {
 
   return (
     <EuiPopover button={button} isOpen={isPopoverOpen} closePopover={closePopover}>
-      <EuiText style={{ width: POPOVER_WIDTH }} size="s">
-        <Markdown
-          markdown={i18n.getTooltipContent(
-            docLinks.links.esql.statsBy,
-            // Docs team will provide actual link to a new page before release
-            // For now, it's just a mock
-            docLinks.links.esql.statsBy
-          )}
+      <EuiText size="s">
+        <FormattedMessage
+          id="xpack.securitySolution.detectionEngine.createRule.stepDefineRule.esqlInfoTooltipContent"
+          defaultMessage="Check out our {createEsqlRuleTypeLink} to get started using ES|QL rules."
+          values={{
+            createEsqlRuleTypeLink: (
+              <EuiLink href={docLinks.links.securitySolution.createEsqlRuleType} target="_blank">
+                <FormattedMessage
+                  id="xpack.securitySolution.detectionEngine.createRule.stepDefineRule.esqlInfoTooltipLink"
+                  defaultMessage="documentation"
+                />
+              </EuiLink>
+            ),
+          }}
         />
       </EuiText>
     </EuiPopover>
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/esql_info_icon/translations.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/esql_info_icon/translations.ts
index db5f8ea86ce63..8729f7b0dd3bc 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/esql_info_icon/translations.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/esql_info_icon/translations.ts
@@ -13,39 +13,3 @@ export const ARIA_LABEL = i18n.translate(
     defaultMessage: `Open help popover`,
   }
 );
-
-export const getTooltipContent = (statsByLink: string, startUsingEsqlLink: string) =>
-  i18n.translate(
-    'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.esqlInfoTooltipContent',
-    {
-      defaultMessage: `
-### Aggregating rule
-Is a rule that uses {statsByLink} grouping commands. So, its result can not be matched with a particular document in ES.
-\`\`\`
-FROM logs*
-| STATS count = COUNT(host.name) BY host.name
-| SORT host.name
-\`\`\`
-
-
-### Non-aggregating rule
-Is a rule that does not use {statsByLink} grouping commands. Hence, each row in result can be tracked to a source document in ES. For this type of rule,
-please use operator \`[metadata _id, _index, _version]\` after defining index source. This would allow deduplicate alerts and link them with the source document.
-
-Example
-
-\`\`\`
-FROM logs* [metadata _id, _index, _version]
-| WHERE event.id == "test"
-| LIMIT 10
-\`\`\`
-
-Please, ensure, metadata properties \`id\`, \`_index\`, \`_version\` are carried over through pipe operators.
-    `,
-      values: {
-        statsByLink: `[STATS..BY](${statsByLink})`,
-        // Docs team will provide actual link to a new page before release
-        //  startUsingEsqlLink: `[WIP: Get started using ES|QL rules](${startUsingEsqlLink})`,
-      },
-    }
-  );
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/translations.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/translations.ts
index e0bbcd45b1f1a..bbb00053cdfab 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/translations.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/translations.ts
@@ -23,6 +23,6 @@ export const esqlValidationErrorMessage = (message: string) =>
 export const ESQL_VALIDATION_MISSING_ID_IN_QUERY_ERROR = i18n.translate(
   'xpack.securitySolution.detectionEngine.esqlValidation.missingIdInQueryError',
   {
-    defaultMessage: `For non-aggregating rules(that don't use STATS..BY function), please write query that returns _id field from [metadata _id, _version, _index] operator`,
+    defaultMessage: `Queries that don’t use the STATS...BY function (non-aggregating queries) must include the [metadata _id, _version, _index] operator after the source command. For example: FROM logs* [metadata _id, _version, _index].  In addition, the metadata properties (_id, _version, and _index)  must be returned in the query response.`,
   }
 );
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
index cfd62ff3d57da..d8b61de136865 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
@@ -32,7 +32,8 @@ export const ESQL_TYPE_TITLE = i18n.translate(
 export const ESQL_TYPE_DESCRIPTION = i18n.translate(
   'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.esqlTypeDescription',
   {
-    defaultMessage: 'Use The Elasticsearch Query Language (ES|QL) to search or aggregate events',
+    defaultMessage:
+      'Use Elasticsearch Query Language (ES|QL) to find events and aggregate search results.',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/explore/containers/risk_score/kpi/index.tsx b/x-pack/plugins/security_solution/public/explore/containers/risk_score/kpi/index.tsx
index 36e0a5a44190f..2d8712556ae24 100644
--- a/x-pack/plugins/security_solution/public/explore/containers/risk_score/kpi/index.tsx
+++ b/x-pack/plugins/security_solution/public/explore/containers/risk_score/kpi/index.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { useEffect, useMemo } from 'react';
+import { useCallback, useEffect, useMemo } from 'react';
 
 import {
   getHostRiskIndex,
@@ -20,12 +20,12 @@ import { isIndexNotFoundError } from '../../../../common/utils/exceptions';
 import type { ESQuery } from '../../../../../common/typed_json';
 import type { SeverityCount } from '../../../components/risk_score/severity/types';
 import { useSpaceId } from '../../../../common/hooks/use_space_id';
-import { useMlCapabilities } from '../../../../common/components/ml/hooks/use_ml_capabilities';
 import { useSearchStrategy } from '../../../../common/containers/use_search_strategy';
 import type { InspectResponse } from '../../../../types';
 import type { inputsModel } from '../../../../common/store';
 import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
 import { useIsNewRiskScoreModuleInstalled } from '../../../../entity_analytics/api/hooks/use_risk_engine_status';
+import { useRiskScoreFeatureStatus } from '../feature_status';
 
 interface RiskScoreKpi {
   error: unknown;
@@ -52,7 +52,6 @@ export const useRiskScoreKpi = ({
 }: UseRiskScoreKpiProps): RiskScoreKpi => {
   const { addError } = useAppToasts();
   const spaceId = useSpaceId();
-  const featureEnabled = useMlCapabilities().isPlatinumOrTrialLicense;
   const isNewRiskScoreModuleInstalled = useIsNewRiskScoreModuleInstalled();
   const defaultIndex = spaceId
     ? riskEntity === RiskScoreEntity.host
@@ -60,6 +59,14 @@ export const useRiskScoreKpi = ({
       : getUserRiskIndex(spaceId, true, isNewRiskScoreModuleInstalled)
     : undefined;
 
+  const {
+    isDeprecated,
+    isEnabled,
+    isAuthorized,
+    isLoading: isDeprecatedLoading,
+    refetch: refetchDeprecated,
+  } = useRiskScoreFeatureStatus(riskEntity, defaultIndex);
+
   const { loading, result, search, refetch, inspect, error } =
     useSearchStrategy<RiskQueries.kpiRiskScore>({
       factoryQueryType: RiskQueries.kpiRiskScore,
@@ -73,18 +80,42 @@ export const useRiskScoreKpi = ({
   const isModuleDisabled = !!error && isIndexNotFoundError(error);
 
   useEffect(() => {
-    if (!skip && defaultIndex && featureEnabled) {
+    if (
+      !skip &&
+      defaultIndex &&
+      !isDeprecatedLoading &&
+      isAuthorized &&
+      isEnabled &&
+      !isDeprecated
+    ) {
       search({
         filterQuery,
         defaultIndex: [defaultIndex],
         entity: riskEntity,
       });
     }
-  }, [defaultIndex, search, filterQuery, skip, riskEntity, featureEnabled]);
+  }, [
+    isEnabled,
+    isDeprecated,
+    isAuthorized,
+    isDeprecatedLoading,
+    skip,
+    defaultIndex,
+    search,
+    filterQuery,
+    riskEntity,
+  ]);
+
+  const refetchAll = useCallback(() => {
+    if (defaultIndex) {
+      refetchDeprecated(defaultIndex);
+      refetch();
+    }
+  }, [defaultIndex, refetch, refetchDeprecated]);
 
   // since query does not take timerange arg, we need to manually refetch when time range updates
   useEffect(() => {
-    refetch();
+    refetchAll();
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [timerange?.to, timerange?.from]);
 
diff --git a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/session_preview_container.tsx b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/session_preview_container.tsx
index 101c067ad661d..10250e74c383c 100644
--- a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/session_preview_container.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/document_details/right/components/session_preview_container.tsx
@@ -10,7 +10,7 @@ import { TimelineTabs } from '@kbn/securitysolution-data-table';
 import { useDispatch } from 'react-redux';
 import { EuiLink, useEuiTheme } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { css } from '@emotion/css/dist/emotion-css.cjs';
+import { css } from '@emotion/css';
 import { useLicense } from '../../../../common/hooks/use_license';
 import { SessionPreview } from './session_preview';
 import { useSessionPreview } from '../hooks/use_session_preview';
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts.cy.ts
index 012456d92db9e..3850409f05911 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts.cy.ts
@@ -36,7 +36,8 @@ const yieldAppliedEndpointRevision = (): Cypress.Chainable<number> =>
 
 const parseRevNumber = (revString: string) => Number(revString.match(/\d+/)?.[0]);
 
-describe('Artifact pages', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
+// FLAKY: https://github.com/elastic/kibana/issues/168342
+describe.skip('Artifact pages', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
   let indexedPolicy: IndexedFleetEndpointPolicyResponse;
   let policy: PolicyData;
   let createdHost: CreateAndEnrollEndpointHostResponse;
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/integration_tests/policy_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/integration_tests/policy_list.test.tsx
index ee520a98632bc..abb68f1d79814 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/integration_tests/policy_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/integration_tests/policy_list.test.tsx
@@ -25,7 +25,8 @@ jest.mock('../../../../../common/components/user_privileges');
 const getPackagePolicies = sendGetEndpointSpecificPackagePolicies as jest.Mock;
 const useUserPrivilegesMock = useUserPrivileges as jest.Mock;
 
-describe('When on the policy list page', () => {
+// Failing: See https://github.com/elastic/kibana/issues/169133
+describe.skip('When on the policy list page', () => {
   let render: () => ReturnType<AppContextTestRender['render']>;
   let renderResult: ReturnType<typeof render>;
   let history: AppContextTestRender['history'];
diff --git a/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_server/fleet_server_services.ts b/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_server/fleet_server_services.ts
index 4357adeeaf6cd..838e94d8faa00 100644
--- a/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_server/fleet_server_services.ts
+++ b/x-pack/plugins/security_solution/scripts/endpoint/common/fleet_server/fleet_server_services.ts
@@ -287,7 +287,10 @@ const startFleetServerWithDocker = async ({
 
       log.info(`Fleet server started`);
 
-      await addFleetServerHostToFleetSettings(kbnClient, log, fleetServerUrl);
+      if (!isServerless) {
+        await addFleetServerHostToFleetSettings(kbnClient, log, fleetServerUrl);
+      }
+
       await updateFleetElasticsearchOutputHostNames(kbnClient, log);
 
       if (isServerless) {
diff --git a/x-pack/plugins/security_solution_serverless/common/config.ts b/x-pack/plugins/security_solution_serverless/common/config.ts
index b1aaef412fcb1..f4e9151988a60 100644
--- a/x-pack/plugins/security_solution_serverless/common/config.ts
+++ b/x-pack/plugins/security_solution_serverless/common/config.ts
@@ -33,28 +33,8 @@ export const productTypes = schema.arrayOf<SecurityProductType>(productType, {
 });
 export type SecurityProductTypes = TypeOf<typeof productTypes>;
 
-/**
- * Developer only options that can be set in `serverless.security.dev.yml`
- */
-export const developerConfigSchema = schema.object({
-  /**
-   * Disables the redirect in the UI for kibana management pages (ex. users, roles, etc).
-   *
-   * NOTE:  you likely will also need to add the following to your `serverless.security.dev.yml`
-   *        file if wanting to access the user, roles and role mapping pages via URL
-   *
-   * xpack.security.ui.userManagementEnabled: true
-   * xpack.security.ui.roleManagementEnabled: true
-   * xpack.security.ui.roleMappingManagementEnabled: true
-   */
-  disableManagementUrlRedirect: schema.boolean({ defaultValue: false }),
-});
-
-export type DeveloperConfig = TypeOf<typeof developerConfigSchema>;
-
 export const configSchema = schema.object({
   enabled: schema.boolean({ defaultValue: false }),
-  developer: developerConfigSchema,
   productTypes,
   /**
    * For internal use. A list of string values (comma delimited) that will enable experimental
diff --git a/x-pack/plugins/security_solution_serverless/public/common/icons/index_management.tsx b/x-pack/plugins/security_solution_serverless/public/common/icons/index_management.tsx
deleted file mode 100644
index 8684c5bd05279..0000000000000
--- a/x-pack/plugins/security_solution_serverless/public/common/icons/index_management.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import type { SVGProps } from 'react';
-import React from 'react';
-export const IconIndexManagement: React.FC<SVGProps<SVGSVGElement>> = ({ ...props }) => (
-  <svg
-    width="32"
-    height="32"
-    viewBox="0 0 32 32"
-    fill="none"
-    xmlns="http://www.w3.org/2000/svg"
-    {...props}
-  >
-    <g id="Group 13">
-      <path
-        id="Fill 1"
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M17 18V16H15V18H3V24H5V20H15V24H17V20H27V24H29V18H17Z"
-        fill="#535766"
-      />
-      <g id="Group 12">
-        <path
-          id="Fill 2"
-          fillRule="evenodd"
-          clipRule="evenodd"
-          d="M4 28C3.448 28 3 28.448 3 29C3 29.552 3.448 30 4 30C4.552 30 5 29.552 5 29C5 28.448 4.552 28 4 28ZM4 32C2.346 32 1 30.654 1 29C1 27.346 2.346 26 4 26C5.654 26 7 27.346 7 29C7 30.654 5.654 32 4 32Z"
-          fill="#00BFB3"
-        />
-        <path
-          id="Fill 4"
-          fillRule="evenodd"
-          clipRule="evenodd"
-          d="M16 28C15.448 28 15 28.448 15 29C15 29.552 15.448 30 16 30C16.552 30 17 29.552 17 29C17 28.448 16.552 28 16 28ZM16 32C14.346 32 13 30.654 13 29C13 27.346 14.346 26 16 26C17.654 26 19 27.346 19 29C19 30.654 17.654 32 16 32Z"
-          fill="#00BFB3"
-        />
-        <path
-          id="Fill 6"
-          fillRule="evenodd"
-          clipRule="evenodd"
-          d="M28 28C27.448 28 27 28.448 27 29C27 29.552 27.448 30 28 30C28.552 30 29 29.552 29 29C29 28.448 28.552 28 28 28ZM28 32C26.346 32 25 30.654 25 29C25 27.346 26.346 26 28 26C29.654 26 31 27.346 31 29C31 30.654 29.654 32 28 32Z"
-          fill="#00BFB3"
-        />
-        <path
-          id="Fill 8"
-          fillRule="evenodd"
-          clipRule="evenodd"
-          d="M16 10C14.346 10 13 8.654 13 7C13 5.346 14.346 4 16 4C17.654 4 19 5.346 19 7C19 8.654 17.654 10 16 10ZM23 8V6H20.898C20.77 5.363 20.515 4.771 20.167 4.247L21.657 2.757L20.243 1.343L18.753 2.833C18.229 2.485 17.637 2.23 17 2.102V0H15V2.102C14.363 2.23 13.771 2.485 13.247 2.833L11.757 1.343L10.343 2.757L11.833 4.247C11.485 4.771 11.23 5.363 11.102 6H9V8H11.102C11.23 8.637 11.485 9.229 11.833 9.753L10.343 11.243L11.757 12.657L13.247 11.167C13.771 11.515 14.363 11.77 15 11.898V14H17V11.898C17.637 11.77 18.229 11.515 18.753 11.167L20.243 12.657L21.657 11.243L20.167 9.753C20.515 9.229 20.77 8.637 20.898 8H23Z"
-          fill="#00BFB3"
-        />
-        <path
-          id="Fill 10"
-          fillRule="evenodd"
-          clipRule="evenodd"
-          d="M16 8C15.729 8 15.479 7.899 15.29 7.71C15.1 7.52 15 7.27 15 7C15 6.93 15.01 6.87 15.02 6.8C15.03 6.74 15.05 6.68 15.08 6.62C15.1 6.56 15.13 6.5 15.17 6.439C15.2 6.39 15.25 6.34 15.29 6.29C15.38 6.2 15.49 6.13 15.62 6.08C15.979 5.93 16.43 6.01 16.71 6.29L16.83 6.439C16.87 6.5 16.899 6.56 16.92 6.62C16.95 6.68 16.97 6.74 16.979 6.8C16.99 6.87 17 6.93 17 7C17 7.27 16.899 7.52 16.71 7.71C16.52 7.899 16.27 8 16 8Z"
-          fill="#535766"
-        />
-      </g>
-    </g>
-  </svg>
-);
-
-// eslint-disable-next-line import/no-default-export
-export default IconIndexManagement;
diff --git a/x-pack/plugins/security_solution_serverless/public/common/icons/map_services.tsx b/x-pack/plugins/security_solution_serverless/public/common/icons/map_services.tsx
deleted file mode 100644
index a9004b486228c..0000000000000
--- a/x-pack/plugins/security_solution_serverless/public/common/icons/map_services.tsx
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import type { SVGProps } from 'react';
-import React from 'react';
-export const IconMapServices: React.FC<SVGProps<SVGSVGElement>> = ({ ...props }) => (
-  <svg
-    width="32"
-    height="32"
-    viewBox="0 0 32 32"
-    fill="none"
-    xmlns="http://www.w3.org/2000/svg"
-    {...props}
-  >
-    <path d="M3 22H6V24H1V1H24V6H22V3H3V22Z" fill="#00BFB3" />
-    <path
-      fillRule="evenodd"
-      clipRule="evenodd"
-      d="M31 31V8H8V31H31ZM10 29V10H29V29H10Z"
-      fill="#535766"
-    />
-    <path
-      d="M30.8227 21.1314L29.1773 22.2683C25.3207 16.6863 18.6562 14.1699 16.5129 17.6167C15.6822 18.9527 15.8443 19.9862 16.9432 22.2789C16.9911 22.3787 16.9911 22.3787 17.0395 22.4794C18.7858 26.1116 18.9092 28.0826 16.3826 30.6952L14.9449 29.3048C16.7327 27.4562 16.6607 26.3072 15.237 23.346C15.1885 23.2451 15.1885 23.2451 15.1397 23.1433C13.771 20.2879 13.5144 18.6515 14.8145 16.5606C18.0019 11.4346 26.2837 14.5616 30.8227 21.1314Z"
-      fill="#535766"
-    />
-  </svg>
-);
-
-// eslint-disable-next-line import/no-default-export
-export default IconMapServices;
diff --git a/x-pack/plugins/security_solution_serverless/public/common/icons/reporting.tsx b/x-pack/plugins/security_solution_serverless/public/common/icons/reporting.tsx
deleted file mode 100644
index ba783401ef7e5..0000000000000
--- a/x-pack/plugins/security_solution_serverless/public/common/icons/reporting.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import type { SVGProps } from 'react';
-import React from 'react';
-export const IconReporting: React.FC<SVGProps<SVGSVGElement>> = ({ ...props }) => (
-  <svg
-    width="32"
-    height="32"
-    viewBox="0 0 32 32"
-    fill="none"
-    xmlns="http://www.w3.org/2000/svg"
-    {...props}
-  >
-    <path
-      id="Stroke 1"
-      d="M20.833 7V5H21C22.6563 5 24 6.34372 24 8V28C24 29.6563 22.6563 31 21 31H3C1.34372 31 0 29.6563 0 28V8C0 6.34372 1.34372 5 3 5H3.167V7H3C2.44828 7 2 7.44828 2 8V28C2 28.5517 2.44828 29 3 29H21C21.5517 29 22 28.5517 22 28V8C22 7.44828 21.5517 7 21 7H20.833Z"
-      fill="#535766"
-    />
-    <path
-      id="Stroke 3"
-      fillRule="evenodd"
-      clipRule="evenodd"
-      d="M19 9V3H15.874C15.4299 1.27477 13.8638 0 12 0C10.1362 0 8.57006 1.27477 8.12602 3H5V9H19ZM14 5H17V7H7V5H10V4C10 2.89543 10.8954 2 12 2C13.1046 2 14 2.89543 14 4V5Z"
-      fill="#535766"
-    />
-    <path id="Stroke 5" d="M6 15V13H18V15H6Z" fill="#00BFB3" />
-    <path id="Stroke 7" d="M6 20V18H18V20H6Z" fill="#00BFB3" />
-    <path id="Stroke 9" d="M6 25V23H18V25H6Z" fill="#00BFB3" />
-  </svg>
-);
-
-// eslint-disable-next-line import/no-default-export
-export default IconReporting;
diff --git a/x-pack/plugins/security_solution_serverless/public/common/icons/users_roles.tsx b/x-pack/plugins/security_solution_serverless/public/common/icons/users_roles.tsx
deleted file mode 100644
index 3eb961f783f67..0000000000000
--- a/x-pack/plugins/security_solution_serverless/public/common/icons/users_roles.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import type { SVGProps } from 'react';
-import React from 'react';
-export const IconUsersRoles: React.FC<SVGProps<SVGSVGElement>> = ({ ...props }) => (
-  <svg
-    width="32"
-    height="32"
-    viewBox="0 0 32 32"
-    fill="none"
-    xmlns="http://www.w3.org/2000/svg"
-    {...props}
-  >
-    <path
-      id="Fill 1"
-      fillRule="evenodd"
-      clipRule="evenodd"
-      d="M16 4C15.448 4 15 3.552 15 3C15 2.448 15.448 2 16 2C16.552 2 17 2.448 17 3C17 3.552 16.552 4 16 4ZM18.911 2.308C18.597 0.987 17.415 0 16 0C14.346 0 13 1.346 13 3C13 4.654 14.346 6 16 6C17.176 6 18.186 5.313 18.677 4.326C22.501 5.203 25.711 7.91 27.166 11.597L29.027 10.862C27.302 6.491 23.47 3.274 18.911 2.308Z"
-      fill="#535766"
-    />
-    <path
-      id="Fill 3"
-      fillRule="evenodd"
-      clipRule="evenodd"
-      d="M3 17C2.448 17 2 16.552 2 16C2 15.448 2.448 15 3 15C3.552 15 4 15.448 4 16C4 16.552 3.552 17 3 17ZM11.597 4.83402L10.862 2.97302C6.491 4.69802 3.274 8.53002 2.308 13.089C0.987 13.403 0 14.585 0 16C0 17.654 1.346 19 3 19C4.654 19 6 17.654 6 16C6 14.824 5.313 13.814 4.326 13.323C5.203 9.49902 7.91 6.28902 11.597 4.83402Z"
-      fill="#535766"
-    />
-    <path
-      id="Fill 5"
-      fillRule="evenodd"
-      clipRule="evenodd"
-      d="M16.0001 30C15.4481 30 15.0001 29.552 15.0001 29C15.0001 28.448 15.4481 28 16.0001 28C16.5521 28 17.0001 28.448 17.0001 29C17.0001 29.552 16.5521 30 16.0001 30ZM16.0001 26C14.8241 26 13.8141 26.687 13.3231 27.674C9.49915 26.797 6.28914 24.09 4.83414 20.403L2.97314 21.138C4.69814 25.509 8.53014 28.726 13.0891 29.692C13.4031 31.013 14.5851 32 16.0001 32C17.6541 32 19.0001 30.654 19.0001 29C19.0001 27.346 17.6541 26 16.0001 26Z"
-      fill="#535766"
-    />
-    <path
-      id="Fill 7"
-      fillRule="evenodd"
-      clipRule="evenodd"
-      d="M28.9998 17C28.4478 17 27.9998 16.552 27.9998 16C27.9998 15.448 28.4478 15 28.9998 15C29.5518 15 29.9998 15.448 29.9998 16C29.9998 16.552 29.5518 17 28.9998 17ZM31.9998 16C31.9998 14.346 30.6538 13 28.9998 13C27.3458 13 25.9998 14.346 25.9998 16C25.9998 17.176 26.6868 18.186 27.6738 18.677C26.7978 22.501 24.0898 25.711 20.4028 27.166L21.1378 29.027C25.5088 27.302 28.7258 23.47 29.6918 18.911C31.0128 18.597 31.9998 17.415 31.9998 16Z"
-      fill="#535766"
-    />
-    <path
-      id="Fill 9"
-      fillRule="evenodd"
-      clipRule="evenodd"
-      d="M13 20C13 18.346 14.346 17 16 17C17.654 17 19 18.346 19 20H13ZM14 13C14 11.897 14.897 11 16 11C17.103 11 18 11.897 18 13C18 14.103 17.103 15 16 15C14.897 15 14 14.103 14 13ZM18.794 15.855C19.536 15.129 20 14.119 20 13C20 10.794 18.206 9 16 9C13.794 9 12 10.794 12 13C12 14.119 12.464 15.129 13.206 15.855C11.876 16.755 11 18.277 11 20V22H21V20C21 18.277 20.124 16.755 18.794 15.855Z"
-      fill="#00BFB3"
-    />
-  </svg>
-);
-
-// eslint-disable-next-line import/no-default-export
-export default IconUsersRoles;
diff --git a/x-pack/plugins/security_solution_serverless/public/common/lazy_icons.tsx b/x-pack/plugins/security_solution_serverless/public/common/lazy_icons.tsx
index f7e016d75c969..c49c4695b1493 100644
--- a/x-pack/plugins/security_solution_serverless/public/common/lazy_icons.tsx
+++ b/x-pack/plugins/security_solution_serverless/public/common/lazy_icons.tsx
@@ -19,18 +19,11 @@ const withSuspenseIcon = <T extends object = {}>(Component: React.ComponentType<
 
 export const IconLensLazy = withSuspenseIcon(React.lazy(() => import('./icons/lens')));
 export const IconEndpointLazy = withSuspenseIcon(React.lazy(() => import('./icons/endpoint')));
-export const IconIndexManagementLazy = withSuspenseIcon(
-  React.lazy(() => import('./icons/index_management'))
-);
 export const IconFleetLazy = withSuspenseIcon(React.lazy(() => import('./icons/fleet')));
 export const IconEcctlLazy = withSuspenseIcon(React.lazy(() => import('./icons/ecctl')));
-export const IconMapServicesLazy = withSuspenseIcon(
-  React.lazy(() => import('./icons/map_services'))
-);
+
 export const IconTimelineLazy = withSuspenseIcon(React.lazy(() => import('./icons/timeline')));
 export const IconOsqueryLazy = withSuspenseIcon(React.lazy(() => import('./icons/osquery')));
-export const IconUsersRolesLazy = withSuspenseIcon(React.lazy(() => import('./icons/users_roles')));
-export const IconReportingLazy = withSuspenseIcon(React.lazy(() => import('./icons/reporting')));
 export const IconVisualizationLazy = withSuspenseIcon(
   React.lazy(() => import('./icons/visualization'))
 );
diff --git a/x-pack/plugins/security_solution_serverless/public/common/services/create_services.ts b/x-pack/plugins/security_solution_serverless/public/common/services/create_services.ts
index 7967f8d00d6fb..790f65f2af819 100644
--- a/x-pack/plugins/security_solution_serverless/public/common/services/create_services.ts
+++ b/x-pack/plugins/security_solution_serverless/public/common/services/create_services.ts
@@ -21,12 +21,7 @@ export const createServices = (
   experimentalFeatures: ExperimentalFeatures
 ): Services => {
   const { securitySolution, cloud } = pluginsStart;
-  const projectNavLinks$ = createProjectNavLinks$(
-    securitySolution.getNavLinks$(),
-    core,
-    cloud,
-    experimentalFeatures
-  );
+  const projectNavLinks$ = createProjectNavLinks$(securitySolution.getNavLinks$(), core, cloud);
   return {
     ...core,
     ...pluginsStart,
diff --git a/x-pack/plugins/security_solution_serverless/public/get_started/welcome_panel/change_plan_link.tsx b/x-pack/plugins/security_solution_serverless/public/get_started/welcome_panel/change_plan_link.tsx
index 19d6afd4a5843..b41dc0829f62b 100644
--- a/x-pack/plugins/security_solution_serverless/public/get_started/welcome_panel/change_plan_link.tsx
+++ b/x-pack/plugins/security_solution_serverless/public/get_started/welcome_panel/change_plan_link.tsx
@@ -6,7 +6,6 @@
  */
 
 import React from 'react';
-import { SecurityPageName } from '@kbn/security-solution-plugin/common';
 import {
   EuiFlexGroup,
   EuiFlexItem,
@@ -43,7 +42,6 @@ const ChangePlanLinkComponent = ({ productTier }: { productTier: ProductTier | u
             <ProductTierBadge productTier={productTier} />
             <EuiLink
               className="eui-alignMiddle"
-              id={SecurityPageName.projectSettings}
               css={css`
                 color: ${euiTheme.colors.primaryText};
                 padding-left: ${euiTheme.size.m};
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/index.ts b/x-pack/plugins/security_solution_serverless/public/navigation/index.ts
index 7462b03cb846a..1504f8dfea8c2 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/index.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/index.ts
@@ -5,36 +5,26 @@
  * 2.0.
  */
 
-import { APP_PATH, SecurityPageName } from '@kbn/security-solution-plugin/common';
+import { APP_PATH } from '@kbn/security-solution-plugin/common';
 import type { CoreSetup } from '@kbn/core/public';
-import type {
-  SecuritySolutionServerlessPluginSetupDeps,
-  ServerlessSecurityPublicConfig,
-} from '../types';
+import type { SecuritySolutionServerlessPluginSetupDeps } from '../types';
 import type { Services } from '../common/services';
 import { subscribeBreadcrumbs } from './breadcrumbs';
-import { SecurityPagePath } from './links/constants';
 import { ProjectNavigationTree } from './navigation_tree';
 import { getSecuritySideNavComponent } from './side_navigation';
 import { getDefaultNavigationComponent } from './default_navigation';
-import { getProjectAppLinksSwitcher } from './links/app_links';
+import { projectAppLinksSwitcher } from './links/app_links';
 import { formatProjectDeepLinks } from './links/deep_links';
-import type { ExperimentalFeatures } from '../../common/experimental_features';
-
-const SECURITY_PROJECT_SETTINGS_PATH = `${APP_PATH}${
-  SecurityPagePath[SecurityPageName.projectSettings]
-}`;
 
 export const setupNavigation = (
   _core: CoreSetup,
-  { securitySolution }: SecuritySolutionServerlessPluginSetupDeps,
-  experimentalFeatures: ExperimentalFeatures
+  { securitySolution }: SecuritySolutionServerlessPluginSetupDeps
 ) => {
-  securitySolution.setAppLinksSwitcher(getProjectAppLinksSwitcher(experimentalFeatures));
+  securitySolution.setAppLinksSwitcher(projectAppLinksSwitcher);
   securitySolution.setDeepLinksFormatter(formatProjectDeepLinks);
 };
 
-export const startNavigation = (services: Services, config: ServerlessSecurityPublicConfig) => {
+export const startNavigation = (services: Services) => {
   const { serverless, management } = services;
   serverless.setProjectHome(APP_PATH);
 
@@ -45,9 +35,8 @@ export const startNavigation = (services: Services, config: ServerlessSecurityPu
       serverless.setSideNavComponent(getDefaultNavigationComponent(navigationTree, services));
     });
   } else {
-    if (!config.developer.disableManagementUrlRedirect) {
-      management.setLandingPageRedirect(SECURITY_PROJECT_SETTINGS_PATH);
-    }
+    management.setupCardsNavigation({ enabled: true });
+
     projectNavigationTree.getChromeNavigationTree$().subscribe((chromeNavigationTree) => {
       serverless.setNavigation({ navigationTree: chromeNavigationTree });
     });
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/links/app_links.ts b/x-pack/plugins/security_solution_serverless/public/navigation/links/app_links.ts
index 4cb0cc4a7fd7c..9d591491cede6 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/links/app_links.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/links/app_links.ts
@@ -14,39 +14,33 @@ import { cloneDeep, remove } from 'lodash';
 import { createInvestigationsLinkFromTimeline } from './sections/investigations_links';
 import { mlAppLink } from './sections/ml_links';
 import { createAssetsLinkFromManage } from './sections/assets_links';
-import { createProjectSettingsLinkFromManage } from './sections/project_settings_links';
-import type { ExperimentalFeatures } from '../../../common/experimental_features';
+import { createProjectSettingsLinksFromManage } from './sections/project_settings_links';
 
 // This function is called by the security_solution plugin to alter the app links
 // that will be registered to the Security Solution application on Serverless projects.
 // The capabilities filtering is done after this function is called by the security_solution plugin.
-export const getProjectAppLinksSwitcher =
-  (experimentalFeatures: ExperimentalFeatures): AppLinksSwitcher =>
-  (appLinks) => {
-    const projectAppLinks = cloneDeep(appLinks) as LinkItem[];
-
-    // Remove timeline link
-    const [timelineLinkItem] = remove(projectAppLinks, { id: SecurityPageName.timelines });
-    if (timelineLinkItem) {
-      // Add investigations link
-      projectAppLinks.push(createInvestigationsLinkFromTimeline(timelineLinkItem));
-    }
-
-    // Remove manage link
-    const [manageLinkItem] = remove(projectAppLinks, { id: SecurityPageName.administration });
-
-    if (manageLinkItem) {
-      // Add assets link
-      projectAppLinks.push(createAssetsLinkFromManage(manageLinkItem));
-    }
-
-    // Add ML link
-    projectAppLinks.push(mlAppLink);
-
-    if (!experimentalFeatures.platformNavEnabled && manageLinkItem) {
-      // Add project settings link
-      projectAppLinks.push(createProjectSettingsLinkFromManage(manageLinkItem));
-    }
-
-    return projectAppLinks;
-  };
+export const projectAppLinksSwitcher: AppLinksSwitcher = (appLinks) => {
+  const projectAppLinks = cloneDeep(appLinks) as LinkItem[];
+
+  // Remove timeline link
+  const [timelineLinkItem] = remove(projectAppLinks, { id: SecurityPageName.timelines });
+  if (timelineLinkItem) {
+    // Add investigations link
+    projectAppLinks.push(createInvestigationsLinkFromTimeline(timelineLinkItem));
+  }
+
+  // Remove manage link
+  const [manageLinkItem] = remove(projectAppLinks, { id: SecurityPageName.administration });
+
+  if (manageLinkItem) {
+    // Add assets link
+    projectAppLinks.push(createAssetsLinkFromManage(manageLinkItem));
+    // Add entity analytics link if exists
+    projectAppLinks.push(...createProjectSettingsLinksFromManage(manageLinkItem));
+  }
+
+  // Add ML link
+  projectAppLinks.push(mlAppLink);
+
+  return projectAppLinks;
+};
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/links/constants.ts b/x-pack/plugins/security_solution_serverless/public/navigation/links/constants.ts
index dca89a4a00111..57f333f90ffc3 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/links/constants.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/links/constants.ts
@@ -13,7 +13,6 @@ export const SecurityPagePath = {
   [SecurityPageName.mlLanding]: '/ml',
   [SecurityPageName.assets]: '/assets',
   [SecurityPageName.cloudDefend]: '/cloud_defend',
-  [SecurityPageName.projectSettings]: '/project_settings',
 } as const;
 
 /**
@@ -74,6 +73,7 @@ export enum ExternalPageName {
   integrationsSecurity = 'integrations:/browse/security',
   // Management
   // Ref: packages/default-nav/management/default_navigation.ts
+  management = 'management:',
   managementIngestPipelines = 'management:ingest_pipelines',
   managementPipelines = 'management:pipelines',
   managementIndexManagement = 'management:index_management',
@@ -97,4 +97,5 @@ export enum ExternalPageName {
   // cloudUrlKey Ref: x-pack/plugins/security_solution_serverless/public/navigation/links/util.ts
   cloudUsersAndRoles = 'cloud:usersAndRoles',
   cloudBilling = 'cloud:billing',
+  cloudPerformance = 'cloud:performance',
 }
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/links/nav.links.test.ts b/x-pack/plugins/security_solution_serverless/public/navigation/links/nav.links.test.ts
index d06b28df01955..2fb039dbc52bf 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/links/nav.links.test.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/links/nav.links.test.ts
@@ -9,19 +9,14 @@ import { APP_UI_ID } from '@kbn/security-solution-plugin/common';
 import type { NavigationLink } from '@kbn/security-solution-navigation';
 import { SecurityPageName } from '@kbn/security-solution-navigation';
 import { createProjectNavLinks$ } from './nav_links';
+import type { Observable } from 'rxjs';
 import { BehaviorSubject, firstValueFrom, take } from 'rxjs';
 import { mockServices } from '../../common/services/__mocks__/services.mock';
 import { mlNavCategories, mlNavLinks } from './sections/ml_links';
 import { assetsNavLinks } from './sections/assets_links';
 import { ExternalPageName } from './constants';
-import type { ProjectNavigationLink } from './types';
 import { investigationsNavLinks } from './sections/investigations_links';
-import {
-  projectSettingsNavCategories,
-  projectSettingsNavLinks,
-} from './sections/project_settings_links';
 import { isCloudLink } from './util';
-import type { ExperimentalFeatures } from '../../../common/experimental_features';
 
 const mockCloudStart = mockServices.cloud;
 const mockChromeNavLinks = jest.fn((): ChromeNavLink[] => []);
@@ -40,7 +35,6 @@ const testServices = {
     },
   },
 };
-const experimentalFeatures = { platformNavEnabled: false } as ExperimentalFeatures;
 
 const link1Id = 'link-1' as SecurityPageName;
 const link2Id = 'link-2' as SecurityPageName;
@@ -52,15 +46,6 @@ const linkMlLanding: NavigationLink<SecurityPageName> = {
   title: 'ML Landing',
   links: [],
 };
-const projectLinkDevTools: ProjectNavigationLink = {
-  id: ExternalPageName.devTools,
-  title: 'Dev tools',
-};
-
-const projectLinkDiscover: ProjectNavigationLink = {
-  id: ExternalPageName.discover,
-  title: 'Discover',
-};
 
 const chromeNavLink1: ChromeNavLink = {
   id: `${APP_UI_ID}:${link1.id}`,
@@ -77,6 +62,22 @@ const devToolsChromeNavLink: ChromeNavLink = {
   baseUrl: '',
 };
 
+const createTestProjectNavLinks = async (
+  testSecurityNavLinks$: Observable<Array<NavigationLink<SecurityPageName>>>,
+  { filterCloudLinks = true }: { filterCloudLinks?: boolean } = {}
+) => {
+  const projectNavLinks$ = createProjectNavLinks$(
+    testSecurityNavLinks$,
+    testServices,
+    mockCloudStart
+  );
+  const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
+  if (filterCloudLinks) {
+    return value.filter((link) => !isCloudLink(link.id));
+  }
+  return value;
+};
+
 describe('getProjectNavLinks', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -86,47 +87,19 @@ describe('getProjectNavLinks', () => {
     );
   });
 
-  it('should return security nav links with all external links filtered', async () => {
+  it('should return security nav links with all external (non cloud) links filtered', async () => {
     mockChromeNavLinksHas.mockReturnValue(false); // no external links exist
     const testSecurityNavLinks$ = new BehaviorSubject([link1, link2]);
 
-    const projectNavLinks$ = createProjectNavLinks$(
-      testSecurityNavLinks$,
-      testServices,
-      mockCloudStart,
-      experimentalFeatures
-    );
-    const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
+    const value = await createTestProjectNavLinks(testSecurityNavLinks$);
     expect(value).toEqual([link1, link2]);
   });
 
-  it('should add devTools nav link if chrome nav link exists', async () => {
-    mockChromeNavLinks.mockReturnValue([devToolsChromeNavLink]);
-    const testSecurityNavLinks$ = new BehaviorSubject([link1]);
-
-    const projectNavLinks$ = createProjectNavLinks$(
-      testSecurityNavLinks$,
-      testServices,
-      mockCloudStart,
-      experimentalFeatures
-    );
-
-    const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
-    expect(value).toEqual([link1, projectLinkDevTools]);
-  });
-
   it('should filter all external links not configured in chrome links', async () => {
     mockChromeNavLinks.mockReturnValue([chromeNavLink1]);
     const testSecurityNavLinks$ = new BehaviorSubject([link1, link2, linkMlLanding]);
 
-    const projectNavLinks$ = createProjectNavLinks$(
-      testSecurityNavLinks$,
-      testServices,
-      mockCloudStart,
-      experimentalFeatures
-    );
-
-    const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
+    const value = await createTestProjectNavLinks(testSecurityNavLinks$);
     expect(value).toEqual([
       link1,
       link2,
@@ -134,25 +107,26 @@ describe('getProjectNavLinks', () => {
     ]);
   });
 
+  it('should add devTools nav link if chrome nav link exists', async () => {
+    mockChromeNavLinks.mockReturnValue([devToolsChromeNavLink]);
+    const testSecurityNavLinks$ = new BehaviorSubject([link1]);
+
+    const value = await createTestProjectNavLinks(testSecurityNavLinks$);
+    expect(value).toEqual([link1, expect.objectContaining({ id: ExternalPageName.devTools })]);
+  });
+
   it('should add machineLearning links', async () => {
     mockChromeNavLinksHas.mockReturnValue(true); // all links exist
     const testSecurityNavLinks$ = new BehaviorSubject([link1, link2, linkMlLanding]);
 
-    const projectNavLinks$ = createProjectNavLinks$(
-      testSecurityNavLinks$,
-      testServices,
-      mockCloudStart,
-      experimentalFeatures
+    const value = await createTestProjectNavLinks(testSecurityNavLinks$);
+    expect(value).toEqual(
+      expect.arrayContaining([
+        link1,
+        link2,
+        { ...linkMlLanding, categories: mlNavCategories, links: mlNavLinks },
+      ])
     );
-
-    const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
-    expect(value).toEqual([
-      link1,
-      link2,
-      { ...linkMlLanding, categories: mlNavCategories, links: mlNavLinks },
-      projectLinkDiscover,
-      projectLinkDevTools,
-    ]);
   });
 
   it('should add assets links', async () => {
@@ -164,20 +138,10 @@ describe('getProjectNavLinks', () => {
     };
     const testSecurityNavLinks$ = new BehaviorSubject([link1, linkAssets]);
 
-    const projectNavLinks$ = createProjectNavLinks$(
-      testSecurityNavLinks$,
-      testServices,
-      mockCloudStart,
-      experimentalFeatures
+    const value = await createTestProjectNavLinks(testSecurityNavLinks$);
+    expect(value).toEqual(
+      expect.arrayContaining([link1, { ...linkAssets, links: [...assetsNavLinks, link2] }])
     );
-
-    const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
-    expect(value).toEqual([
-      link1,
-      { ...linkAssets, links: [...assetsNavLinks, link2] },
-      projectLinkDiscover,
-      projectLinkDevTools,
-    ]);
   });
 
   it('should add investigations links', async () => {
@@ -189,77 +153,41 @@ describe('getProjectNavLinks', () => {
     };
     const testSecurityNavLinks$ = new BehaviorSubject([link1, linkInvestigations]);
 
-    const projectNavLinks$ = createProjectNavLinks$(
-      testSecurityNavLinks$,
-      testServices,
-      mockCloudStart,
-      experimentalFeatures
+    const value = await createTestProjectNavLinks(testSecurityNavLinks$);
+    expect(value).toEqual(
+      expect.arrayContaining([
+        link1,
+        { ...linkInvestigations, links: [link2, ...investigationsNavLinks] },
+      ])
     );
-
-    const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
-    expect(value).toEqual([
-      link1,
-      { ...linkInvestigations, links: [link2, ...investigationsNavLinks] },
-      projectLinkDiscover,
-      projectLinkDevTools,
-    ]);
   });
 
   it('should add project settings links', async () => {
     mockChromeNavLinksHas.mockReturnValue(true); // all links exist
-    const linkProjectSettings: NavigationLink<SecurityPageName> = {
-      id: SecurityPageName.projectSettings,
-      title: 'Project settings',
-      links: [link2],
-    };
-    const testSecurityNavLinks$ = new BehaviorSubject([link1, linkProjectSettings]);
-
-    const projectNavLinks$ = createProjectNavLinks$(
-      testSecurityNavLinks$,
-      testServices,
-      mockCloudStart,
-      experimentalFeatures
-    );
-
-    const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
+    const testSecurityNavLinks$ = new BehaviorSubject([link1]);
 
-    const expectedProjectSettingsNavLinks = projectSettingsNavLinks.map(
-      (link) => expect.objectContaining(link) // ignore externalUrl property in cloud links, tested separately
+    const value = await createTestProjectNavLinks(testSecurityNavLinks$, {
+      filterCloudLinks: false,
+    });
+    expect(value).toEqual(
+      expect.arrayContaining([
+        link1,
+        expect.objectContaining({ id: ExternalPageName.management }),
+        expect.objectContaining({ id: ExternalPageName.integrationsSecurity }),
+        expect.objectContaining({ id: ExternalPageName.cloudUsersAndRoles }),
+        expect.objectContaining({ id: ExternalPageName.cloudBilling }),
+      ])
     );
-
-    expect(value).toEqual([
-      link1,
-      {
-        ...linkProjectSettings,
-        categories: projectSettingsNavCategories,
-        links: [...expectedProjectSettingsNavLinks, link2],
-      },
-      projectLinkDiscover,
-      projectLinkDevTools,
-    ]);
   });
 
   it('should process cloud links', async () => {
     mockChromeNavLinksHas.mockReturnValue(true); // all links exist
-    const linkProjectSettings: NavigationLink<SecurityPageName> = {
-      id: SecurityPageName.projectSettings,
-      title: 'Project settings',
-      links: [link2],
-    };
-    const testSecurityNavLinks$ = new BehaviorSubject([link1, linkProjectSettings]);
-
-    const projectNavLinks$ = createProjectNavLinks$(
-      testSecurityNavLinks$,
-      testServices,
-      mockCloudStart,
-      experimentalFeatures
-    );
+    const testSecurityNavLinks$ = new BehaviorSubject([link1]);
 
-    const value = await firstValueFrom(projectNavLinks$.pipe(take(1)));
-    const cloudLinks =
-      value
-        .find((link) => link.id === SecurityPageName.projectSettings)
-        ?.links?.filter((link) => isCloudLink(link.id)) ?? [];
+    const value = await createTestProjectNavLinks(testSecurityNavLinks$, {
+      filterCloudLinks: false,
+    });
+    const cloudLinks = value.filter(({ id }) => isCloudLink(id));
 
     expect(cloudLinks.length > 0).toBe(true);
     expect(cloudLinks.every((cloudLink) => cloudLink.externalUrl)).toBe(true);
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/links/nav_links.ts b/x-pack/plugins/security_solution_serverless/public/navigation/links/nav_links.ts
index 76f4e752af6c5..180d86142abb3 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/links/nav_links.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/links/nav_links.ts
@@ -10,26 +10,19 @@ import type { ChromeNavLinks, CoreStart } from '@kbn/core/public';
 import { SecurityPageName, type NavigationLink } from '@kbn/security-solution-navigation';
 import { isSecurityId } from '@kbn/security-solution-navigation/links';
 import type { CloudStart } from '@kbn/cloud-plugin/public';
-import { remove } from 'lodash';
 import { assetsNavLinks } from './sections/assets_links';
 import { mlNavCategories, mlNavLinks } from './sections/ml_links';
-import {
-  projectSettingsNavCategories,
-  projectSettingsNavLinks,
-} from './sections/project_settings_links';
+import { projectSettingsNavLinks } from './sections/project_settings_links';
 import { devToolsNavLink } from './sections/dev_tools_links';
 import { discoverNavLink } from './sections/discover_links';
 import type { ProjectNavigationLink } from './types';
 import { getCloudLinkKey, getCloudUrl, getNavLinkIdFromProjectPageName, isCloudLink } from './util';
 import { investigationsNavLinks } from './sections/investigations_links';
-import { ExternalPageName } from './constants';
-import type { ExperimentalFeatures } from '../../../common/experimental_features';
 
 export const createProjectNavLinks$ = (
   securityNavLinks$: Observable<Array<NavigationLink<SecurityPageName>>>,
   core: CoreStart,
-  cloud: CloudStart,
-  experimentalFeatures: ExperimentalFeatures
+  cloud: CloudStart
 ): Observable<ProjectNavigationLink[]> => {
   const { chrome } = core;
   return combineLatest([securityNavLinks$, chrome.navLinks.getNavLinks$()]).pipe(
@@ -38,9 +31,7 @@ export const createProjectNavLinks$ = (
       ([securityNavLinks, chromeNavLinks]) =>
         securityNavLinks.length === 0 || chromeNavLinks.length === 0 // skip if not initialized
     ),
-    map(([securityNavLinks]) =>
-      processNavLinks(securityNavLinks, chrome.navLinks, cloud, experimentalFeatures)
-    )
+    map(([securityNavLinks]) => processNavLinks(securityNavLinks, chrome.navLinks, cloud))
   );
 };
 
@@ -51,8 +42,7 @@ export const createProjectNavLinks$ = (
 const processNavLinks = (
   securityNavLinks: Array<NavigationLink<SecurityPageName>>,
   chromeNavLinks: ChromeNavLinks,
-  cloud: CloudStart,
-  experimentalFeatures: ExperimentalFeatures
+  cloud: CloudStart
 ): ProjectNavigationLink[] => {
   const projectNavLinks: ProjectNavigationLink[] = [...securityNavLinks];
 
@@ -91,27 +81,9 @@ const processNavLinks = (
     };
   }
 
-  // Project Settings, adding all external sub-links
-  const projectSettingsLinkIndex = projectNavLinks.findIndex(
-    ({ id }) => id === SecurityPageName.projectSettings
-  );
-  if (projectSettingsLinkIndex !== -1) {
-    const projectSettingsNavLink = projectNavLinks[projectSettingsLinkIndex];
-    projectNavLinks[projectSettingsLinkIndex] = {
-      ...projectSettingsNavLink,
-      categories: projectSettingsNavCategories,
-      links: [...projectSettingsNavLinks, ...(projectSettingsNavLink.links ?? [])],
-    };
-  }
-
   // Dev Tools. just pushing it
   projectNavLinks.push(devToolsNavLink);
-
-  if (experimentalFeatures.platformNavEnabled) {
-    remove(projectNavLinks, { id: SecurityPageName.landing });
-    remove(projectNavLinks, { id: ExternalPageName.devTools });
-    remove(projectNavLinks, { id: SecurityPageName.projectSettings });
-  }
+  projectNavLinks.push(...projectSettingsNavLinks);
 
   return processCloudLinks(filterDisabled(projectNavLinks, chromeNavLinks), cloud);
 };
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/dev_tools_links.ts b/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/dev_tools_links.ts
index 684304a665fcc..603440016c010 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/dev_tools_links.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/dev_tools_links.ts
@@ -12,4 +12,5 @@ import { DEV_TOOLS_TITLE } from './dev_tools_translations';
 export const devToolsNavLink: ProjectNavigationLink = {
   id: ExternalPageName.devTools,
   title: DEV_TOOLS_TITLE,
+  sideNavIcon: 'editorCodeBlock',
 };
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/dev_tools_translations.ts b/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/dev_tools_translations.ts
index 7a4e94a6cd053..898d3efb88829 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/dev_tools_translations.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/dev_tools_translations.ts
@@ -10,6 +10,6 @@ import { i18n } from '@kbn/i18n';
 export const DEV_TOOLS_TITLE = i18n.translate(
   'xpack.securitySolutionServerless.navLinks.devTools.title',
   {
-    defaultMessage: 'Dev tools',
+    defaultMessage: 'Developer tools',
   }
 );
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/project_settings_links.ts b/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/project_settings_links.ts
index 69e560a929c09..b5c4d746c2af1 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/project_settings_links.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/project_settings_links.ts
@@ -5,194 +5,48 @@
  * 2.0.
  */
 
-import { LinkCategoryType, SecurityPageName } from '@kbn/security-solution-navigation';
-import { SERVER_APP_ID } from '@kbn/security-solution-plugin/common';
 import type { LinkItem } from '@kbn/security-solution-plugin/public';
-import { ExternalPageName, SecurityPagePath } from '../constants';
-import type { ProjectLinkCategory, ProjectNavigationLink } from '../types';
-import {
-  IconMapServicesLazy,
-  IconIndexManagementLazy,
-  IconUsersRolesLazy,
-  IconReportingLazy,
-  IconVisualizationLazy,
-} from '../../../common/lazy_icons';
+import { SecurityPageName } from '@kbn/security-solution-navigation';
+import { ExternalPageName } from '../constants';
+import type { ProjectNavigationLink } from '../types';
 import * as i18n from './project_settings_translations';
 
-// appLinks configures the Security Solution pages links
-const projectSettingsAppLink: LinkItem = {
-  id: SecurityPageName.projectSettings,
-  title: i18n.PROJECT_SETTINGS_TITLE,
-  path: SecurityPagePath[SecurityPageName.projectSettings],
-  capabilities: [`${SERVER_APP_ID}.show`],
-  hideTimeline: true,
-  skipUrlState: true,
-  links: [], // endpoints and cloudDefend links are added in createAssetsLinkFromManage
-};
-
-export const createProjectSettingsLinkFromManage = (manageLink: LinkItem): LinkItem => {
-  const projectSettingsSubLinks = [];
-
+export const createProjectSettingsLinksFromManage = (manageLink: LinkItem): LinkItem[] => {
   const entityAnalyticsLink = manageLink.links?.find(
     ({ id }) => id === SecurityPageName.entityAnalyticsManagement
   );
-  if (entityAnalyticsLink) {
-    projectSettingsSubLinks.push(entityAnalyticsLink);
-  }
-
-  return {
-    ...projectSettingsAppLink,
-    links: projectSettingsSubLinks,
-  };
+  return entityAnalyticsLink ? [{ ...entityAnalyticsLink, sideNavDisabled: true }] : [];
 };
 
-export const projectSettingsNavCategories: ProjectLinkCategory[] = [
-  {
-    type: LinkCategoryType.separator,
-    linkIds: [
-      ExternalPageName.cloudUsersAndRoles,
-      ExternalPageName.cloudBilling,
-      SecurityPageName.entityAnalyticsManagement,
-    ],
-  },
+export const projectSettingsNavLinks: ProjectNavigationLink[] = [
   {
-    type: LinkCategoryType.separator,
-    linkIds: [
-      ExternalPageName.integrationsSecurity,
-      ExternalPageName.maps,
-      ExternalPageName.visualize,
-    ],
+    id: ExternalPageName.management,
+    title: i18n.MANAGEMENT_TITLE,
   },
   {
-    type: LinkCategoryType.accordion,
-    label: i18n.MANAGEMENT_CATEGORY_TITLE,
-    categories: [
-      {
-        label: i18n.DATA_CATEGORY_TITLE,
-        linkIds: [
-          ExternalPageName.managementIndexManagement,
-          ExternalPageName.managementTransforms,
-          ExternalPageName.managementIngestPipelines,
-          ExternalPageName.managementDataViews,
-          ExternalPageName.managementJobsListLink,
-          ExternalPageName.managementPipelines,
-        ],
-      },
-      {
-        label: i18n.ALERTS_INSIGHTS_CATEGORY_TITLE,
-        linkIds: [
-          ExternalPageName.managementCases,
-          ExternalPageName.managementTriggersActionsConnectors,
-          ExternalPageName.managementMaintenanceWindows,
-        ],
-      },
-      {
-        label: i18n.CONTENT_CATEGORY_TITLE,
-        linkIds: [
-          ExternalPageName.managementObjects,
-          ExternalPageName.managementFiles,
-          ExternalPageName.managementReporting,
-          ExternalPageName.managementTags,
-        ],
-      },
-      {
-        label: i18n.OTHER_CATEGORY_TITLE,
-        linkIds: [ExternalPageName.managementApiKeys, ExternalPageName.managementSettings],
-      },
-    ],
+    id: ExternalPageName.integrationsSecurity,
+    title: i18n.INTEGRATIONS_TITLE,
   },
-];
-
-// navLinks define the navigation links for the Security Solution pages and External pages as well
-export const projectSettingsNavLinks: ProjectNavigationLink[] = [
   {
     id: ExternalPageName.cloudUsersAndRoles,
     title: i18n.CLOUD_USERS_ROLES_TITLE,
-    description: i18n.CLOUD_USERS_ROLES_DESCRIPTION,
-    landingIcon: IconUsersRolesLazy,
   },
   {
-    id: ExternalPageName.cloudBilling,
-    title: i18n.CLOUD_BILLING_TITLE,
-    description: i18n.CLOUD_BILLING_DESCRIPTION,
-    landingIcon: IconReportingLazy,
+    id: ExternalPageName.cloudPerformance,
+    title: i18n.CLOUD_PERFORMANCE_TITLE,
   },
   {
-    id: ExternalPageName.integrationsSecurity,
-    title: i18n.INTEGRATIONS_TITLE,
-    description: i18n.INTEGRATIONS_DESCRIPTION,
-    landingIcon: IconIndexManagementLazy,
+    id: ExternalPageName.cloudBilling,
+    title: i18n.CLOUD_BILLING_TITLE,
   },
   {
     id: ExternalPageName.maps,
-    title: i18n.MAPS_TITLE,
-    description: i18n.MAPS_DESCRIPTION,
-    landingIcon: IconMapServicesLazy,
+    title: i18n.CLOUD_MAPS_TITLE,
+    disabled: true, // the link will be available in the navigationTree (breadcrumbs) but not appear in the sideNav
   },
   {
     id: ExternalPageName.visualize,
-    title: i18n.VISUALIZE_TITLE,
-    description: i18n.VISUALIZE_DESCRIPTION,
-    landingIcon: IconVisualizationLazy,
-  },
-  {
-    id: ExternalPageName.managementIndexManagement,
-    title: i18n.MANAGEMENT_INDEX_MANAGEMENT_TITLE,
-  },
-  {
-    id: ExternalPageName.managementTransforms,
-    title: i18n.MANAGEMENT_TRANSFORMS_TITLE,
-  },
-  {
-    id: ExternalPageName.managementMaintenanceWindows,
-    title: i18n.MANAGEMENT_MAINTENANCE_WINDOWS_TITLE,
-  },
-  {
-    id: ExternalPageName.managementIngestPipelines,
-    title: i18n.MANAGEMENT_INGEST_PIPELINES_TITLE,
-  },
-  {
-    id: ExternalPageName.managementDataViews,
-    title: i18n.MANAGEMENT_DATA_VIEWS_TITLE,
-  },
-  {
-    id: ExternalPageName.managementJobsListLink,
-    title: i18n.MANAGEMENT_ML_TITLE,
-  },
-  {
-    id: ExternalPageName.managementPipelines,
-    title: i18n.MANAGEMENT_LOGSTASH_PIPELINES_TITLE,
-  },
-  {
-    id: ExternalPageName.managementCases,
-    title: i18n.MANAGEMENT_CASES_TITLE,
-  },
-  {
-    id: ExternalPageName.managementTriggersActionsConnectors,
-    title: i18n.MANAGEMENT_CONNECTORS_TITLE,
-  },
-  {
-    id: ExternalPageName.managementReporting,
-    title: i18n.MANAGEMENT_REPORTING_TITLE,
-  },
-  {
-    id: ExternalPageName.managementObjects,
-    title: i18n.MANAGEMENT_SAVED_OBJECTS_TITLE,
-  },
-  {
-    id: ExternalPageName.managementApiKeys,
-    title: i18n.MANAGEMENT_API_KEYS_TITLE,
-  },
-  {
-    id: ExternalPageName.managementTags,
-    title: i18n.MANAGEMENT_TAGS_TITLE,
-  },
-  {
-    id: ExternalPageName.managementFiles,
-    title: i18n.MANAGEMENT_FILES_TITLE,
-  },
-  {
-    id: ExternalPageName.managementSettings,
-    title: i18n.MANAGEMENT_SETTINGS_TITLE,
+    title: i18n.CLOUD_VISUALIZE_TITLE,
+    disabled: true, // the link will be available in the navigationTree (breadcrumbs) but not appear in the sideNav
   },
 ];
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/project_settings_translations.ts b/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/project_settings_translations.ts
index 56ef414457dfa..50b8086bfb0d9 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/project_settings_translations.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/links/sections/project_settings_translations.ts
@@ -7,195 +7,46 @@
 
 import { i18n } from '@kbn/i18n';
 
-export const PROJECT_SETTINGS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.title',
+export const MANAGEMENT_TITLE = i18n.translate(
+  'xpack.securitySolutionServerless.navLinks.management.title',
   {
-    defaultMessage: 'Project settings',
+    defaultMessage: 'Management',
   }
 );
-
 export const INTEGRATIONS_TITLE = i18n.translate(
   'xpack.securitySolutionServerless.navLinks.projectSettings.integrations.title',
   {
     defaultMessage: 'Integrations',
   }
 );
-export const INTEGRATIONS_DESCRIPTION = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.integrations.description',
-  {
-    defaultMessage: 'Security integrations',
-  }
-);
-
 export const CLOUD_USERS_ROLES_TITLE = i18n.translate(
   'xpack.securitySolutionServerless.navLinks.projectSettings.usersAndRoles.title',
   {
-    defaultMessage: 'Users & roles',
+    defaultMessage: 'Users and roles',
   }
 );
-export const CLOUD_USERS_ROLES_DESCRIPTION = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.usersAndRoles.description',
+export const CLOUD_PERFORMANCE_TITLE = i18n.translate(
+  'xpack.securitySolutionServerless.navLinks.projectSettings.performance.title',
   {
-    defaultMessage: 'Users and roles management',
+    defaultMessage: 'Performance',
   }
 );
-
 export const CLOUD_BILLING_TITLE = i18n.translate(
   'xpack.securitySolutionServerless.navLinks.projectSettings.billing.title',
   {
-    defaultMessage: 'Billing & consumptions',
-  }
-);
-export const CLOUD_BILLING_DESCRIPTION = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.billing.description',
-  {
-    defaultMessage: 'Billing & consumption page',
+    defaultMessage: 'Billing and subscription',
   }
 );
 
-export const MANAGEMENT_INDEX_MANAGEMENT_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.indexManagement.title',
-  {
-    defaultMessage: 'Index management',
-  }
-);
-export const MANAGEMENT_TRANSFORMS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.transforms.title',
-  {
-    defaultMessage: 'Transforms',
-  }
-);
-export const MANAGEMENT_INGEST_PIPELINES_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.ingestPipelines.title',
-  {
-    defaultMessage: 'Ingest pipelines',
-  }
-);
-export const MANAGEMENT_DATA_VIEWS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.dataViews.title',
-  {
-    defaultMessage: 'Data views',
-  }
-);
-export const MANAGEMENT_ML_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.ml.title',
-  {
-    defaultMessage: 'Machine learning',
-  }
-);
-export const MANAGEMENT_LOGSTASH_PIPELINES_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.logstashPipelines.title',
-  {
-    defaultMessage: 'Logstash pipelines',
-  }
-);
-export const MANAGEMENT_CASES_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.cases.title',
-  {
-    defaultMessage: 'Cases',
-  }
-);
-export const MANAGEMENT_CONNECTORS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.connectors.title',
-  {
-    defaultMessage: 'Connectors',
-  }
-);
-export const MANAGEMENT_SAVED_OBJECTS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.savedObjects.title',
-  {
-    defaultMessage: 'Saved objects',
-  }
-);
-export const MANAGEMENT_TAGS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.tags.title',
-  {
-    defaultMessage: 'Tags',
-  }
-);
-export const MANAGEMENT_SETTINGS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.settings.title',
-  {
-    defaultMessage: 'Advanced settings',
-  }
-);
-export const MANAGEMENT_MAINTENANCE_WINDOWS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.maintenanceWindows.title',
-  {
-    defaultMessage: 'Maintenance windows',
-  }
-);
-export const MANAGEMENT_REPORTING_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.reporting.title',
-  {
-    defaultMessage: 'Reporting',
-  }
-);
-export const MANAGEMENT_API_KEYS_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.apiKeys.title',
-  {
-    defaultMessage: 'Api keys',
-  }
-);
-export const MANAGEMENT_FILES_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.management.files.title',
-  {
-    defaultMessage: 'Files',
-  }
-);
-
-export const MANAGEMENT_CATEGORY_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.category.management',
-  {
-    defaultMessage: 'MANAGEMENT',
-  }
-);
-export const DATA_CATEGORY_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.subCategory.data',
-  {
-    defaultMessage: 'DATA',
-  }
-);
-export const ALERTS_INSIGHTS_CATEGORY_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.subCategory.alertsAndInsights',
-  {
-    defaultMessage: 'ALERTS AND INSIGHTS',
-  }
-);
-export const CONTENT_CATEGORY_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.subCategory.content',
-  {
-    defaultMessage: 'CONTENT',
-  }
-);
-export const OTHER_CATEGORY_TITLE = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.subCategory.other',
-  {
-    defaultMessage: 'OTHER',
-  }
-);
-export const MAPS_TITLE = i18n.translate(
+export const CLOUD_MAPS_TITLE = i18n.translate(
   'xpack.securitySolutionServerless.navLinks.projectSettings.maps.title',
   {
     defaultMessage: 'Maps',
   }
 );
-export const MAPS_DESCRIPTION = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.maps.description',
-  {
-    defaultMessage: 'Plot geographic data',
-  }
-);
-export const VISUALIZE_TITLE = i18n.translate(
+export const CLOUD_VISUALIZE_TITLE = i18n.translate(
   'xpack.securitySolutionServerless.navLinks.projectSettings.visualize.title',
   {
     defaultMessage: 'Visualize library',
   }
 );
-
-export const VISUALIZE_DESCRIPTION = i18n.translate(
-  'xpack.securitySolutionServerless.navLinks.projectSettings.visualize.description',
-  {
-    defaultMessage: 'Visualize library page',
-  }
-);
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/navigation_tree/navigation_tree.ts b/x-pack/plugins/security_solution_serverless/public/navigation/navigation_tree/navigation_tree.ts
index 0db77598e7032..926e54ad8bb33 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/navigation_tree/navigation_tree.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/navigation_tree/navigation_tree.ts
@@ -7,7 +7,6 @@
 import { i18n } from '@kbn/i18n';
 import type { NavigationTreeDefinition } from '@kbn/shared-ux-chrome-navigation';
 import type { AppDeepLinkId, NodeDefinition } from '@kbn/core-chrome-browser';
-import type { NonEmptyArray } from '@kbn/shared-ux-chrome-navigation/src/ui/types';
 import type { LinkCategory } from '@kbn/security-solution-navigation';
 import {
   SecurityPageName,
@@ -37,72 +36,83 @@ const PROJECT_SETTINGS_TITLE = i18n.translate(
 export const formatNavigationTree = (
   projectNavLinks: ProjectNavigationLink[],
   categories?: Readonly<Array<LinkCategory<ProjectPageName>>>
-): NavigationTreeDefinition => ({
-  body: [
-    {
-      type: 'navGroup',
-      id: 'security_project_nav',
-      title: SECURITY_TITLE,
-      icon: 'logoSecurity',
-      breadcrumbStatus: 'hidden',
-      defaultIsCollapsed: false,
-      children: formatNodesFromLinks(projectNavLinks, categories),
-    },
-  ],
-  footer: [
-    {
-      type: 'navGroup',
-      id: 'getStarted',
-      title: GET_STARTED_TITLE,
-      link: getNavLinkIdFromProjectPageName(SecurityPageName.landing) as AppDeepLinkId,
-      icon: 'launch',
-    },
-    {
-      type: 'navGroup',
-      id: 'devTools',
-      title: DEV_TOOLS_TITLE,
-      link: 'dev_tools',
-      icon: 'editorCodeBlock',
-    },
-    {
-      type: 'navGroup',
-      id: 'project_settings_project_nav',
-      title: PROJECT_SETTINGS_TITLE,
-      icon: 'gear',
-      breadcrumbStatus: 'hidden',
-      children: [
-        {
-          id: 'settings',
-          children: [
-            {
-              link: 'management',
-              title: 'Management',
-            },
-            {
-              link: 'integrations',
-            },
-            {
-              link: 'fleet',
-            },
-            {
-              id: 'cloudLinkUserAndRoles',
-              cloudLink: 'userAndRoles',
-            },
-            {
-              id: 'cloudLinkBilling',
-              cloudLink: 'billingAndSub',
-            },
-          ],
-        },
-      ],
-    },
-  ],
-});
+): NavigationTreeDefinition => {
+  const children = formatNodesFromLinks(projectNavLinks, categories);
+  return {
+    body: [
+      children
+        ? {
+            type: 'navGroup',
+            id: 'security_project_nav',
+            title: SECURITY_TITLE,
+            icon: 'logoSecurity',
+            breadcrumbStatus: 'hidden',
+            defaultIsCollapsed: false,
+            children,
+          }
+        : {
+            type: 'navItem',
+            id: 'security_project_nav',
+            title: SECURITY_TITLE,
+            icon: 'logoSecurity',
+            breadcrumbStatus: 'hidden',
+          },
+    ],
+    footer: [
+      {
+        type: 'navItem',
+        id: 'getStarted',
+        title: GET_STARTED_TITLE,
+        link: getNavLinkIdFromProjectPageName(SecurityPageName.landing) as AppDeepLinkId,
+        icon: 'launch',
+      },
+      {
+        type: 'navItem',
+        id: 'devTools',
+        title: DEV_TOOLS_TITLE,
+        link: 'dev_tools',
+        icon: 'editorCodeBlock',
+      },
+      {
+        type: 'navGroup',
+        id: 'project_settings_project_nav',
+        title: PROJECT_SETTINGS_TITLE,
+        icon: 'gear',
+        breadcrumbStatus: 'hidden',
+        children: [
+          {
+            id: 'settings',
+            children: [
+              {
+                link: 'management',
+                title: 'Management',
+              },
+              {
+                link: 'integrations',
+              },
+              {
+                link: 'fleet',
+              },
+              {
+                id: 'cloudLinkUserAndRoles',
+                cloudLink: 'userAndRoles',
+              },
+              {
+                id: 'cloudLinkBilling',
+                cloudLink: 'billingAndSub',
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  };
+};
 
 const formatNodesFromLinks = (
   projectNavLinks: ProjectNavigationLink[],
   parentCategories?: Readonly<Array<LinkCategory<ProjectPageName>>>
-): NonEmptyArray<NodeDefinition> | undefined => {
+): NodeDefinition[] | undefined => {
   if (projectNavLinks.length === 0) {
     return undefined;
   }
@@ -117,7 +127,7 @@ const formatNodesFromLinks = (
   if (nodes.length === 0) {
     return undefined;
   }
-  return nodes as NonEmptyArray<NodeDefinition>;
+  return nodes as NodeDefinition[];
 };
 
 const formatNodesFromLinksWithCategory = (
@@ -142,7 +152,7 @@ const formatNodesFromLinksWithCategory = (
       {
         id: `category-${category.label.toLowerCase().replace(' ', '_')}`,
         title: category.label,
-        children: children as NonEmptyArray<NodeDefinition>,
+        children: children as NodeDefinition[],
       },
     ];
   } else if (isSeparatorLinkCategory(category)) {
@@ -165,7 +175,7 @@ const formatNodesFromLinksWithCategory = (
 const formatNodesFromLinksWithoutCategory = (projectNavLinks: ProjectNavigationLink[]) =>
   projectNavLinks.map((projectNavLink) =>
     createNodeFromProjectNavLink(projectNavLink)
-  ) as NonEmptyArray<NodeDefinition>;
+  ) as NodeDefinition[];
 
 const createNodeFromProjectNavLink = (projectNavLink: ProjectNavigationLink): NodeDefinition => {
   const { id, title, links, categories } = projectNavLink;
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/navigation_tree/utils.ts b/x-pack/plugins/security_solution_serverless/public/navigation/navigation_tree/utils.ts
index 3a908b9913060..7e682a40856e8 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/navigation_tree/utils.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/navigation_tree/utils.ts
@@ -6,6 +6,7 @@
  */
 
 import { SecurityPageName } from '@kbn/security-solution-navigation';
+import { ExternalPageName } from '../links/constants';
 import type { ProjectPageName } from '../links/types';
 
 // We need to hide breadcrumbs for some pages (tabs) because they appear duplicated.
@@ -31,4 +32,5 @@ const HIDDEN_BREADCRUMBS = new Set<ProjectPageName>([
 
 export const isBreadcrumbHidden = (id: ProjectPageName): boolean =>
   HIDDEN_BREADCRUMBS.has(id) ||
-  id.startsWith('management:'); /* management sub-pages set their breadcrumbs themselves */
+  /* management sub-pages set their breadcrumbs themselves, the main Management breadcrumb is configured with our navigationTree definition */
+  (id.startsWith(ExternalPageName.management) && id !== ExternalPageName.management);
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation.test.tsx b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation.test.tsx
index 532ca9b985d51..c22fce30419de 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation.test.tsx
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation.test.tsx
@@ -26,17 +26,27 @@ jest.mock('@kbn/security-solution-side-nav', () => ({
   SolutionSideNav: (props: unknown) => mockSolutionSideNav(props),
 }));
 
+const mockSideNavigationFooter = jest.fn((_props: unknown) => (
+  <div data-test-subj="solutionSideNavFooter" />
+));
+jest.mock('./side_navigation_footer', () => ({
+  ...jest.requireActual('./side_navigation_footer'),
+  SideNavigationFooter: (props: unknown) => mockSideNavigationFooter(props),
+}));
+
 const sideNavItems = [
   {
     id: SecurityPageName.dashboards,
     label: 'Dashboards',
     href: '/dashboards',
+    position: 'top',
     onClick: jest.fn(),
   },
   {
     id: SecurityPageName.alerts,
     label: 'Alerts',
     href: '/alerts',
+    position: 'top',
     onClick: jest.fn(),
   },
   {
@@ -76,17 +86,37 @@ describe('SecuritySideNavigation', () => {
     expect(component.queryByTestId('solutionSideNav')).toBeInTheDocument();
   });
 
-  it('should pass item props to the SolutionSideNav component', () => {
+  it('should render the SideNav footer when items received', () => {
+    const component = render(<SecuritySideNavigation activeNodes={[]} />, {
+      wrapper: I18nProvider,
+    });
+    expect(component.queryByTestId('solutionSideNavFooter')).toBeInTheDocument();
+  });
+
+  it('should pass only top items to the SolutionSideNav component', () => {
     render(<SecuritySideNavigation activeNodes={[]} />, { wrapper: I18nProvider });
 
     expect(mockSolutionSideNav).toHaveBeenCalledWith(
       expect.objectContaining({
-        items: sideNavItems,
+        items: [
+          expect.objectContaining({ id: SecurityPageName.dashboards }),
+          expect.objectContaining({ id: SecurityPageName.alerts }),
+        ],
+      })
+    );
+  });
+
+  it('should pass only bottom items to the SideNavigationFooter component', () => {
+    render(<SecuritySideNavigation activeNodes={[]} />, { wrapper: I18nProvider });
+
+    expect(mockSideNavigationFooter).toHaveBeenCalledWith(
+      expect.objectContaining({
+        items: [expect.objectContaining({ id: SecurityPageName.administration })],
       })
     );
   });
 
-  it('should have empty selectedId the SolutionSideNav component', () => {
+  it('should set empty selectedId', () => {
     render(<SecuritySideNavigation activeNodes={[]} />, { wrapper: I18nProvider });
 
     expect(mockSolutionSideNav).toHaveBeenCalledWith(
@@ -94,9 +124,14 @@ describe('SecuritySideNavigation', () => {
         selectedId: '',
       })
     );
+    expect(mockSideNavigationFooter).toHaveBeenCalledWith(
+      expect.objectContaining({
+        activeNodeId: '',
+      })
+    );
   });
 
-  it('should have root external selectedId the SolutionSideNav component', () => {
+  it('should set root external selectedId', () => {
     const activeNodes = [[{ id: 'dev_tools' }]] as ChromeProjectNavigationNode[][];
     render(<SecuritySideNavigation activeNodes={activeNodes} />, { wrapper: I18nProvider });
 
@@ -105,9 +140,14 @@ describe('SecuritySideNavigation', () => {
         selectedId: ExternalPageName.devTools,
       })
     );
+    expect(mockSideNavigationFooter).toHaveBeenCalledWith(
+      expect.objectContaining({
+        activeNodeId: 'dev_tools',
+      })
+    );
   });
 
-  it('should have external page selectedId the SolutionSideNav component', () => {
+  it('should set external page selectedId', () => {
     const activeNodes = [[{ id: `ml:overview` }]] as ChromeProjectNavigationNode[][];
     render(<SecuritySideNavigation activeNodes={activeNodes} />, { wrapper: I18nProvider });
 
@@ -116,9 +156,14 @@ describe('SecuritySideNavigation', () => {
         selectedId: ExternalPageName.mlOverview,
       })
     );
+    expect(mockSideNavigationFooter).toHaveBeenCalledWith(
+      expect.objectContaining({
+        activeNodeId: 'ml:overview',
+      })
+    );
   });
 
-  it('should internal selectedId the SolutionSideNav component', () => {
+  it('should set internal selectedId', () => {
     const activeNodes = [
       [{ id: `${APP_UI_ID}:${SecurityPageName.alerts}` }],
     ] as ChromeProjectNavigationNode[][];
@@ -129,5 +174,10 @@ describe('SecuritySideNavigation', () => {
         selectedId: SecurityPageName.alerts,
       })
     );
+    expect(mockSideNavigationFooter).toHaveBeenCalledWith(
+      expect.objectContaining({
+        activeNodeId: 'securitySolutionUI:alerts',
+      })
+    );
   });
 });
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation.tsx b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation.tsx
index 43b02ab94824d..d56e98eef3c2d 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation.tsx
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation.tsx
@@ -6,25 +6,51 @@
  */
 
 import React, { useMemo } from 'react';
-import { EuiLoadingSpinner, useEuiTheme } from '@elastic/eui';
+import type { EuiCollapsibleNavItemProps } from '@elastic/eui';
+import {
+  EuiCollapsibleNavBeta,
+  EuiCollapsibleNavItem,
+  EuiLoadingSpinner,
+  useEuiTheme,
+} from '@elastic/eui';
 import type { SideNavComponent } from '@kbn/core-chrome-browser';
-import { SolutionNav } from '@kbn/shared-ux-page-solution-nav';
-import { SolutionSideNav } from '@kbn/security-solution-side-nav';
+import type { SolutionSideNavItem } from '@kbn/security-solution-side-nav';
+import { SolutionSideNav, SolutionSideNavItemPosition } from '@kbn/security-solution-side-nav';
 import { useObservable } from 'react-use';
+import { css } from '@emotion/react';
+import { partition } from 'lodash/fp';
 import { useSideNavItems } from './use_side_nav_items';
 import { CATEGORIES } from './categories';
 import { getProjectPageNameFromNavLinkId } from '../links/util';
 import { useKibana } from '../../common/services';
+import { SideNavigationFooter } from './side_navigation_footer';
+
+const getEuiNavItemFromSideNavItem = (sideNavItem: SolutionSideNavItem, selectedId: string) => ({
+  id: sideNavItem.id,
+  title: sideNavItem.label,
+  isSelected: sideNavItem.id === selectedId,
+  href: sideNavItem.href,
+  onClick: sideNavItem.onClick,
+});
 
 export const SecuritySideNavigation: SideNavComponent = React.memo(function SecuritySideNavigation({
   activeNodes: [activeChromeNodes],
 }) {
-  const { hasHeaderBanner$ } = useKibana().services.chrome;
+  const { chrome } = useKibana().services;
   const { euiTheme } = useEuiTheme();
+  const hasHeaderBanner = useObservable(chrome.hasHeaderBanner$());
+
+  /**
+   * TODO: Uncomment this when we have the getIsSideNavCollapsed API available
+   * const isCollapsed = useObservable(chrome.getIsSideNavCollapsed$());
+   */
+  const isCollapsed = false;
+
   const items = useSideNavItems();
-  const hasHeaderBanner = useObservable(hasHeaderBanner$());
 
   const isLoading = items.length === 0;
+  // we only care about the first node to highlight a left nav main item
+  const activeNodeId = activeChromeNodes?.[0].id ?? '';
 
   const panelTopOffset = useMemo(
     () =>
@@ -34,30 +60,56 @@ export const SecuritySideNavigation: SideNavComponent = React.memo(function Secu
     [hasHeaderBanner, euiTheme]
   );
 
-  const selectedId = useMemo(() => {
-    const mainNode = activeChromeNodes?.[0]; // we only care about the first node to highlight a left nav main item
-    return mainNode ? getProjectPageNameFromNavLinkId(mainNode.id) : '';
-  }, [activeChromeNodes]);
+  const selectedId = useMemo(
+    () => (activeNodeId ? getProjectPageNameFromNavLinkId(activeNodeId) : ''),
+    [activeNodeId]
+  );
+
+  const bodyStyle = css`
+    padding-left: calc(${euiTheme.size.xl} + ${euiTheme.size.s});
+    padding-right: ${euiTheme.size.s};
+  `;
+
+  const collapsedNavItems = useMemo(() => {
+    return CATEGORIES.reduce<EuiCollapsibleNavItemProps[]>((links, category) => {
+      const categoryLinks = items.filter((item) => category.linkIds.includes(item.id));
+      links.push(...categoryLinks.map((link) => getEuiNavItemFromSideNavItem(link, selectedId)));
+      return links;
+    }, []);
+  }, [items, selectedId]);
+
+  const [bodyItems, footerItems] = useMemo(
+    () => partition((item) => item.position === SolutionSideNavItemPosition.top, items),
+    [items]
+  );
 
   return isLoading ? (
     <EuiLoadingSpinner size="m" data-test-subj="sideNavLoader" />
   ) : (
-    <SolutionNav
-      canBeCollapsed={false}
-      name={'Security'}
-      icon={'logoSecurity'}
-      closeFlyoutButtonPosition={'inside'}
-      headingProps={{
-        'data-test-subj': 'securitySolutionNavHeading',
-      }}
-    >
-      <SolutionSideNav
-        items={items}
-        categories={CATEGORIES}
-        selectedId={selectedId}
-        panelTopOffset={panelTopOffset}
-      />
-    </SolutionNav>
+    <>
+      <EuiCollapsibleNavBeta.Body>
+        <EuiCollapsibleNavItem
+          title="Security"
+          icon="logoSecurity"
+          iconProps={{ size: 'm' }}
+          data-test-subj="securitySolutionNavHeading"
+          items={isCollapsed ? collapsedNavItems : undefined}
+        />
+        {!isCollapsed && (
+          <div css={bodyStyle}>
+            <SolutionSideNav
+              items={bodyItems}
+              categories={CATEGORIES}
+              selectedId={selectedId}
+              panelTopOffset={panelTopOffset}
+            />
+          </div>
+        )}
+      </EuiCollapsibleNavBeta.Body>
+      <EuiCollapsibleNavBeta.Footer>
+        <SideNavigationFooter activeNodeId={activeNodeId} items={footerItems} />
+      </EuiCollapsibleNavBeta.Footer>
+    </>
   );
 });
 
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation_footer.test.tsx b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation_footer.test.tsx
new file mode 100644
index 0000000000000..02e4979c1fba2
--- /dev/null
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation_footer.test.tsx
@@ -0,0 +1,125 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render } from '@testing-library/react';
+import { SecurityPageName } from '@kbn/security-solution-navigation';
+import { SideNavigationFooter } from './side_navigation_footer';
+import { ExternalPageName } from '../links/constants';
+import { I18nProvider } from '@kbn/i18n-react';
+import type { ProjectSideNavItem } from './types';
+
+jest.mock('../../common/services');
+
+const items: ProjectSideNavItem[] = [
+  {
+    id: SecurityPageName.landing,
+    label: 'Get Started',
+    href: '/landing',
+  },
+  {
+    id: ExternalPageName.devTools,
+    label: 'Developer tools',
+    href: '/dev_tools',
+  },
+  {
+    id: ExternalPageName.management,
+    label: 'Management',
+    href: '/management',
+  },
+  {
+    id: ExternalPageName.integrationsSecurity,
+    label: 'Integrations',
+    href: '/integrations',
+  },
+  {
+    id: ExternalPageName.cloudUsersAndRoles,
+    label: 'Users and roles',
+    href: '/cloud/users_and_roles',
+  },
+  {
+    id: ExternalPageName.cloudBilling,
+    label: 'Billing and subscription',
+    href: '/cloud/billing',
+  },
+];
+
+describe('SideNavigationFooter', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should render all the items', () => {
+    const component = render(<SideNavigationFooter items={items} activeNodeId={''} />, {
+      wrapper: I18nProvider,
+    });
+
+    items.forEach((item) => {
+      expect(component.queryByTestId(`solutionSideNavItemLink-${item.id}`)).toBeInTheDocument();
+    });
+  });
+
+  it('should highlight the active node', () => {
+    const component = render(<SideNavigationFooter items={items} activeNodeId={'dev_tools'} />, {
+      wrapper: I18nProvider,
+    });
+
+    items.forEach((item) => {
+      const isSelected = component
+        .queryByTestId(`solutionSideNavItemLink-${item.id}`)
+        ?.className.includes('isSelected');
+
+      if (item.id === ExternalPageName.devTools) {
+        expect(isSelected).toBe(true);
+      } else {
+        expect(isSelected).toBe(false);
+      }
+    });
+  });
+
+  it('should highlight the active node inside the collapsible', () => {
+    const component = render(<SideNavigationFooter items={items} activeNodeId={'management'} />, {
+      wrapper: I18nProvider,
+    });
+
+    items.forEach((item) => {
+      const isSelected = component
+        .queryByTestId(`solutionSideNavItemLink-${item.id}`)
+        ?.className.includes('isSelected');
+
+      if (item.id === ExternalPageName.management) {
+        expect(isSelected).toBe(true);
+      } else {
+        expect(isSelected).toBe(false);
+      }
+    });
+  });
+
+  it('should render closed collapsible if it has no active node', () => {
+    const component = render(<SideNavigationFooter items={items} activeNodeId={''} />, {
+      wrapper: I18nProvider,
+    });
+
+    const isOpen = component
+      .queryByTestId('navFooterCollapsible-project-settings')
+      ?.className.includes('euiAccordion-isOpen');
+
+    expect(isOpen).toBe(false);
+  });
+
+  it('should open collapsible if it has an active node', () => {
+    const component = render(<SideNavigationFooter items={items} activeNodeId={'management'} />, {
+      wrapper: I18nProvider,
+    });
+
+    const isOpen = component
+      .queryByTestId('navFooterCollapsible-project-settings')
+      ?.className.includes('euiAccordion-isOpen');
+
+    expect(isOpen).toBe(true);
+  });
+});
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation_footer.tsx b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation_footer.tsx
new file mode 100644
index 0000000000000..2c8cf2369c50b
--- /dev/null
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/side_navigation_footer.tsx
@@ -0,0 +1,153 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useEffect, useMemo, useState } from 'react';
+import type { EuiCollapsibleNavSubItemProps, IconType } from '@elastic/eui';
+import { EuiCollapsibleNavItem } from '@elastic/eui';
+import { SecurityPageName } from '@kbn/security-solution-navigation';
+import { ExternalPageName } from '../links/constants';
+import { getNavLinkIdFromProjectPageName } from '../links/util';
+import type { ProjectSideNavItem } from './types';
+
+interface FooterCategory {
+  type: 'standalone' | 'collapsible';
+  title?: string;
+  icon?: IconType;
+  linkIds: string[];
+}
+
+const categories: FooterCategory[] = [
+  { type: 'standalone', linkIds: [SecurityPageName.landing, ExternalPageName.devTools] },
+  {
+    type: 'collapsible',
+    title: 'Project Settings',
+    icon: 'gear',
+    linkIds: [
+      ExternalPageName.management,
+      ExternalPageName.integrationsSecurity,
+      ExternalPageName.cloudUsersAndRoles,
+      ExternalPageName.cloudPerformance,
+      ExternalPageName.cloudBilling,
+    ],
+  },
+];
+
+export const SideNavigationFooter: React.FC<{
+  activeNodeId: string;
+  items: ProjectSideNavItem[];
+}> = ({ activeNodeId, items }) => {
+  return (
+    <>
+      {categories.map((category, index) => {
+        const categoryItems = category.linkIds.reduce<ProjectSideNavItem[]>((acc, linkId) => {
+          const item = items.find(({ id }) => id === linkId);
+          if (item) {
+            acc.push(item);
+          }
+          return acc;
+        }, []);
+
+        if (category.type === 'standalone') {
+          return (
+            <SideNavigationFooterStandalone
+              key={index}
+              items={categoryItems}
+              activeNodeId={activeNodeId}
+            />
+          );
+        }
+        if (category.type === 'collapsible') {
+          return (
+            <SideNavigationFooterCollapsible
+              key={index}
+              title={category.title ?? ''}
+              items={categoryItems}
+              activeNodeId={activeNodeId}
+              icon={category.icon}
+            />
+          );
+        }
+        return null;
+      })}
+    </>
+  );
+};
+
+const SideNavigationFooterStandalone: React.FC<{
+  items: ProjectSideNavItem[];
+  activeNodeId: string;
+}> = ({ items, activeNodeId }) => (
+  <>
+    {items.map((item) => (
+      <EuiCollapsibleNavItem
+        key={item.id}
+        id={item.id}
+        title={item.label}
+        icon={item.iconType}
+        iconProps={{ size: 'm' }}
+        data-test-subj={`solutionSideNavItemLink-${item.id}`}
+        href={item.href}
+        onClick={item.onClick}
+        isSelected={getNavLinkIdFromProjectPageName(item.id) === activeNodeId}
+        linkProps={{ external: item.openInNewTab }}
+      />
+    ))}
+  </>
+);
+
+const SideNavigationFooterCollapsible: React.FC<{
+  title: string;
+  items: ProjectSideNavItem[];
+  activeNodeId: string;
+  icon?: IconType;
+}> = ({ title, icon, items, activeNodeId }) => {
+  const hasSelected = useMemo(
+    () => items.some(({ id }) => getNavLinkIdFromProjectPageName(id) === activeNodeId),
+    [activeNodeId, items]
+  );
+  const [isOpen, setIsOpen] = useState(hasSelected);
+  const categoryId = useMemo(() => (title ?? '').toLowerCase().replace(' ', '-'), [title]);
+
+  useEffect(() => {
+    setIsOpen((open) => (!open ? hasSelected : true));
+  }, [hasSelected]);
+
+  return (
+    <EuiCollapsibleNavItem
+      key={categoryId}
+      data-test-subj={`navFooterCollapsible-${categoryId}`}
+      title={title}
+      icon={icon}
+      iconProps={{ size: 'm' }}
+      accordionProps={{
+        forceState: isOpen ? 'open' : 'closed',
+        initialIsOpen: isOpen,
+        onToggle: (open) => {
+          setIsOpen(open);
+        },
+      }}
+      items={items.map((item) => formatCollapsibleItem(item, activeNodeId))}
+    />
+  );
+};
+
+const formatCollapsibleItem = (
+  sideNavItem: ProjectSideNavItem,
+  activeNodeId: string
+): EuiCollapsibleNavSubItemProps => {
+  return {
+    'data-test-subj': `solutionSideNavItemLink-${sideNavItem.id}`,
+    id: sideNavItem.id,
+    title: sideNavItem.label,
+    isSelected: getNavLinkIdFromProjectPageName(sideNavItem.id) === activeNodeId,
+    href: sideNavItem.href,
+    ...(sideNavItem.openInNewTab && { target: '_blank' }),
+    onClick: sideNavItem.onClick,
+    icon: sideNavItem.iconType,
+    iconProps: { size: 's' },
+  };
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/index.ts b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/types.ts
similarity index 51%
rename from x-pack/test/security_solution_api_integration/test_suites/index.ts
rename to x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/types.ts
index 2f9c0eda7a61b..8e386090ba8dd 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/index.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/types.ts
@@ -5,10 +5,7 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../ftr_provider_context';
+import type { SolutionSideNavItem } from '@kbn/security-solution-side-nav';
+import type { ProjectPageName } from '../links/types';
 
-export default function ({ loadTestFile }: FtrProviderContext) {
-  describe('Security solution API', function () {
-    loadTestFile(require.resolve('./detections_response'));
-  });
-}
+export type ProjectSideNavItem = SolutionSideNavItem<ProjectPageName>;
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/use_side_nav_items.test.tsx b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/use_side_nav_items.test.tsx
index b9dfb76923d8a..abb82cc209313 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/use_side_nav_items.test.tsx
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/use_side_nav_items.test.tsx
@@ -104,7 +104,6 @@ describe('useSideNavItems', () => {
         position: 'bottom',
         onClick: expect.any(Function),
         iconType: 'launch',
-        appendSeparator: true,
       },
     ]);
   });
@@ -129,7 +128,7 @@ describe('useSideNavItems', () => {
         label: 'Users & Roles',
         openInNewTab: true,
         iconType: 'someicon',
-        position: 'top',
+        position: 'bottom',
       },
     ]);
   });
diff --git a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/use_side_nav_items.ts b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/use_side_nav_items.ts
index 9833e6387b485..9b61439712221 100644
--- a/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/use_side_nav_items.ts
+++ b/x-pack/plugins/security_solution_serverless/public/navigation/side_navigation/use_side_nav_items.ts
@@ -8,28 +8,33 @@
 import { useCallback, useMemo } from 'react';
 import { SecurityPageName, type NavigationLink } from '@kbn/security-solution-navigation';
 import { useGetLinkProps } from '@kbn/security-solution-navigation/links';
-import {
-  SolutionSideNavItemPosition,
-  type SolutionSideNavItem,
-} from '@kbn/security-solution-side-nav';
+import { SolutionSideNavItemPosition } from '@kbn/security-solution-side-nav';
 import { useNavLinks } from '../../common/hooks/use_nav_links';
 import { ExternalPageName } from '../links/constants';
+import type { ProjectSideNavItem } from './types';
+import type { ProjectPageName } from '../links/types';
 
 type GetLinkProps = (link: NavigationLink) => {
-  href: string & Partial<SolutionSideNavItem>;
+  href: string & Partial<ProjectSideNavItem>;
 };
 
 const isBottomNavItem = (id: string) =>
   id === SecurityPageName.landing ||
-  id === SecurityPageName.projectSettings ||
-  id === ExternalPageName.devTools;
-const isGetStartedNavItem = (id: string) => id === SecurityPageName.landing;
+  id === ExternalPageName.devTools ||
+  id === ExternalPageName.management ||
+  id === ExternalPageName.integrationsSecurity ||
+  id === ExternalPageName.cloudUsersAndRoles ||
+  id === ExternalPageName.cloudPerformance ||
+  id === ExternalPageName.cloudBilling;
 
 /**
  * Formats generic navigation links into the shape expected by the `SolutionSideNav`
  */
-const formatLink = (navLink: NavigationLink, getLinkProps: GetLinkProps): SolutionSideNavItem => {
-  const items = navLink.links?.reduce<SolutionSideNavItem[]>((acc, current) => {
+const formatLink = (
+  navLink: NavigationLink<ProjectPageName>,
+  getLinkProps: GetLinkProps
+): ProjectSideNavItem => {
+  const items = navLink.links?.reduce<ProjectSideNavItem[]>((acc, current) => {
     if (!current.disabled) {
       acc.push({
         id: current.id,
@@ -56,25 +61,10 @@ const formatLink = (navLink: NavigationLink, getLinkProps: GetLinkProps): Soluti
   };
 };
 
-/**
- * Formats the get started navigation links into the shape expected by the `SolutionSideNav`
- */
-const formatGetStartedLink = (
-  navLink: NavigationLink,
-  getLinkProps: GetLinkProps
-): SolutionSideNavItem => ({
-  id: navLink.id,
-  label: navLink.title,
-  iconType: navLink.sideNavIcon,
-  position: SolutionSideNavItemPosition.bottom,
-  ...getLinkProps(navLink),
-  appendSeparator: true,
-});
-
 /**
  * Returns all the formatted SideNavItems, including external links
  */
-export const useSideNavItems = (): SolutionSideNavItem[] => {
+export const useSideNavItems = (): ProjectSideNavItem[] => {
   const navLinks = useNavLinks();
   const getKibanaLinkProps = useGetLinkProps();
 
@@ -94,13 +84,8 @@ export const useSideNavItems = (): SolutionSideNavItem[] => {
 
   return useMemo(
     () =>
-      navLinks.reduce<SolutionSideNavItem[]>((items, navLink) => {
-        if (navLink.disabled) {
-          return items;
-        }
-        if (isGetStartedNavItem(navLink.id)) {
-          items.push(formatGetStartedLink(navLink, getLinkProps));
-        } else {
+      navLinks.reduce<ProjectSideNavItem[]>((items, navLink) => {
+        if (!navLink.disabled) {
           items.push(formatLink(navLink, getLinkProps));
         }
         return items;
diff --git a/x-pack/plugins/security_solution_serverless/public/pages/project_settings.tsx b/x-pack/plugins/security_solution_serverless/public/pages/project_settings.tsx
deleted file mode 100644
index 71809249b266e..0000000000000
--- a/x-pack/plugins/security_solution_serverless/public/pages/project_settings.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { EuiHorizontalRule, EuiPageHeader, EuiSpacer } from '@elastic/eui';
-import {
-  LandingLinksIconsCategories,
-  LandingLinksIconsCategoriesGroups,
-} from '@kbn/security-solution-navigation/landing_links';
-import type { AccordionLinkCategory, NavigationLink } from '@kbn/security-solution-navigation';
-import {
-  isAccordionLinkCategory,
-  isSeparatorLinkCategory,
-  SecurityPageName,
-} from '@kbn/security-solution-navigation';
-import { KibanaPageTemplate } from '@kbn/shared-ux-page-kibana-template';
-import { TrackApplicationView } from '@kbn/usage-collection-plugin/public';
-import { useNavLink } from '../common/hooks/use_nav_links';
-
-export const ProjectSettingsRoute: React.FC = () => {
-  const projectSettingsLink = useNavLink(SecurityPageName.projectSettings);
-  const { links = [], categories = [], title } = projectSettingsLink ?? {};
-
-  const iconLinks = categories.reduce<NavigationLink[]>((acc, category) => {
-    if (isSeparatorLinkCategory(category)) {
-      const categoryLinks = links.filter(({ id }) => category.linkIds.includes(id));
-
-      acc.push(...categoryLinks);
-    }
-    return acc;
-  }, []);
-
-  const accordionCategories = (categories.filter((category) => isAccordionLinkCategory(category)) ??
-    []) as AccordionLinkCategory[];
-
-  const separatorCategories = (categories.filter((category) => isSeparatorLinkCategory(category)) ??
-    []) as AccordionLinkCategory[];
-
-  return (
-    <KibanaPageTemplate restrictWidth={false} contentBorder={false} grow={true}>
-      <KibanaPageTemplate.Section>
-        <TrackApplicationView viewId={SecurityPageName.projectSettings}>
-          <EuiPageHeader pageTitle={title} />
-          <EuiSpacer size="l" />
-          <EuiSpacer size="xl" />
-          <LandingLinksIconsCategories links={iconLinks} categories={separatorCategories} />
-          <EuiSpacer size="l" />
-          <EuiHorizontalRule />
-          <LandingLinksIconsCategoriesGroups links={links} categories={accordionCategories} />
-        </TrackApplicationView>
-      </KibanaPageTemplate.Section>
-    </KibanaPageTemplate>
-  );
-};
-
-// eslint-disable-next-line import/no-default-export
-export default ProjectSettingsRoute;
diff --git a/x-pack/plugins/security_solution_serverless/public/pages/routes.tsx b/x-pack/plugins/security_solution_serverless/public/pages/routes.tsx
index 91df4306de69c..31639182db8b1 100644
--- a/x-pack/plugins/security_solution_serverless/public/pages/routes.tsx
+++ b/x-pack/plugins/security_solution_serverless/public/pages/routes.tsx
@@ -29,9 +29,6 @@ const AssetsPage = withSuspense(AssetsPageLazy);
 const MachineLearningPageLazy = lazy(() => import('./machine_learning'));
 const MachineLearningPage = withSuspense(MachineLearningPageLazy);
 
-const ProjectSettingsPageLazy = lazy(() => import('./project_settings'));
-const ProjectSettingsPage = withSuspense(ProjectSettingsPageLazy);
-
 // Sets the project specific routes for Serverless as extra routes in the Security Solution plugin
 export const setRoutes = (services: Services) => {
   const projectRoutes: RouteProps[] = [
@@ -47,10 +44,6 @@ export const setRoutes = (services: Services) => {
       path: SecurityPagePath[SecurityPageName.mlLanding],
       component: withServicesProvider(MachineLearningPage, services),
     },
-    {
-      path: SecurityPagePath[SecurityPageName.projectSettings],
-      component: withServicesProvider(ProjectSettingsPage, services),
-    },
   ];
   services.securitySolution.setExtraRoutes(projectRoutes);
 };
diff --git a/x-pack/plugins/security_solution_serverless/public/plugin.ts b/x-pack/plugins/security_solution_serverless/public/plugin.ts
index 3f11cf02cd5b3..e7e58c42bcaac 100644
--- a/x-pack/plugins/security_solution_serverless/public/plugin.ts
+++ b/x-pack/plugins/security_solution_serverless/public/plugin.ts
@@ -53,7 +53,7 @@ export class SecuritySolutionServerlessPlugin
       securitySolution.experimentalFeatures
     ).features;
 
-    setupNavigation(core, setupDeps, this.experimentalFeatures);
+    setupNavigation(core, setupDeps);
     return {};
   }
 
@@ -73,7 +73,7 @@ export class SecuritySolutionServerlessPlugin
       dashboardsLandingCallout: getDashboardsLandingCallout(services),
     });
 
-    startNavigation(services, this.config);
+    startNavigation(services);
     setRoutes(services);
 
     return {};
diff --git a/x-pack/plugins/security_solution_serverless/public/types.ts b/x-pack/plugins/security_solution_serverless/public/types.ts
index cb34701fe6feb..19fa50d3b630a 100644
--- a/x-pack/plugins/security_solution_serverless/public/types.ts
+++ b/x-pack/plugins/security_solution_serverless/public/types.ts
@@ -38,5 +38,5 @@ export interface SecuritySolutionServerlessPluginStartDeps {
 
 export type ServerlessSecurityPublicConfig = Pick<
   ServerlessSecurityConfigSchema,
-  'productTypes' | 'developer' | 'enableExperimental'
+  'productTypes' | 'enableExperimental'
 >;
diff --git a/x-pack/plugins/security_solution_serverless/server/config.ts b/x-pack/plugins/security_solution_serverless/server/config.ts
index 551fd5976a761..f10c1d0f2c3c6 100644
--- a/x-pack/plugins/security_solution_serverless/server/config.ts
+++ b/x-pack/plugins/security_solution_serverless/server/config.ts
@@ -8,13 +8,12 @@
 import { schema, type TypeOf } from '@kbn/config-schema';
 import type { PluginConfigDescriptor, PluginInitializerContext } from '@kbn/core/server';
 import type { SecuritySolutionPluginSetup } from '@kbn/security-solution-plugin/server/plugin_contract';
-import { developerConfigSchema, productTypes } from '../common/config';
+import { productTypes } from '../common/config';
 import type { ExperimentalFeatures } from '../common/experimental_features';
 import { parseExperimentalConfigValue } from '../common/experimental_features';
 
 export const configSchema = schema.object({
   enabled: schema.boolean({ defaultValue: false }),
-  developer: developerConfigSchema,
   productTypes,
   /**
    * For internal use. A list of string values (comma delimited) that will enable experimental
@@ -38,7 +37,6 @@ export const config: PluginConfigDescriptor<ServerlessSecuritySchema> = {
   exposeToBrowser: {
     enableExperimental: true,
     productTypes: true,
-    developer: true,
   },
   schema: configSchema,
   deprecations: ({ renameFromRoot }) => [
diff --git a/x-pack/plugins/security_solution_serverless/tsconfig.json b/x-pack/plugins/security_solution_serverless/tsconfig.json
index ef6c4009f345e..154284ca9fab8 100644
--- a/x-pack/plugins/security_solution_serverless/tsconfig.json
+++ b/x-pack/plugins/security_solution_serverless/tsconfig.json
@@ -20,7 +20,6 @@
     "@kbn/security-solution-ess",
     "@kbn/security-solution-plugin",
     "@kbn/serverless",
-    "@kbn/shared-ux-page-solution-nav",
     "@kbn/security-solution-side-nav",
     "@kbn/security-solution-navigation",
     "@kbn/security-solution-upselling",
diff --git a/x-pack/plugins/serverless_observability/public/components/side_navigation/index.tsx b/x-pack/plugins/serverless_observability/public/components/side_navigation/index.tsx
index 47e459c9c8cea..d2b07282e70b5 100644
--- a/x-pack/plugins/serverless_observability/public/components/side_navigation/index.tsx
+++ b/x-pack/plugins/serverless_observability/public/components/side_navigation/index.tsx
@@ -172,7 +172,7 @@ const navigationTree: NavigationTreeDefinition = {
   ],
   footer: [
     {
-      type: 'navGroup',
+      type: 'navItem',
       title: i18n.translate('xpack.serverlessObservability.nav.getStarted', {
         defaultMessage: 'Get Started',
       }),
@@ -181,7 +181,7 @@ const navigationTree: NavigationTreeDefinition = {
       icon: 'launch',
     },
     {
-      type: 'navGroup',
+      type: 'navItem',
       id: 'devTools',
       title: i18n.translate('xpack.serverlessObservability.nav.devTools', {
         defaultMessage: 'Developer tools',
diff --git a/x-pack/plugins/serverless_search/common/doc_links.ts b/x-pack/plugins/serverless_search/common/doc_links.ts
index 0c816e3c7a389..6d97c6aed5bed 100644
--- a/x-pack/plugins/serverless_search/common/doc_links.ts
+++ b/x-pack/plugins/serverless_search/common/doc_links.ts
@@ -76,7 +76,7 @@ class ESDocLinks {
     this.phpClient = newDocLinks.serverlessClients.phpGettingStarted;
     // Python
     this.pythonApiReference = newDocLinks.serverlessClients.pythonGettingStarted;
-    this.pythonBasicConfig = newDocLinks.clients.pythonConnecting;
+    this.pythonBasicConfig = newDocLinks.serverlessClients.pythonGettingStarted;
     this.pythonClient = newDocLinks.serverlessClients.pythonGettingStarted;
     // Python
     this.rubyBasicConfig = newDocLinks.serverlessClients.rubyGettingStarted;
diff --git a/x-pack/plugins/serverless_search/public/layout/nav.tsx b/x-pack/plugins/serverless_search/public/layout/nav.tsx
index 7e050fe4fdc1e..a4078ba841861 100644
--- a/x-pack/plugins/serverless_search/public/layout/nav.tsx
+++ b/x-pack/plugins/serverless_search/public/layout/nav.tsx
@@ -114,7 +114,7 @@ const navigationTree: NavigationTreeDefinition = {
   ],
   footer: [
     {
-      type: 'navGroup',
+      type: 'navItem',
       id: 'search_getting_started',
       title: i18n.translate('xpack.serverlessSearch.nav.gettingStarted', {
         defaultMessage: 'Getting started',
diff --git a/x-pack/plugins/stack_connectors/common/bedrock/constants.ts b/x-pack/plugins/stack_connectors/common/bedrock/constants.ts
index 361309a84d0a9..8071091194049 100644
--- a/x-pack/plugins/stack_connectors/common/bedrock/constants.ts
+++ b/x-pack/plugins/stack_connectors/common/bedrock/constants.ts
@@ -10,7 +10,7 @@ import { i18n } from '@kbn/i18n';
 export const BEDROCK_TITLE = i18n.translate(
   'xpack.stackConnectors.components.bedrock.connectorTypeTitle',
   {
-    defaultMessage: 'AWS Bedrock',
+    defaultMessage: 'Amazon Bedrock',
   }
 );
 export const BEDROCK_CONNECTOR_ID = '.bedrock';
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/bedrock/bedrock.test.tsx b/x-pack/plugins/stack_connectors/public/connector_types/bedrock/bedrock.test.tsx
index 502ec1755bda7..a37762487a822 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/bedrock/bedrock.test.tsx
+++ b/x-pack/plugins/stack_connectors/public/connector_types/bedrock/bedrock.test.tsx
@@ -26,8 +26,8 @@ beforeAll(() => {
 describe('actionTypeRegistry.get() works', () => {
   test('connector type static data is as expected', () => {
     expect(actionTypeModel.id).toEqual(ACTION_TYPE_ID);
-    expect(actionTypeModel.selectMessage).toBe('Send a request to AWS Bedrock.');
-    expect(actionTypeModel.actionTypeTitle).toBe('AWS Bedrock');
+    expect(actionTypeModel.selectMessage).toBe('Send a request to Amazon Bedrock.');
+    expect(actionTypeModel.actionTypeTitle).toBe('Amazon Bedrock');
   });
 });
 
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/bedrock/bedrock.tsx b/x-pack/plugins/stack_connectors/public/connector_types/bedrock/bedrock.tsx
index e6d674354511a..361caed6882c2 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/bedrock/bedrock.tsx
+++ b/x-pack/plugins/stack_connectors/public/connector_types/bedrock/bedrock.tsx
@@ -21,7 +21,7 @@ export function getConnectorType(): BedrockConnector {
     id: BEDROCK_CONNECTOR_ID,
     iconClass: lazy(() => import('./logo')),
     selectMessage: i18n.translate('xpack.stackConnectors.components.bedrock.selectMessageText', {
-      defaultMessage: 'Send a request to AWS Bedrock.',
+      defaultMessage: 'Send a request to Amazon Bedrock.',
     }),
     actionTypeTitle: BEDROCK_TITLE,
     validateParams: async (
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/bedrock/constants.tsx b/x-pack/plugins/stack_connectors/public/connector_types/bedrock/constants.tsx
index 7ee3e35cecf15..88fc42e004bf8 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/bedrock/constants.tsx
+++ b/x-pack/plugins/stack_connectors/public/connector_types/bedrock/constants.tsx
@@ -33,7 +33,7 @@ export const bedrockConfig: ConfigFieldSchema[] = [
     defaultValue: DEFAULT_BEDROCK_URL,
     helpText: (
       <FormattedMessage
-        defaultMessage="The AWS Bedrock API endpoint URL. For more information on the URL, refer to the {bedrockAPIUrlDocs}."
+        defaultMessage="The Amazon Bedrock API endpoint URL. For more information on the URL, refer to the {bedrockAPIUrlDocs}."
         id="xpack.stackConnectors.components.bedrock.bedrockDocumentation"
         values={{
           bedrockAPIUrlDocs: (
diff --git a/x-pack/plugins/stack_connectors/public/connector_types/bedrock/translations.ts b/x-pack/plugins/stack_connectors/public/connector_types/bedrock/translations.ts
index 37c8165b76048..6906f691ffcae 100644
--- a/x-pack/plugins/stack_connectors/public/connector_types/bedrock/translations.ts
+++ b/x-pack/plugins/stack_connectors/public/connector_types/bedrock/translations.ts
@@ -40,7 +40,7 @@ export const SECRET = i18n.translate('xpack.stackConnectors.components.bedrock.s
 });
 
 export const BEDROCK = i18n.translate('xpack.stackConnectors.components.bedrock.title', {
-  defaultMessage: 'AWS Bedrock',
+  defaultMessage: 'Amazon Bedrock',
 });
 
 export const DOCUMENTATION = i18n.translate(
diff --git a/x-pack/plugins/stack_connectors/server/connector_types/bedrock/index.test.ts b/x-pack/plugins/stack_connectors/server/connector_types/bedrock/index.test.ts
index 78a1937bf76c2..ba4f8290b34f7 100644
--- a/x-pack/plugins/stack_connectors/server/connector_types/bedrock/index.test.ts
+++ b/x-pack/plugins/stack_connectors/server/connector_types/bedrock/index.test.ts
@@ -33,9 +33,9 @@ describe('Bedrock Connector', () => {
     configurationUtilities = actionsConfigMock.create();
     connectorType = getConnectorType();
   });
-  test('exposes the connector as `AWS Bedrock` with id `.bedrock`', () => {
+  test('exposes the connector as `Amazon Bedrock` with id `.bedrock`', () => {
     expect(connectorType.id).toEqual('.bedrock');
-    expect(connectorType.name).toEqual('AWS Bedrock');
+    expect(connectorType.name).toEqual('Amazon Bedrock');
   });
   describe('config validation', () => {
     test('config validation passes when only required fields are provided', () => {
@@ -55,7 +55,7 @@ describe('Bedrock Connector', () => {
       expect(() => {
         configValidator(config, { configurationUtilities });
       }).toThrowErrorMatchingInlineSnapshot(
-        '"Error configuring AWS Bedrock action: Error: URL Error: Invalid URL: example.com/do-something"'
+        '"Error configuring Amazon Bedrock action: Error: URL Error: Invalid URL: example.com/do-something"'
       );
     });
 
@@ -75,7 +75,7 @@ describe('Bedrock Connector', () => {
       expect(() => {
         configValidator(config, { configurationUtilities: configUtils });
       }).toThrowErrorMatchingInlineSnapshot(
-        `"Error configuring AWS Bedrock action: Error: error validating url: target url is not present in allowedHosts"`
+        `"Error configuring Amazon Bedrock action: Error: error validating url: target url is not present in allowedHosts"`
       );
     });
   });
diff --git a/x-pack/plugins/stack_connectors/server/connector_types/bedrock/index.ts b/x-pack/plugins/stack_connectors/server/connector_types/bedrock/index.ts
index 11050628203a9..02b2bff9a93ae 100644
--- a/x-pack/plugins/stack_connectors/server/connector_types/bedrock/index.ts
+++ b/x-pack/plugins/stack_connectors/server/connector_types/bedrock/index.ts
@@ -43,7 +43,7 @@ export const configValidator = (configObject: Config, validatorServices: Validat
   } catch (err) {
     throw new Error(
       i18n.translate('xpack.stackConnectors.bedrock.configurationErrorApiProvider', {
-        defaultMessage: 'Error configuring AWS Bedrock action: {err}',
+        defaultMessage: 'Error configuring Amazon Bedrock action: {err}',
         values: {
           err,
         },
diff --git a/x-pack/plugins/stack_connectors/server/plugin.test.ts b/x-pack/plugins/stack_connectors/server/plugin.test.ts
index c728ee92cea40..c5c16a29647fd 100644
--- a/x-pack/plugins/stack_connectors/server/plugin.test.ts
+++ b/x-pack/plugins/stack_connectors/server/plugin.test.ts
@@ -164,7 +164,7 @@ describe('Stack Connectors Plugin', () => {
         4,
         expect.objectContaining({
           id: '.bedrock',
-          name: 'AWS Bedrock',
+          name: 'Amazon Bedrock',
         })
       );
       expect(actionsSetup.registerSubActionConnectorType).toHaveBeenNthCalledWith(
diff --git a/x-pack/plugins/synthetics/common/runtime_types/monitor_management/monitor_types_project.ts b/x-pack/plugins/synthetics/common/runtime_types/monitor_management/monitor_types_project.ts
index 23e39660842fa..99082a43f09b3 100644
--- a/x-pack/plugins/synthetics/common/runtime_types/monitor_management/monitor_types_project.ts
+++ b/x-pack/plugins/synthetics/common/runtime_types/monitor_management/monitor_types_project.ts
@@ -43,7 +43,7 @@ export const ProjectMonitorCodec = t.intersection([
     alert: AlertConfigsCodec,
     urls: t.union([t.string, t.array(t.string)]),
     hosts: t.union([t.string, t.array(t.string)]),
-    max_redirects: t.string,
+    max_redirects: t.union([t.string, t.number]),
     wait: t.string,
     hash: t.string,
     namespace: t.string,
diff --git a/x-pack/plugins/synthetics/e2e/synthetics/journeys/data_retention.journey.ts b/x-pack/plugins/synthetics/e2e/synthetics/journeys/data_retention.journey.ts
index 9487fb62ccf95..1e0c00f42a92f 100644
--- a/x-pack/plugins/synthetics/e2e/synthetics/journeys/data_retention.journey.ts
+++ b/x-pack/plugins/synthetics/e2e/synthetics/journeys/data_retention.journey.ts
@@ -52,7 +52,7 @@ journey(`DataRetentionPage`, async ({ page, params }) => {
     const screenshotChecks = await page.textContent(
       `tr:has-text("Browser Screenshots") span:has-text("KB")`
     );
-    expect(Number(allChecks?.split('KB')[0])).toBeGreaterThan(450);
+    expect(Number(allChecks?.split('KB')[0])).toBeGreaterThan(400);
     expect(Number(browserChecks?.split('KB')[0])).toBeGreaterThan(50);
     expect(Number(networkChecks?.split('KB')[0])).toBeGreaterThan(300);
     expect(Number(screenshotChecks?.split('KB')[0])).toBeGreaterThan(25);
diff --git a/x-pack/plugins/synthetics/e2e/synthetics/journeys/index.ts b/x-pack/plugins/synthetics/e2e/synthetics/journeys/index.ts
index 40418a55e8d8e..e38219a78ec95 100644
--- a/x-pack/plugins/synthetics/e2e/synthetics/journeys/index.ts
+++ b/x-pack/plugins/synthetics/e2e/synthetics/journeys/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+export * from './data_retention.journey';
 export * from './project_api_keys.journey';
 export * from './getting_started.journey';
 export * from './add_monitor.journey';
@@ -19,7 +20,6 @@ export * from './global_parameters.journey';
 export * from './detail_flyout';
 // export * from './alert_rules/default_status_alert.journey';
 export * from './test_now_mode.journey';
-// export * from './data_retention.journey';
 export * from './monitor_details_page/monitor_summary.journey';
 export * from './test_run_details.journey';
 export * from './step_details.journey';
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/view_document.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/view_document.tsx
index 591c91a902146..8f03ab6190af5 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/view_document.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/view_document.tsx
@@ -6,7 +6,7 @@
  */
 
 import { EuiButtonIcon, EuiFlyout, EuiFlyoutBody, EuiFlyoutHeader, EuiTitle } from '@elastic/eui';
-import React, { useState } from 'react';
+import React, { useState, MouseEvent } from 'react';
 import { useUnifiedDocViewerServices } from '@kbn/unified-doc-viewer-plugin/public';
 import { buildDataTableRecord } from '@kbn/discover-utils';
 import { UnifiedDocViewer } from '@kbn/unified-doc-viewer-plugin/public';
@@ -56,12 +56,20 @@ export const ViewDocument = ({ ping }: { ping: Ping }) => {
         data-test-subj="syntheticsViewDocumentButton"
         iconType="inspect"
         title={INSPECT_DOCUMENT}
-        onClick={() => {
+        onClick={(evt: MouseEvent<HTMLButtonElement>) => {
+          evt.stopPropagation();
           setIsFlyoutVisible(true);
         }}
       />
       {isFlyoutVisible && (
-        <EuiFlyout onClose={() => setIsFlyoutVisible(false)} ownFocus={true}>
+        <EuiFlyout
+          onClose={() => setIsFlyoutVisible(false)}
+          ownFocus={true}
+          onClick={(evt: MouseEvent) => {
+            // needed to prevent propagation to the table row click
+            evt.stopPropagation();
+          }}
+        >
           <EuiFlyoutHeader>
             <EuiTitle size="m">
               <h4>
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/journey_screenshot_preview.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/journey_screenshot_preview.tsx
index 5eac5686e9923..f16586141971d 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/journey_screenshot_preview.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/journey_screenshot_preview.tsx
@@ -61,7 +61,9 @@ export const JourneyScreenshotPreview: React.FC<StepImagePopoverProps> = ({
   );
 
   const onImgClick = useCallback(
-    (_evt: MouseEvent<HTMLImageElement>) => {
+    (evt: MouseEvent<HTMLImageElement>) => {
+      // needed to prevent propagation to the table row click
+      evt.stopPropagation();
       setIsImageEverClicked(true);
       setIsImageDialogOpen(true);
       setIsImagePopoverOpen(false);
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/screenshot/empty_thumbnail.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/screenshot/empty_thumbnail.tsx
index 7309d54aa08da..45e1e780d1e31 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/screenshot/empty_thumbnail.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/screenshot/empty_thumbnail.tsx
@@ -49,6 +49,7 @@ export const EmptyThumbnail = ({
   const noDataMessage = unavailableMessage ?? SCREENSHOT_NOT_AVAILABLE;
 
   return (
+    // eslint-disable-next-line jsx-a11y/no-noninteractive-element-interactions
     <div
       data-test-subj="stepScreenshotPlaceholder"
       role="img"
@@ -62,6 +63,15 @@ export const EmptyThumbnail = ({
         border: euiTheme.border.thin,
         ...(borderRadius ? { borderRadius } : {}),
       }}
+      onClick={(e) => {
+        // We don't want the placeholder to be clickable
+        e.stopPropagation();
+        e.preventDefault();
+      }}
+      onKeyDown={(e) => {
+        // We don't want the placeholder to be clickable
+        e.stopPropagation();
+      }}
     >
       {isLoading && animateLoading ? (
         <EuiSkeletonRectangle
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/screenshot/journey_screenshot_dialog.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/screenshot/journey_screenshot_dialog.tsx
index 05295781aa7c3..9f261e738a96b 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/screenshot/journey_screenshot_dialog.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/screenshot/journey_screenshot_dialog.tsx
@@ -107,6 +107,7 @@ export const JourneyScreenshotDialog = ({
     <EuiOutsideClickDetector onOutsideClick={onClose}>
       <EuiModal
         onClose={(evt?: KeyboardEvent<HTMLDivElement> | MouseEvent<HTMLButtonElement>) => {
+          // for table row click to work
           evt?.stopPropagation?.();
           onClose();
         }}
@@ -127,6 +128,10 @@ export const JourneyScreenshotDialog = ({
             animateLoading={false}
             hasBorder={false}
             size={'full'}
+            onClick={(evt) => {
+              // for table row click to work
+              evt.stopPropagation();
+            }}
           />
         </ModalBodyStyled>
 
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_summary/test_runs_table.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_summary/test_runs_table.tsx
index 5fe46b6c52697..de83a03ac4928 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_summary/test_runs_table.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_summary/test_runs_table.tsx
@@ -213,7 +213,7 @@ export const TestRunsTable = ({
       name: MESSAGE_LABEL,
       textOnly: true,
       css: css`
-        max-width: 600px;
+        max-width: 500px;
       `,
       render: (errorMessage: string) => (
         <EuiText size="s">{errorMessage?.length > 0 ? errorMessage : '-'}</EuiText>
@@ -269,31 +269,16 @@ export const TestRunsTable = ({
     return {
       'data-test-subj': `row-${item.monitor.check_group}`,
       onClick: (evt: MouseEvent) => {
-        const targetElem = evt.target as HTMLElement;
-        const isTableRow =
-          targetElem.parentElement?.classList.contains('euiTableCellContent') ||
-          targetElem.parentElement?.classList.contains('euiTableCellContent__text') ||
-          targetElem?.classList.contains('euiTableCellContent') ||
-          targetElem?.classList.contains('euiBadge__text');
-        // we dont want to capture image click event
-        if (
-          isTableRow &&
-          targetElem.tagName !== 'IMG' &&
-          targetElem.tagName !== 'path' &&
-          targetElem.tagName !== 'BUTTON' &&
-          !targetElem.parentElement?.classList.contains('euiLink')
-        ) {
-          if (item.monitor.type !== MONITOR_TYPES.BROWSER) {
-            toggleDetails(item, expandedRows, setExpandedRows);
-          } else {
-            history.push(
-              getTestRunDetailRelativeLink({
-                monitorId,
-                checkGroup: item.monitor.check_group,
-                locationId: selectedLocation?.id,
-              })
-            );
-          }
+        if (item.monitor.type !== MONITOR_TYPES.BROWSER) {
+          toggleDetails(item, expandedRows, setExpandedRows);
+        } else {
+          history.push(
+            getTestRunDetailRelativeLink({
+              monitorId,
+              checkGroup: item.monitor.check_group,
+              locationId: selectedLocation?.id,
+            })
+          );
         }
       },
     };
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/test_now_mode/simple/ping_list/columns/expand_row.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/test_now_mode/simple/ping_list/columns/expand_row.tsx
index 9ef5ceacc6183..13cef1917b1cc 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/test_now_mode/simple/ping_list/columns/expand_row.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/test_now_mode/simple/ping_list/columns/expand_row.tsx
@@ -5,16 +5,17 @@
  * 2.0.
  */
 
-import React from 'react';
+import React, { Dispatch, SetStateAction, MouseEvent } from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiButtonIcon } from '@elastic/eui';
 import { Ping } from '../../../../../../../../common/runtime_types';
 import { PingListExpandedRowComponent } from '../expanded_row';
+type PingExpandedRowMap = Record<string, JSX.Element>;
 
 export const toggleDetails = (
   ping: Ping,
-  expandedRows: Record<string, JSX.Element>,
-  setExpandedRows: (update: Record<string, JSX.Element>) => any
+  expandedRows: PingExpandedRowMap,
+  setExpandedRows: Dispatch<SetStateAction<PingExpandedRowMap>>
 ) => {
   // prevent expanding on row click if not expandable
   if (!rowShouldExpand(ping)) {
@@ -48,14 +49,18 @@ export function rowShouldExpand(item: Ping) {
 
 interface Props {
   item: Ping;
-  expandedRows: Record<string, JSX.Element>;
-  setExpandedRows: (val: Record<string, JSX.Element>) => void;
+  expandedRows: PingExpandedRowMap;
+  setExpandedRows: Dispatch<SetStateAction<PingExpandedRowMap>>;
 }
 export const ExpandRowColumn = ({ item, expandedRows, setExpandedRows }: Props) => {
   return (
     <EuiButtonIcon
       data-test-subj="uptimePingListExpandBtn"
-      onClick={() => toggleDetails(item, expandedRows, setExpandedRows)}
+      onClick={(evt: MouseEvent<HTMLButtonElement>) => {
+        // for table row click
+        evt.stopPropagation();
+        toggleDetails(item, expandedRows, setExpandedRows);
+      }}
       isDisabled={!rowShouldExpand(item)}
       aria-label={
         expandedRows[item.docId]
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.test.ts b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.test.ts
index 44678ad3b7688..6db69ae3eebf2 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.test.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.test.ts
@@ -78,6 +78,7 @@ describe('http normalizers', () => {
           supported_protocols: ['TLSv1.2', 'TLSv1.3'],
         },
         hash: testHash,
+        max_redirects: 2,
       },
       {
         locations: ['localhost'],
@@ -160,7 +161,7 @@ describe('http normalizers', () => {
             form_monitor_type: 'http',
             journey_id: 'my-monitor-2',
             locations: [],
-            max_redirects: '0',
+            max_redirects: '2',
             name: 'My Monitor 2',
             namespace: 'test_space',
             origin: 'project',
@@ -300,7 +301,7 @@ describe('http normalizers', () => {
             form_monitor_type: 'http',
             journey_id: 'my-monitor-2',
             locations: [],
-            max_redirects: '0',
+            max_redirects: '2',
             name: 'My Monitor 2',
             namespace: 'test_space',
             origin: 'project',
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.ts b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.ts
index 892fbd53617a1..c79db2433cb80 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/project_monitor/normalizers/http_monitor.ts
@@ -64,8 +64,7 @@ export const getNormalizeHTTPFields = ({
     [ConfigKey.MONITOR_TYPE]: DataStream.HTTP,
     [ConfigKey.FORM_MONITOR_TYPE]: FormMonitorType.HTTP,
     [ConfigKey.URLS]: getOptionalArrayField(monitor.urls) || defaultFields[ConfigKey.URLS],
-    [ConfigKey.MAX_REDIRECTS]:
-      monitor[ConfigKey.MAX_REDIRECTS] || defaultFields[ConfigKey.MAX_REDIRECTS],
+    [ConfigKey.MAX_REDIRECTS]: formatMaxRedirects(monitor[ConfigKey.MAX_REDIRECTS]),
     [ConfigKey.REQUEST_BODY_CHECK]: getRequestBodyField(
       (yamlConfig as Record<keyof HTTPFields, unknown>)[ConfigKey.REQUEST_BODY_CHECK] as string,
       defaultFields[ConfigKey.REQUEST_BODY_CHECK]
@@ -113,3 +112,13 @@ export const getRequestBodyField = (
     value: parsedValue || defaultValue.value,
   };
 };
+
+export const formatMaxRedirects = (value?: string | number): string => {
+  if (typeof value === 'number') {
+    return `${value}`;
+  }
+
+  const defaultFields = DEFAULT_FIELDS[DataStream.HTTP];
+
+  return value ?? defaultFields[ConfigKey.MAX_REDIRECTS];
+};
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/service_api_client.ts b/x-pack/plugins/synthetics/server/synthetics_service/service_api_client.ts
index 02779526c8421..e30b9a18872a9 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/service_api_client.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/service_api_client.ts
@@ -18,7 +18,12 @@ import {
   DataStreamConfig,
 } from './formatters/public_formatters/convert_to_data_stream';
 import { sendErrorTelemetryEvents } from '../routes/telemetry/monitor_upgrade_sender';
-import { MonitorFields, PublicLocations, ServiceLocationErrors } from '../../common/runtime_types';
+import {
+  MonitorFields,
+  PublicLocations,
+  ServiceLocation,
+  ServiceLocationErrors,
+} from '../../common/runtime_types';
 import { ServiceConfig } from '../../common/config';
 
 const TEST_SERVICE_USERNAME = 'localKibanaIntegrationTestsUser';
@@ -32,6 +37,7 @@ export interface ServiceData {
   endpoint?: 'monitors' | 'runOnce' | 'sync';
   isEdit?: boolean;
   license: LicenseGetLicenseInformation;
+  location?: ServiceLocation;
 }
 
 export interface ServicePayload {
@@ -161,10 +167,14 @@ export class ServiceAPIClient {
   }
 
   async syncMonitors(data: ServiceData) {
-    return (await this.callAPI('PUT', { ...data, endpoint: 'sync' })).pushErrors;
+    try {
+      return (await this.callAPI('PUT', { ...data, endpoint: 'sync' })).pushErrors;
+    } catch (e) {
+      this.logger.error(e);
+    }
   }
 
-  processServiceData({ monitors, ...restOfData }: ServiceData) {
+  processServiceData({ monitors, location, ...restOfData }: ServiceData) {
     // group monitors by location
     const monitorsByLocation: Array<{
       location: { id: string; url: string };
@@ -172,12 +182,14 @@ export class ServiceAPIClient {
       data: ServicePayload;
     }> = [];
     this.locations.forEach(({ id, url }) => {
-      const locMonitors = monitors.filter(({ locations }) =>
-        locations?.find((loc) => loc.id === id && loc.isServiceManaged)
-      );
-      if (locMonitors.length > 0) {
-        const data = this.getRequestData({ ...restOfData, monitors: locMonitors });
-        monitorsByLocation.push({ location: { id, url }, monitors: locMonitors, data });
+      if (!location || location.id === id) {
+        const locMonitors = monitors.filter(({ locations }) =>
+          locations?.find((loc) => loc.id === id && loc.isServiceManaged)
+        );
+        if (locMonitors.length > 0) {
+          const data = this.getRequestData({ ...restOfData, monitors: locMonitors });
+          monitorsByLocation.push({ location: { id, url }, monitors: locMonitors, data });
+        }
       }
     });
     return monitorsByLocation;
@@ -275,7 +287,9 @@ export class ServiceAPIClient {
     result: AxiosResponse<any> | ServicePayload
   ) {
     if ('status' in result || 'request' in result) {
-      this.logger.debug(result.data);
+      if (result.data) {
+        this.logger.debug(result.data);
+      }
       this.logger.debug(
         `Successfully called service location ${url}${result.request?.path} with method ${method} with ${numMonitors} monitors`
       );
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.test.ts b/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.test.ts
index e98508a5e4116..66c25a8bb5ca1 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.test.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.test.ts
@@ -23,22 +23,24 @@ const taskManagerSetup = taskManagerMock.createSetup();
 
 const mockCoreStart = coreMock.createStart() as CoreStart;
 
-mockCoreStart.elasticsearch.client.asInternalUser.license.get = jest.fn().mockResolvedValue({
-  license: {
-    status: 'active',
-    uid: 'c5788419-1c6f-424a-9217-da7a0a9151a0',
-    type: 'platinum',
-    issue_date: '2022-11-29T00:00:00.000Z',
-    issue_date_in_millis: 1669680000000,
-    expiry_date: '2024-12-31T23:59:59.999Z',
-    expiry_date_in_millis: 1735689599999,
-    max_nodes: 100,
-    max_resource_units: null,
-    issued_to: 'Elastic - INTERNAL (development environments)',
-    issuer: 'API',
-    start_date_in_millis: 1669680000000,
-  },
-});
+const mockLicense = () => {
+  mockCoreStart.elasticsearch.client.asInternalUser.license.get = jest.fn().mockResolvedValue({
+    license: {
+      status: 'active',
+      uid: 'c5788419-1c6f-424a-9217-da7a0a9151a0',
+      type: 'platinum',
+      issue_date: '2022-11-29T00:00:00.000Z',
+      issue_date_in_millis: 1669680000000,
+      expiry_date: '2024-12-31T23:59:59.999Z',
+      expiry_date_in_millis: 1735689599999,
+      max_nodes: 100,
+      max_resource_units: null,
+      issued_to: 'Elastic - INTERNAL (development environments)',
+      issuer: 'API',
+      start_date_in_millis: 1669680000000,
+    },
+  });
+};
 
 const getFakePayload = (locations: HeartbeatConfig['locations']) => {
   return {
@@ -87,6 +89,16 @@ describe('SyntheticsService', () => {
     savedObjectsClient: savedObjectsClientMock.create()!,
   } as unknown as SyntheticsServerSetup;
 
+  const mockConfig = {
+    service: {
+      devUrl: 'http://localhost',
+      manifestUrl: 'https://test-manifest.com',
+    },
+    enabled: true,
+  };
+
+  mockLicense();
+
   const getMockedService = (locationsNum: number = 1) => {
     const locations = times(locationsNum).map((n) => {
       return {
@@ -101,13 +113,7 @@ describe('SyntheticsService', () => {
         status: LocationStatus.GA,
       };
     });
-    serverMock.config = {
-      service: {
-        devUrl: 'http://localhost',
-        manifestUrl: 'https://test-manifest.com',
-      },
-      enabled: true,
-    };
+    serverMock.config = mockConfig;
     if (serverMock.savedObjectsClient) {
       serverMock.savedObjectsClient.find = jest.fn().mockResolvedValue({
         saved_objects: [
@@ -133,8 +139,10 @@ describe('SyntheticsService', () => {
     const service = new SyntheticsService(serverMock);
 
     service.apiClient.locations = locations;
+    service.locations = locations;
 
     jest.spyOn(service, 'getOutput').mockResolvedValue({ hosts: ['es'], api_key: 'i:k' });
+    jest.spyOn(service, 'getSyntheticsParams').mockResolvedValue({});
 
     return { service, locations };
   };
@@ -222,7 +230,7 @@ describe('SyntheticsService', () => {
       const { service } = getMockedService();
       jest.spyOn(service, 'getOutput').mockRestore();
 
-      serverMock.encryptedSavedObjects = mockEncryptedSO(null) as any;
+      serverMock.encryptedSavedObjects = mockEncryptedSO();
 
       (axios as jest.MockedFunction<typeof axios>).mockResolvedValue({} as AxiosResponse);
 
@@ -240,8 +248,12 @@ describe('SyntheticsService', () => {
       jest.spyOn(service, 'getOutput').mockRestore();
 
       serverMock.encryptedSavedObjects = mockEncryptedSO({
-        attributes: getFakePayload([locations[0]]),
-      }) as any;
+        monitors: [
+          {
+            attributes: getFakePayload([locations[0]]),
+          },
+        ],
+      });
 
       (axios as jest.MockedFunction<typeof axios>).mockResolvedValue({} as AxiosResponse);
 
@@ -309,8 +321,12 @@ describe('SyntheticsService', () => {
       const { service, locations } = getMockedService();
 
       serverMock.encryptedSavedObjects = mockEncryptedSO({
-        attributes: getFakePayload([locations[0]]),
-      }) as any;
+        monitors: [
+          {
+            attributes: getFakePayload([locations[0]]),
+          },
+        ],
+      });
 
       (axios as jest.MockedFunction<typeof axios>).mockResolvedValue({} as AxiosResponse);
 
@@ -357,8 +373,10 @@ describe('SyntheticsService', () => {
           });
 
         serverMock.encryptedSavedObjects = mockEncryptedSO({
-          attributes: getFakePayload([locations[0]]),
-        }) as any;
+          monitors: {
+            attributes: getFakePayload([locations[0]]),
+          },
+        });
 
         (axios as jest.MockedFunction<typeof axios>).mockResolvedValue({} as AxiosResponse);
 
@@ -370,13 +388,18 @@ describe('SyntheticsService', () => {
   describe('getSyntheticsParams', () => {
     it('returns the params for all spaces', async () => {
       const { service } = getMockedService();
+      jest.spyOn(service, 'getSyntheticsParams').mockReset();
 
       (axios as jest.MockedFunction<typeof axios>).mockResolvedValue({} as AxiosResponse);
 
       serverMock.encryptedSavedObjects = mockEncryptedSO({
-        attributes: { key: 'username', value: 'elastic' },
-        namespaces: ['*'],
-      }) as any;
+        params: [
+          {
+            attributes: { key: 'username', value: 'elastic' },
+            namespaces: ['*'],
+          },
+        ],
+      });
 
       const params = await service.getSyntheticsParams();
 
@@ -389,6 +412,16 @@ describe('SyntheticsService', () => {
 
     it('returns the params for specific space', async () => {
       const { service } = getMockedService();
+      jest.spyOn(service, 'getSyntheticsParams').mockReset();
+
+      serverMock.encryptedSavedObjects = mockEncryptedSO({
+        params: [
+          {
+            attributes: { key: 'username', value: 'elastic' },
+            namespaces: ['*'],
+          },
+        ],
+      });
 
       const params = await service.getSyntheticsParams({ spaceId: 'default' });
 
@@ -403,11 +436,16 @@ describe('SyntheticsService', () => {
     });
     it('returns the space limited params', async () => {
       const { service } = getMockedService();
+      jest.spyOn(service, 'getSyntheticsParams').mockReset();
 
       serverMock.encryptedSavedObjects = mockEncryptedSO({
-        attributes: { key: 'username', value: 'elastic' },
-        namespaces: ['default'],
-      }) as any;
+        params: [
+          {
+            attributes: { key: 'username', value: 'elastic' },
+            namespaces: ['default'],
+          },
+        ],
+      });
 
       const params = await service.getSyntheticsParams({ spaceId: 'default' });
 
@@ -418,4 +456,62 @@ describe('SyntheticsService', () => {
       });
     });
   });
+
+  describe('pagination', () => {
+    const service = new SyntheticsService(serverMock);
+
+    const locations = times(5).map((n) => {
+      return {
+        id: `loc-${n}`,
+        label: `Location ${n}`,
+        url: `https://example.com/${n}`,
+        geo: {
+          lat: 0,
+          lon: 0,
+        },
+        isServiceManaged: true,
+        status: LocationStatus.GA,
+      };
+    });
+    service.apiClient.locations = locations;
+    service.locations = locations;
+    jest.spyOn(service, 'getOutput').mockResolvedValue({ hosts: ['es'], api_key: 'i:k' });
+    jest.spyOn(service, 'getSyntheticsParams').mockResolvedValue({});
+
+    it('paginates the results', async () => {
+      serverMock.config = mockConfig;
+
+      mockLicense();
+
+      const syncSpy = jest.spyOn(service.apiClient, 'syncMonitors');
+
+      let num = -1;
+      const data = times(10000).map((n) => {
+        if (num === 4) {
+          num = -1;
+        }
+        num++;
+        if (locations?.[num + 1]) {
+          return {
+            attributes: getFakePayload([locations[num], locations[num + 1]]),
+          };
+        }
+        return {
+          attributes: getFakePayload([locations[num]]),
+        };
+      });
+
+      serverMock.encryptedSavedObjects = mockEncryptedSO({ monitors: data });
+
+      (axios as jest.MockedFunction<typeof axios>).mockResolvedValue({} as AxiosResponse);
+
+      await service.pushConfigs();
+
+      expect(syncSpy).toHaveBeenCalledTimes(72);
+      expect(axios).toHaveBeenCalledTimes(72);
+      expect(logger.debug).toHaveBeenCalledTimes(112);
+      expect(logger.info).toHaveBeenCalledTimes(0);
+      expect(logger.error).toHaveBeenCalledTimes(0);
+    });
+  });
 });
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.ts b/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.ts
index da0434201eaa2..4f5739e933e0a 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/synthetics_service.ts
@@ -7,18 +7,16 @@
 
 /* eslint-disable max-classes-per-file */
 
-import { Logger, SavedObject, ElasticsearchClient } from '@kbn/core/server';
+import { ElasticsearchClient, Logger, SavedObject } from '@kbn/core/server';
 import {
   ConcreteTaskInstance,
   TaskInstance,
   TaskManagerSetupContract,
   TaskManagerStartContract,
 } from '@kbn/task-manager-plugin/server';
-import { concatMap, Subject } from 'rxjs';
-import { EncryptedSavedObjectsClient } from '@kbn/encrypted-saved-objects-plugin/server';
-import pMap from 'p-map';
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common';
 import { ALL_SPACES_ID } from '@kbn/spaces-plugin/common/constants';
+import pMap from 'p-map';
 import { registerCleanUpTask } from './private_location/clean_up_task';
 import { SyntheticsServerSetup } from '../types';
 import { syntheticsMonitorType, syntheticsParamType } from '../../common/types/saved_objects';
@@ -31,11 +29,9 @@ import { ServiceAPIClient, ServiceData } from './service_api_client';
 
 import {
   ConfigKey,
-  EncryptedSyntheticsMonitorAttributes,
   MonitorFields,
   ServiceLocationErrors,
   ServiceLocations,
-  SyntheticsMonitorWithId,
   SyntheticsMonitorWithSecretsAttributes,
   SyntheticsParams,
   ThrottlingOptions,
@@ -279,6 +275,18 @@ export class SyntheticsService {
     return license;
   }
 
+  private async getSOClientFinder({ pageSize }: { pageSize: number }) {
+    const encryptedClient = this.server.encryptedSavedObjects.getClient();
+
+    return await encryptedClient.createPointInTimeFinderDecryptedAsInternalUser<SyntheticsMonitorWithSecretsAttributes>(
+      {
+        type: syntheticsMonitorType,
+        perPage: pageSize,
+        namespaces: [ALL_SPACES_ID],
+      }
+    );
+  }
+
   private getESClient() {
     if (!this.server.coreStart) {
       return;
@@ -373,55 +381,95 @@ export class SyntheticsService {
   async pushConfigs() {
     const license = await this.getLicense();
     const service = this;
-    const subject = new Subject<MonitorFields[]>();
+
+    const PER_PAGE = 250;
+    service.syncErrors = [];
 
     let output: ServiceData['output'] | null = null;
 
-    subject
-      .pipe(
-        concatMap(async (monitors) => {
-          try {
-            if (monitors.length === 0 || !this.config.manifestUrl) {
-              return;
-            }
+    const paramsBySpace = await this.getSyntheticsParams();
+    const finder = await this.getSOClientFinder({ pageSize: PER_PAGE });
 
-            if (!output) {
-              output = await this.getOutput();
+    const bucketsByLocation: Record<string, MonitorFields[]> = {};
+    this.locations.forEach((location) => {
+      bucketsByLocation[location.id] = [];
+    });
 
-              if (!output) {
-                sendErrorTelemetryEvents(service.logger, service.server.telemetry, {
-                  reason: 'API key is not valid.',
-                  message: 'Failed to push configs. API key is not valid.',
-                  type: 'invalidApiKey',
-                  stackVersion: service.server.stackVersion,
-                });
-                return;
-              }
-            }
+    const syncAllLocations = async (perBucket = 0) => {
+      await pMap(
+        this.locations,
+        async (location) => {
+          if (bucketsByLocation[location.id].length > perBucket && output) {
+            const locMonitors = bucketsByLocation[location.id].splice(0, PER_PAGE);
 
-            this.logger.debug(`${monitors.length} monitors will be pushed to synthetics service.`);
+            this.logger.debug(
+              `${locMonitors.length} monitors will be pushed to synthetics service for location ${location.id}.`
+            );
 
-            service.syncErrors = await this.apiClient.syncMonitors({
-              monitors,
+            const syncErrors = await this.apiClient.syncMonitors({
+              monitors: locMonitors,
               output,
               license,
+              location,
             });
-          } catch (e) {
+
+            this.syncErrors = [...(this.syncErrors ?? []), ...(syncErrors ?? [])];
+          }
+        },
+        {
+          stopOnError: false,
+        }
+      );
+    };
+
+    for await (const result of finder.find()) {
+      try {
+        if (!output) {
+          output = await this.getOutput();
+          if (!output) {
             sendErrorTelemetryEvents(service.logger, service.server.telemetry, {
-              reason: 'Failed to push configs to service',
-              message: e?.message,
-              type: 'pushConfigsError',
-              code: e?.code,
-              status: e.status,
+              reason: 'API key is not valid.',
+              message: 'Failed to push configs. API key is not valid.',
+              type: 'invalidApiKey',
               stackVersion: service.server.stackVersion,
             });
-            this.logger.error(e);
+            return;
           }
-        })
-      )
-      .subscribe();
+        }
+
+        const monitors = result.saved_objects.filter(({ error }) => !error);
+        const formattedConfigs = this.normalizeConfigs(monitors, paramsBySpace);
+
+        this.logger.debug(
+          `${formattedConfigs.length} monitors will be pushed to synthetics service.`
+        );
+
+        formattedConfigs.forEach((monitor) => {
+          monitor.locations.forEach((location) => {
+            if (location.isServiceManaged) {
+              bucketsByLocation[location.id]?.push(monitor);
+            }
+          });
+        });
+
+        await syncAllLocations(PER_PAGE);
+      } catch (e) {
+        sendErrorTelemetryEvents(service.logger, service.server.telemetry, {
+          reason: 'Failed to push configs to service',
+          message: e?.message,
+          type: 'pushConfigsError',
+          code: e?.code,
+          status: e.status,
+          stackVersion: service.server.stackVersion,
+        });
+        this.logger.error(e);
+      }
+    }
 
-    await this.getMonitorConfigs(subject);
+    // execute the remaining monitors
+    await syncAllLocations();
+
+    await finder.close();
   }
 
   async runOnceConfigs(configs?: ConfigData) {
@@ -481,123 +529,28 @@ export class SyntheticsService {
 
   async deleteAllConfigs() {
     const license = await this.getLicense();
-    const subject = new Subject<MonitorFields[]>();
-
-    subject
-      .pipe(
-        concatMap(async (monitors) => {
-          const hasPublicLocations = monitors.some((config) =>
-            config.locations.some(({ isServiceManaged }) => isServiceManaged)
-          );
-
-          if (hasPublicLocations) {
-            const output = await this.getOutput();
-            if (!output) {
-              return;
-            }
-
-            const data = {
-              output,
-              monitors,
-              license,
-            };
-            return await this.apiClient.delete(data);
-          }
-        })
-      )
-      .subscribe();
-
-    await this.getMonitorConfigs(subject);
-  }
-
-  async getMonitorConfigs(subject: Subject<MonitorFields[]>) {
-    const soClient = this.server.savedObjectsClient;
-    const encryptedClient = this.server.encryptedSavedObjects.getClient();
-
-    if (!soClient?.find) {
-      return [] as SyntheticsMonitorWithId[];
-    }
-
     const paramsBySpace = await this.getSyntheticsParams();
-
-    const finder = soClient.createPointInTimeFinder<EncryptedSyntheticsMonitorAttributes>({
-      type: syntheticsMonitorType,
-      perPage: 100,
-      namespaces: [ALL_SPACES_ID],
-    });
+    const finder = await this.getSOClientFinder({ pageSize: 100 });
+    const output = await this.getOutput();
+    if (!output) {
+      return;
+    }
 
     for await (const result of finder.find()) {
-      const monitors = await this.decryptMonitors(result.saved_objects, encryptedClient);
-
-      const configDataList: ConfigData[] = (monitors ?? []).map((monitor) => {
-        const attributes = monitor.attributes as unknown as MonitorFields;
-        const monitorSpace = monitor.namespaces?.[0] ?? DEFAULT_SPACE_ID;
-
-        const params = paramsBySpace[monitorSpace];
+      const monitors = this.normalizeConfigs(result.saved_objects, paramsBySpace);
+      const hasPublicLocations = monitors.some((config) =>
+        config.locations.some(({ isServiceManaged }) => isServiceManaged)
+      );
 
-        return {
-          params: { ...params, ...(paramsBySpace?.[ALL_SPACES_ID] ?? {}) },
-          monitor: normalizeSecrets(monitor).attributes,
-          configId: monitor.id,
-          heartbeatId: attributes[ConfigKey.MONITOR_QUERY_ID],
+      if (hasPublicLocations) {
+        const data = {
+          output,
+          monitors,
+          license,
         };
-      });
-
-      const formattedConfigs = this.formatConfigs(configDataList);
-
-      subject.next(formattedConfigs as MonitorFields[]);
+        return await this.apiClient.delete(data);
+      }
     }
-
-    await finder.close();
-  }
-
-  async decryptMonitors(
-    monitors: Array<SavedObject<EncryptedSyntheticsMonitorAttributes>>,
-    encryptedClient: EncryptedSavedObjectsClient
-  ) {
-    const start = performance.now();
-
-    const decryptedMonitors = await pMap(
-      monitors,
-      (monitor) =>
-        new Promise((resolve) => {
-          encryptedClient
-            .getDecryptedAsInternalUser<SyntheticsMonitorWithSecretsAttributes>(
-              syntheticsMonitorType,
-              monitor.id,
-              {
-                namespace: monitor.namespaces?.[0],
-              }
-            )
-            .then((decryptedMonitor) => resolve(decryptedMonitor))
-            .catch((e) => {
-              this.logger.error(e);
-              sendErrorTelemetryEvents(this.logger, this.server.telemetry, {
-                reason: 'Failed to decrypt monitor',
-                message: e?.message,
-                type: 'runTaskError',
-                code: e?.code,
-                status: e.status,
-                stackVersion: this.server.stackVersion,
-              });
-              resolve(null);
-            });
-        })
-    );
-
-    const end = performance.now();
-    const duration = end - start;
-
-    this.logger.debug(`Decrypted ${monitors.length} monitors. Took ${duration} milliseconds`, {
-      event: {
-        duration,
-      },
-      monitors: monitors.length,
-    });
-
-    return decryptedMonitors.filter((monitor) => monitor !== null) as Array<
-      SavedObject<SyntheticsMonitorWithSecretsAttributes>
-    >;
   }
 
   async getSyntheticsParams({
@@ -671,6 +624,27 @@ export class SyntheticsService {
       );
     });
   }
+
+  normalizeConfigs(
+    monitors: Array<SavedObject<SyntheticsMonitorWithSecretsAttributes>>,
+    paramsBySpace: Record<string, Record<string, string>>
+  ) {
+    const configDataList = (monitors ?? []).map((monitor) => {
+      const attributes = monitor.attributes as unknown as MonitorFields;
+      const monitorSpace = monitor.namespaces?.[0] ?? DEFAULT_SPACE_ID;
+
+      const params = paramsBySpace[monitorSpace];
+
+      return {
+        params: { ...params, ...(paramsBySpace?.[ALL_SPACES_ID] ?? {}) },
+        monitor: normalizeSecrets(monitor).attributes,
+        configId: monitor.id,
+        heartbeatId: attributes[ConfigKey.MONITOR_QUERY_ID],
+      };
+    });
+
+    return this.formatConfigs(configDataList) as MonitorFields[];
+  }
 }
 
 class IndexTemplateInstallationError extends Error {
diff --git a/x-pack/plugins/synthetics/server/synthetics_service/utils/mocks.ts b/x-pack/plugins/synthetics/server/synthetics_service/utils/mocks.ts
index f881d242aeb52..b9d6b54961f59 100644
--- a/x-pack/plugins/synthetics/server/synthetics_service/utils/mocks.ts
+++ b/x-pack/plugins/synthetics/server/synthetics_service/utils/mocks.ts
@@ -6,21 +6,54 @@
  */
 
 import { EncryptedSavedObjectsClient } from '@kbn/encrypted-saved-objects-plugin/server';
+import { cloneDeep } from 'lodash';
+import { syntheticsParamType } from '../../../common/types/saved_objects';
 
-export const mockEncryptedSO = (
-  data: any = { attributes: { key: 'username', value: 'elastic' }, namespaces: ['*'] }
-) => ({
-  getClient: jest.fn().mockReturnValue({
-    getDecryptedAsInternalUser: jest.fn().mockResolvedValue(data),
-    createPointInTimeFinderDecryptedAsInternalUser: jest.fn().mockImplementation(() => ({
-      close: jest.fn(),
-      find: jest.fn().mockReturnValue({
-        async *[Symbol.asyncIterator]() {
-          yield {
-            saved_objects: data === null ? [] : [data],
-          };
-        },
-      }),
-    })),
-  } as jest.Mocked<EncryptedSavedObjectsClient>),
-});
+export const mockEncryptedSO = ({
+  monitors = null,
+  params,
+}: { monitors?: any; params?: any } = {}) => {
+  const result = cloneDeep(monitors);
+  const mockParams = params ?? [
+    { attributes: { key: 'username', value: 'elastic' }, namespaces: ['*'] },
+  ];
+  return {
+    isEncryptionError: jest.fn(),
+    getClient: jest.fn().mockReturnValue({
+      getDecryptedAsInternalUser: jest.fn().mockResolvedValue(monitors),
+      createPointInTimeFinderDecryptedAsInternalUser: jest
+        .fn()
+        .mockImplementation(({ perPage, type: soType }) => ({
+          close: jest.fn(),
+          find: jest.fn().mockReturnValue({
+            async *[Symbol.asyncIterator]() {
+              if (soType === syntheticsParamType) {
+                yield {
+                  saved_objects: mockParams,
+                };
+                return;
+              }
+              if (!perPage) {
+                yield {
+                  saved_objects: result,
+                };
+                return;
+              }
+              if (monitors === null) {
+                return;
+              }
+              do {
+                const currentPage = result.splice(0, perPage);
+                if (currentPage.length === 0) {
+                  return;
+                }
+                yield {
+                  saved_objects: currentPage,
+                };
+              } while (result.length > 0);
+            },
+          }),
+        })),
+    } as jest.Mocked<EncryptedSavedObjectsClient>),
+  };
+};
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index c0fd4bd97b876..ec61fc696fd77 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -4792,8 +4792,6 @@
     "presentationUtil.labs.components.titleLabel": "Ateliers",
     "presentationUtil.labs.enableByValueEmbeddableDescription": "Active la prise en charge pour les éléments d'incorporation by-value dans Canvas",
     "presentationUtil.labs.enableByValueEmbeddableName": "Éléments d'incorporation By-Value",
-    "presentationUtil.labs.enableDashboardControlsProjectDescription": "Active le système de contrôles pour le tableau de bord, ce qui permet à ses auteurs de créer plus facilement des éléments interactifs pour leurs utilisateurs.",
-    "presentationUtil.labs.enableDashboardControlsProjectName": "Activer les contrôles pour le tableau de bord",
     "presentationUtil.labs.enableDeferBelowFoldProjectDescription": "Les panneaux sous \"le pli\" (la zone masquée en dessous de la fenêtre accessible en faisant défiler), ne se chargeront pas immédiatement, mais seulement lorsqu'ils entreront dans la fenêtre d'affichage.",
     "presentationUtil.labs.enableDeferBelowFoldProjectName": "Différer le chargement des panneaux sous \"le pli\"",
     "presentationUtil.saveModalDashboard.addToDashboardLabel": "Ajouter au tableau de bord",
@@ -27273,11 +27271,9 @@
     "xpack.observability.slo.sloEdit.createAlert.ruleName": "Règle d'alerte de taux d'avancement du SLO",
     "xpack.observability.slo.sloEdit.createAlert.title": "Créer",
     "xpack.observability.slo.sloEdit.createSloButton": "Créer un SLO",
-    "xpack.observability.slo.sloEdit.customKql.indexSelection.dataViewOptionsLabel": "Sélectionner une vue de données existante",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.helpText": "Utilisez le caractère * pour élargir votre recherche.",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.indexPatternLabel": "Utiliser le modèle d'indexation",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.label": "Index",
-    "xpack.observability.slo.sloEdit.customKql.indexSelection.placeholder": "Sélectionner une vue de données ou utiliser un modèle d’indexation",
     "xpack.observability.slo.sloEdit.dataPreviewChart.xTitle": "Dernière heure",
     "xpack.observability.slo.sloEdit.dataPreviewChart.yTitle": "SLI",
     "xpack.observability.slo.sloEdit.definition.sliType": "Choisir le type de SLI",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 13fb9daea73e0..ecf2b3716ddec 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -4808,8 +4808,6 @@
     "presentationUtil.labs.components.titleLabel": "ラボ",
     "presentationUtil.labs.enableByValueEmbeddableDescription": "キャンバスでby-value埋め込み可能オブジェクトのサポートを有効にします",
     "presentationUtil.labs.enableByValueEmbeddableName": "By-Value埋め込み可能オブジェクト",
-    "presentationUtil.labs.enableDashboardControlsProjectDescription": "ダッシュボードのコントロールシステムを有効にします。これにより、ダッシュボードの作成者は、ユーザー向けのインタラクティブな要素をより簡単に構築できます。",
-    "presentationUtil.labs.enableDashboardControlsProjectName": "ダッシュボードコントロールを有効にする",
     "presentationUtil.labs.enableDeferBelowFoldProjectDescription": "「区切り」の下のすべてのパネル（ウィンドウ下部の下にある非表示の領域）はすぐに読み込まれません。ビューポートを入力するときにのみ読み込まれます",
     "presentationUtil.labs.enableDeferBelowFoldProjectName": "「区切り」の下のパネルの読み込みを延期",
     "presentationUtil.saveModalDashboard.addToDashboardLabel": "ダッシュボードに追加",
@@ -27273,11 +27271,9 @@
     "xpack.observability.slo.sloEdit.createAlert.ruleName": "SLOバーンレートアラートルール",
     "xpack.observability.slo.sloEdit.createAlert.title": "作成",
     "xpack.observability.slo.sloEdit.createSloButton": "SLOの作成",
-    "xpack.observability.slo.sloEdit.customKql.indexSelection.dataViewOptionsLabel": "既存のデータビューを選択",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.helpText": "* で検索クエリの範囲を広げます。",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.indexPatternLabel": "インデックスパターンを使用",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.label": "インデックス",
-    "xpack.observability.slo.sloEdit.customKql.indexSelection.placeholder": "データビューを選択するか、インデックスパターンを使用してください。",
     "xpack.observability.slo.sloEdit.dataPreviewChart.xTitle": "過去 1 時間",
     "xpack.observability.slo.sloEdit.dataPreviewChart.yTitle": "SLI",
     "xpack.observability.slo.sloEdit.definition.sliType": "SLIタイプを選択",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 10c4246523858..65c962b7db7f1 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -4807,8 +4807,6 @@
     "presentationUtil.labs.components.titleLabel": "实验",
     "presentationUtil.labs.enableByValueEmbeddableDescription": "在 Canvas 中启用按值嵌入的支持",
     "presentationUtil.labs.enableByValueEmbeddableName": "按值嵌入",
-    "presentationUtil.labs.enableDashboardControlsProjectDescription": "为仪表板启用控件系统，这允许仪表板作者更轻松地为其用户构建交互式元素。",
-    "presentationUtil.labs.enableDashboardControlsProjectName": "启用仪表板控件",
     "presentationUtil.labs.enableDeferBelowFoldProjectDescription": "“折叠”下的任何面板即可通过滚动访问的窗口底部隐藏的区域，将不会立即加载，而仅在进入视区时加载",
     "presentationUtil.labs.enableDeferBelowFoldProjectName": "推迟加载“折叠”下的面板",
     "presentationUtil.saveModalDashboard.addToDashboardLabel": "添加到仪表板",
@@ -27271,11 +27269,9 @@
     "xpack.observability.slo.sloEdit.createAlert.ruleName": "SLO 消耗速度告警规则",
     "xpack.observability.slo.sloEdit.createAlert.title": "创建",
     "xpack.observability.slo.sloEdit.createSloButton": "创建 SLO",
-    "xpack.observability.slo.sloEdit.customKql.indexSelection.dataViewOptionsLabel": "选择现有数据视图",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.helpText": "使用 * 可扩大您的查询范围。",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.indexPatternLabel": "使用索引模式",
     "xpack.observability.slo.sloEdit.customKql.indexSelection.label": "索引",
-    "xpack.observability.slo.sloEdit.customKql.indexSelection.placeholder": "选择数据视图或使用索引模式",
     "xpack.observability.slo.sloEdit.dataPreviewChart.xTitle": "过去一小时",
     "xpack.observability.slo.sloEdit.dataPreviewChart.yTitle": "SLI",
     "xpack.observability.slo.sloEdit.definition.sliType": "选择 SLI 类型",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_table.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_table.tsx
index 458e14b0b0117..afe42369176db 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_table.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rules_list/components/rules_list_table.tsx
@@ -8,7 +8,6 @@ import React, { useCallback, useMemo, useState } from 'react';
 import moment from 'moment';
 import numeral from '@elastic/numeral';
 import { i18n } from '@kbn/i18n';
-import { AlertConsumers } from '@kbn/rule-data-utils';
 import { useUiSetting$ } from '@kbn/kibana-react-plugin/public';
 import {
   EuiBasicTable,
@@ -482,7 +481,7 @@ export const RulesListTable = (props: RulesListTableProps) => {
         width: '14%',
         'data-test-subj': 'rulesTableCell-rulesListNotify',
         render: (rule: RuleTableItem) => {
-          if (rule.consumer === AlertConsumers.SIEM || !rule.enabled) {
+          if (!rule.enabled) {
             return null;
           }
           return (
diff --git a/x-pack/plugins/watcher/public/application/sections/watch_edit_page/components/json_watch_edit/simulate_watch_results_flyout.tsx b/x-pack/plugins/watcher/public/application/sections/watch_edit_page/components/json_watch_edit/simulate_watch_results_flyout.tsx
index e48202e80c304..a4f156afcc14c 100644
--- a/x-pack/plugins/watcher/public/application/sections/watch_edit_page/components/json_watch_edit/simulate_watch_results_flyout.tsx
+++ b/x-pack/plugins/watcher/public/application/sections/watch_edit_page/components/json_watch_edit/simulate_watch_results_flyout.tsx
@@ -81,6 +81,7 @@ export const SimulateWatchResultsFlyout = ({
       return Object.keys(actions).map((actionKey) => {
         const actionStatus = actionStatuses.find((status) => status.id === actionKey);
         const isConditionMet = executeResults.details?.result?.condition.met;
+
         return {
           actionId: actionKey,
           actionType: getTypeFromAction(actions[actionKey]),
@@ -90,7 +91,7 @@ export const SimulateWatchResultsFlyout = ({
           actionStatus:
             (isConditionMet &&
               executeResults.details.result.actions.find((action: any) => action.id === actionKey)
-                .status) ||
+                ?.status) ||
             conditionNotMetActionStatus(actionModes[actionKey]),
         };
       });
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/actions/connector_types/bedrock.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/actions/connector_types/bedrock.ts
index 8d4412cf37a19..4983d19d36b69 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/actions/connector_types/bedrock.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/actions/connector_types/bedrock.ts
@@ -160,7 +160,7 @@ export default function bedrockTest({ getService }: FtrProviderContext) {
               statusCode: 400,
               error: 'Bad Request',
               message:
-                'error validating action type config: Error configuring AWS Bedrock action: Error: error validating url: target url "http://bedrock.mynonexistent.com" is not added to the Kibana config xpack.actions.allowedHosts',
+                'error validating action type config: Error configuring Amazon Bedrock action: Error: error validating url: target url "http://bedrock.mynonexistent.com" is not added to the Kibana config xpack.actions.allowedHosts',
             });
           });
       });
@@ -280,7 +280,7 @@ export default function bedrockTest({ getService }: FtrProviderContext) {
             status: 'error',
             retry: true,
             message: 'an error occurred while running the action',
-            service_message: `Sub action "invalidAction" is not registered. Connector id: ${bedrockActionId}. Connector name: AWS Bedrock. Connector type: .bedrock`,
+            service_message: `Sub action "invalidAction" is not registered. Connector id: ${bedrockActionId}. Connector name: Amazon Bedrock. Connector type: .bedrock`,
           });
         });
       });
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/bulk_edit.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/bulk_edit.ts
index 9e06b9f73422c..23e05ed530d4a 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/bulk_edit.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/bulk_edit.ts
@@ -422,45 +422,6 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
       });
     });
 
-    it('should ignore bulk snooze and snooze schedule rule for SIEM rules', async () => {
-      const { body: createdRule } = await supertest
-        .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerting/rule`)
-        .set('kbn-xsrf', 'foo')
-        .send(getTestRuleData({ enabled: false, consumer: 'siem' }));
-
-      objectRemover.add(Spaces.space1.id, createdRule.id, 'rule', 'alerting');
-
-      const payload = {
-        ids: [createdRule.id],
-        operations: [
-          {
-            operation: 'set',
-            field: 'snoozeSchedule',
-            value: getSnoozeSchedule(),
-          },
-        ],
-      };
-
-      const bulkSnoozeResponse = await supertest
-        .post(`${getUrlPrefix(Spaces.space1.id)}/internal/alerting/rules/_bulk_edit`)
-        .set('kbn-xsrf', 'foo')
-        .send(payload);
-
-      expect(bulkSnoozeResponse.body.errors).to.have.length(0);
-      expect(bulkSnoozeResponse.body.rules).to.have.length(1);
-      expect(bulkSnoozeResponse.body.rules[0].snooze_schedule).empty();
-      // Ensure revision is NOT updated
-      expect(bulkSnoozeResponse.body.rules[0].revision).to.eql(0);
-
-      // Ensure AAD isn't broken
-      await checkAAD({
-        supertest,
-        spaceId: Spaces.space1.id,
-        type: 'alert',
-        id: createdRule.id,
-      });
-    });
-
     it('should not bulk update API key with apiKey operation', async () => {
       const { body: createdRule } = await supertest
         .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerting/rule`)
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group2/index.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group2/index.ts
deleted file mode 100644
index f477b23e801f3..0000000000000
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group2/index.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrProviderContext } from '../../common/ftr_provider_context';
-
-// eslint-disable-next-line import/no-default-export
-export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('detection engine api security and spaces enabled - Group 2', function () {
-    loadTestFile(require.resolve('./create_endpoint_exceptions'));
-  });
-};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group3/index.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group3/index.ts
deleted file mode 100644
index 73bf2b2669daf..0000000000000
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group3/index.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrProviderContext } from '../../common/ftr_provider_context';
-
-// eslint-disable-next-line import/no-default-export
-export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('detection engine api security and spaces enabled - Group 3', function () {
-    loadTestFile(require.resolve('./exceptions_workflows'));
-  });
-};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/index.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/index.ts
deleted file mode 100644
index 96f53c47441ed..0000000000000
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/index.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrProviderContext } from '../../common/ftr_provider_context';
-
-// eslint-disable-next-line import/no-default-export
-export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('detection engine api security and spaces enabled - Group 7', function () {
-    loadTestFile(require.resolve('./exception_operators_data_types'));
-  });
-};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/index.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/index.ts
deleted file mode 100644
index 7182e411a1332..0000000000000
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/index.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrProviderContext } from '../../common/ftr_provider_context';
-
-// eslint-disable-next-line import/no-default-export
-export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('detection engine api security and spaces enabled - Group 8', function () {
-    loadTestFile(require.resolve('./exception_operators_data_types'));
-  });
-};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/config.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/config.ts
deleted file mode 100644
index 2430b8f2148d9..0000000000000
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/config.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrConfigProviderContext } from '@kbn/test';
-
-// eslint-disable-next-line import/no-default-export
-export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const functionalConfig = await readConfigFile(require.resolve('../config.base.ts'));
-
-  return {
-    ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
-  };
-}
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/index.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/index.ts
deleted file mode 100644
index ad5e427c69df8..0000000000000
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/index.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrProviderContext } from '../../common/ftr_provider_context';
-
-// eslint-disable-next-line import/no-default-export
-export default ({ loadTestFile }: FtrProviderContext): void => {
-  describe('detection engine api security and spaces enabled - Group 9', function () {
-    loadTestFile(require.resolve('./exception_operators_data_types'));
-  });
-};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/prebuilt_rules/fleet_integration.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/prebuilt_rules/fleet_integration.ts
index 1433cb7cac2ff..0683868ae3413 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/prebuilt_rules/fleet_integration.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/prebuilt_rules/fleet_integration.ts
@@ -22,7 +22,8 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const log = getService('log');
 
-  describe('install_prebuilt_rules_from_real_package', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/167056
+  describe.skip('install_prebuilt_rules_from_real_package', () => {
     beforeEach(async () => {
       await deletePrebuiltRulesFleetPackage(supertest);
       await deleteAllRules(supertest, log);
diff --git a/x-pack/test/functional/apps/dashboard/group2/migration_smoke_tests/controls_migration_smoke_test.ts b/x-pack/test/functional/apps/dashboard/group2/migration_smoke_tests/controls_migration_smoke_test.ts
index f2c8d67d16b7e..848be6a783849 100644
--- a/x-pack/test/functional/apps/dashboard/group2/migration_smoke_tests/controls_migration_smoke_test.ts
+++ b/x-pack/test/functional/apps/dashboard/group2/migration_smoke_tests/controls_migration_smoke_test.ts
@@ -55,7 +55,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     });
 
     it('should render all panels on the dashboard', async () => {
-      await dashboardControls.enableControlsLab();
       await dashboard.navigateToApp();
       await dashboard.loadSavedDashboard('[8.0.0] Controls Dashboard');
 
diff --git a/x-pack/test/functional/apps/ml/short_tests/model_management/model_list.ts b/x-pack/test/functional/apps/ml/short_tests/model_management/model_list.ts
index 7d3cf599558f4..5a50a34b4ee17 100644
--- a/x-pack/test/functional/apps/ml/short_tests/model_management/model_list.ts
+++ b/x-pack/test/functional/apps/ml/short_tests/model_management/model_list.ts
@@ -192,21 +192,19 @@ export default function ({ getService }: FtrProviderContext) {
         await ml.testExecution.logTestStep('should display the trained model in the table');
         await ml.trainedModelsTable.filterWithSearchString(modelWithoutPipelineData.modelId, 1);
         await ml.testExecution.logTestStep(
-          'should not show collapsed actions menu for the model in the table'
+          'should show collapsed actions menu for the model in the table'
         );
         await ml.trainedModelsTable.assertModelCollapsedActionsButtonExists(
           modelWithoutPipelineData.modelId,
-          false
+          true
         );
         await ml.testExecution.logTestStep('should show deploy action for the model in the table');
-        await ml.trainedModelsTable.assertModelDeployActionButtonExists(
+        await ml.trainedModelsTable.assertModelDeployActionButtonEnabled(
           modelWithoutPipelineData.modelId,
           true
         );
         await ml.testExecution.logTestStep('should open the deploy model flyout');
-        await ml.trainedModelsTable.openTrainedModelsInferenceFlyout(
-          modelWithoutPipelineData.modelId
-        );
+        await ml.trainedModelsTable.clickDeployAction(modelWithoutPipelineData.modelId);
         await ml.testExecution.logTestStep('should complete the deploy model Details step');
         await ml.deployDFAModelFlyout.completeTrainedModelsInferenceFlyoutDetails({
           name: modelWithoutPipelineDataExpectedValues.name,
@@ -251,17 +249,15 @@ export default function ({ getService }: FtrProviderContext) {
         );
         await ml.trainedModelsTable.assertModelCollapsedActionsButtonExists(
           modelWithoutPipelineData.modelId,
-          false
+          true
         );
         await ml.testExecution.logTestStep('should show deploy action for the model in the table');
         await ml.trainedModelsTable.assertModelDeployActionButtonExists(
           modelWithoutPipelineData.modelId,
-          true
+          false
         );
         await ml.testExecution.logTestStep('should open the deploy model flyout');
-        await ml.trainedModelsTable.openTrainedModelsInferenceFlyout(
-          modelWithoutPipelineData.modelId
-        );
+        await ml.trainedModelsTable.clickDeployAction(modelWithoutPipelineData.modelId);
         await ml.testExecution.logTestStep('should complete the deploy model Details step');
         await ml.deployDFAModelFlyout.completeTrainedModelsInferenceFlyoutDetails(
           {
diff --git a/x-pack/test/functional/config.base.js b/x-pack/test/functional/config.base.js
index 9315b8779fc0c..95849312e17da 100644
--- a/x-pack/test/functional/config.base.js
+++ b/x-pack/test/functional/config.base.js
@@ -51,6 +51,8 @@ export default async function ({ readConfigFile }) {
         '--xpack.discoverEnhanced.actions.exploreDataInContextMenu.enabled=true',
         '--savedObjects.maxImportPayloadBytes=10485760', // for OSS test management/_import_objects,
         '--savedObjects.allowHttpApiAccess=false', // override default to not allow hiddenFromHttpApis saved objects access to the http APIs see https://github.com/elastic/dev/issues/2200
+        // disable fleet task that writes to metrics.fleet_server.* data streams, impacting functional tests
+        `--xpack.task_manager.unsafe.exclude_task_types=${JSON.stringify(['Fleet-Metrics-Task'])}`,
       ],
     },
     uiSettings: {
diff --git a/x-pack/test/functional/services/ml/trained_models_table.ts b/x-pack/test/functional/services/ml/trained_models_table.ts
index 878d1a0d8d1d1..1053d8a990e44 100644
--- a/x-pack/test/functional/services/ml/trained_models_table.ts
+++ b/x-pack/test/functional/services/ml/trained_models_table.ts
@@ -319,15 +319,6 @@ export function TrainedModelsTableProvider(
       await trainedModelsActions.testModelOutput(modelType, inputParams, expectedResult);
     }
 
-    public async openTrainedModelsInferenceFlyout(modelId: string) {
-      await mlCommonUI.invokeTableRowAction(
-        this.rowSelector(modelId),
-        'mlModelsTableRowDeployAction',
-        false
-      );
-      await this.assertDeployModelFlyoutExists();
-    }
-
     public async deleteModel(modelId: string) {
       const fromContextMenu = await this.doesModelCollapsedActionsButtonExist(modelId);
       await mlCommonUI.invokeTableRowAction(
@@ -341,6 +332,33 @@ export function TrainedModelsTableProvider(
       await this.assertModelDisplayedInTable(modelId, false);
     }
 
+    public async assertModelDeployActionButtonEnabled(modelId: string, expectedValue: boolean) {
+      const actionsButtonExists = await this.doesModelCollapsedActionsButtonExist(modelId);
+
+      let isEnabled = null;
+
+      if (actionsButtonExists) {
+        await this.toggleActionsContextMenu(modelId, true);
+        const panelElement = await find.byCssSelector('.euiContextMenuPanel');
+        const actionButton = await panelElement.findByTestSubject('mlModelsTableRowDeployAction');
+        isEnabled = await actionButton.isEnabled();
+        // escape popover
+        await browser.pressKeys(browser.keys.ESCAPE);
+      } else {
+        await this.assertModelDeployActionButtonExists(modelId, true);
+        isEnabled = await testSubjects.isEnabled(
+          this.rowSelector(modelId, 'mlModelsTableRowDeployAction')
+        );
+      }
+
+      expect(isEnabled).to.eql(
+        expectedValue,
+        `Expected row deploy action button for trained model '${modelId}' to be '${
+          expectedValue ? 'enabled' : 'disabled'
+        }' (got '${isEnabled ? 'enabled' : 'disabled'}')`
+      );
+    }
+
     public async assertModelDeleteActionButtonEnabled(modelId: string, expectedValue: boolean) {
       const actionsButtonExists = await this.doesModelCollapsedActionsButtonExist(modelId);
 
@@ -458,6 +476,21 @@ export function TrainedModelsTableProvider(
       await this.assertDeleteModalExists();
     }
 
+    public async clickDeployAction(modelId: string) {
+      const actionsButtonExists = await this.doesModelCollapsedActionsButtonExist(modelId);
+
+      if (actionsButtonExists) {
+        await this.toggleActionsContextMenu(modelId, true);
+        const panelElement = await find.byCssSelector('.euiContextMenuPanel');
+        const actionButton = await panelElement.findByTestSubject('mlModelsTableRowDeployAction');
+        await actionButton.click();
+      } else {
+        await testSubjects.click(this.rowSelector(modelId, 'mlModelsTableRowDeployAction'));
+      }
+
+      await this.assertDeployModelFlyoutExists();
+    }
+
     async assertNumOfAllocations(expectedValue: number) {
       const actualValue = await testSubjects.getAttribute(
         'mlModelsStartDeploymentModalNumOfAllocations',
diff --git a/x-pack/test/functional_with_es_ssl/apps/cases/group1/view_case.ts b/x-pack/test/functional_with_es_ssl/apps/cases/group1/view_case.ts
index b163413ba9ba0..9391c9f1e77db 100644
--- a/x-pack/test/functional_with_es_ssl/apps/cases/group1/view_case.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/cases/group1/view_case.ts
@@ -1154,7 +1154,8 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
       });
     });
 
-    describe('customFields', () => {
+    // FLAKY: https://github.com/elastic/kibana/issues/168534
+    describe.skip('customFields', () => {
       const customFields = [
         {
           key: 'valid_key_1',
diff --git a/x-pack/test/osquery_cypress/artifact_manager.ts b/x-pack/test/osquery_cypress/artifact_manager.ts
index 54b9a70d37aff..0f5ca38d74978 100644
--- a/x-pack/test/osquery_cypress/artifact_manager.ts
+++ b/x-pack/test/osquery_cypress/artifact_manager.ts
@@ -6,5 +6,6 @@
  */
 
 export async function getLatestVersion(): Promise<string> {
-  return '8.11.0-SNAPSHOT';
+  // temporary solution until newer agents work fine with Docker
+  return '8.10.4';
 }
diff --git a/x-pack/test/plugin_api_integration/test_suites/task_manager/check_registered_task_types.ts b/x-pack/test/plugin_api_integration/test_suites/task_manager/check_registered_task_types.ts
index a8ab29da16979..7e48895a9060f 100644
--- a/x-pack/test/plugin_api_integration/test_suites/task_manager/check_registered_task_types.ts
+++ b/x-pack/test/plugin_api_integration/test_suites/task_manager/check_registered_task_types.ts
@@ -45,6 +45,7 @@ export default function ({ getService }: FtrProviderContext) {
         .filter((t: string) => !TEST_TYPES.includes(t))
         .sort();
       expect(types).to.eql([
+        'Fleet-Metrics-Task',
         'Fleet-Usage-Logger',
         'Fleet-Usage-Sender',
         'ML:saved-objects-sync',
diff --git a/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_alerting/index_threshold_rule.ts b/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_alerting/index_threshold_rule.ts
index a09333154bc0e..9ca11a5a2dc45 100644
--- a/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_alerting/index_threshold_rule.ts
+++ b/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_alerting/index_threshold_rule.ts
@@ -79,7 +79,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await testSubjects.click('overExpressionSelect');
       await testSubjects.setValue('overExpressionSelect', 'top');
       await testSubjects.setValue('fieldsNumberSelect', '4');
-      await testSubjects.setValue('fieldsExpressionSelect', 'host.keyword');
+      await comboBox.set('fieldsExpressionSelect', 'host.keyword');
       await commonScreenshots.takeScreenshot(
         'rule-types-index-threshold-example-grouping',
         screenshotDirectories,
@@ -128,6 +128,23 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         1024
       );
 
+      const actionFrequency = await testSubjects.find('summaryOrPerRuleSelect');
+      await actionFrequency.click();
+      const actionSummary = await testSubjects.find('actionNotifyWhen-option-summary');
+      await actionSummary.click();
+      const notifyWhen = await testSubjects.find('notifyWhenSelect');
+      await notifyWhen.click();
+      const customInterval = await testSubjects.find('onThrottleInterval');
+      await customInterval.click();
+      await testSubjects.setValue('throttleInput', '24');
+      await testSubjects.scrollIntoView('addAlertActionButton');
+      await commonScreenshots.takeScreenshot(
+        'rule-types-index-threshold-example-action-summary',
+        screenshotDirectories,
+        1400,
+        1024
+      );
+
       const saveButton = await testSubjects.find('saveRuleButton');
       await saveButton.click();
       const flyOutCancelButton = await testSubjects.find('euiFlyoutCloseButton');
diff --git a/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts b/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
index 3dfa29a28b4de..105701ec61e08 100644
--- a/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
+++ b/x-pack/test/security_solution_api_integration/config/serverless/config.base.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 import { FtrConfigProviderContext } from '@kbn/test';
+// import { ES_RESOURCES } from '@kbn/security-solution-plugin/scripts/endpoint/common/roles_users/serverless';
 
 export interface CreateTestConfigOptions {
   testFiles: string[];
@@ -23,6 +24,9 @@ export function createTestConfig(options: CreateTestConfigOptions) {
         ...svlSharedConfig.get('kbnTestServer'),
         serverArgs: [...svlSharedConfig.get('kbnTestServer.serverArgs'), '--serverless=security'],
       },
+      // esServerlessOptions: {
+      //   resources: Object.values(ES_RESOURCES),
+      // },
       testFiles: options.testFiles,
       junit: options.junit,
 
diff --git a/x-pack/test/security_solution_api_integration/package.json b/x-pack/test/security_solution_api_integration/package.json
index 4cd9e44c89eb6..ed8252f86c2da 100644
--- a/x-pack/test/security_solution_api_integration/package.json
+++ b/x-pack/test/security_solution_api_integration/package.json
@@ -5,9 +5,25 @@
   "private": true,
   "license": "Elastic License 2.0",
   "scripts": {
-    "detectionResponse:server:serverless": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/serverless.config.ts",
-    "detectionResponse:runner:serverless": "node ../../../scripts/functional_test_runner  --config=test_suites/detections_response/serverless.config.ts --grep @serverless --grep  @brokenInServerless --invert",
-    "detectionResponse:server:ess": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/ess.config.ts",
-    "detectionResponse:runner:ess": "node ../../../scripts/functional_test_runner --config=test_suites/detections_response/ess.config.ts --grep @ess"
+    "exception_workflows:server:serverless": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts",
+    "exception_workflows:runner:serverless": "node ../../../scripts/functional_test_runner  --config=test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts --grep @serverless --grep  @brokenInServerless --invert",
+    "exception_workflows:server:ess": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts",
+    "exception_workflows:runner:ess": "node ../../../scripts/functional_test_runner --config=test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts --grep @ess",
+    "exception_operators_date_numeric_types:server:serverless": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts",
+    "exception_operators_date_numeric_types:runner:serverless": "node ../../../scripts/functional_test_runner  --config=test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts --grep @serverless --grep  @brokenInServerless --invert",
+    "exception_operators_date_numeric_types:server:ess": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts",
+    "exception_operators_date_numeric_types:runner:ess": "node ../../../scripts/functional_test_runner --config=test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts --grep @ess",
+    "exception_operators_keyword_text_long:server:serverless": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts",
+    "exception_operators_keyword_text_long:runner:serverless": "node ../../../scripts/functional_test_runner  --config=test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts --grep @serverless --grep  @brokenInServerless --invert",
+    "exception_operators_keyword_text_long:server:ess": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts",
+    "exception_operators_keyword_text_long:runner:ess": "node ../../../scripts/functional_test_runner --config=test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts --grep @ess",
+    "exception_operators_ips_text_array:server:serverless": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts",
+    "exception_operators_ips_text_array:runner:serverless": "node ../../../scripts/functional_test_runner  --config=test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts --grep @serverless --grep  @brokenInServerless --invert",
+    "exception_operators_ips_text_array:server:ess": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts",
+    "exception_operators_ips_text_array:runner:ess": "node ../../../scripts/functional_test_runner --config=test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts --grep @ess",
+    "rule_creation:server:serverless": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts",
+    "rule_creation:runner:serverless": "node ../../../scripts/functional_test_runner  --config=test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts --grep @serverless --grep  @brokenInServerless --invert",
+    "rule_creation:server:ess": "node ../../../scripts/functional_tests_server.js --config ./test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts",
+    "rule_creation:runner:ess": "node ../../../scripts/functional_test_runner --config=test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts --grep @ess"
   }
 }
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group2/config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
similarity index 58%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group2/config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
index 2430b8f2148d9..ec10972a7062e 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group2/config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
@@ -7,12 +7,17 @@
 
 import { FtrConfigProviderContext } from '@kbn/test';
 
-// eslint-disable-next-line import/no-default-export
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const functionalConfig = await readConfigFile(require.resolve('../config.base.ts'));
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../../../config/ess/config.base.trial')
+  );
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName:
+        'Detection Engine ESS/ Exception Operators Data Types API date_numeric_types Integration Tests',
+    },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
new file mode 100644
index 0000000000000..3ec867abab432
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName:
+      'Detection Engine Serverless/ Exception Operators Data Types date_numeric_types API Integration Tests',
+  },
+});
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/date.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/date.ts
similarity index 73%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/date.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/date.ts
index 6e926c7c85d92..3ccad9a60e943 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/date.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/date.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type date', () => {
+  describe('@serverless @ess Rule exception operators for data type date', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/date');
     });
@@ -43,7 +42,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -56,12 +55,12 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the dates from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
           '2020-10-02T05:08:53.000Z',
@@ -71,7 +70,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 1 single date if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -83,9 +82,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
           '2020-10-03T05:08:53.000Z',
@@ -94,7 +93,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 dates if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -114,14 +113,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-03T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
 
       it('should filter 3 dates if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -149,14 +148,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-04T05:08:53.000Z']);
       });
 
       it('should filter 4 dates if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -192,15 +191,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -212,13 +211,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -230,14 +229,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z']);
       });
 
       it('will return 0 results if we exclude two dates', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -257,15 +256,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single date if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -277,9 +276,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
           '2020-10-03T05:08:53.000Z',
@@ -288,7 +287,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 dates if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -300,14 +299,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-03T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
 
       it('should filter 3 dates if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -323,14 +322,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-04T05:08:53.000Z']);
       });
 
       it('should filter 4 dates if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -347,15 +346,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -367,13 +366,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -385,16 +384,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
     });
 
     describe('"exists" operator', () => {
       it('will return 0 results if matching against date', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -405,15 +404,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against date', async () => {
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -424,9 +423,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
           '2020-10-02T05:08:53.000Z',
@@ -439,7 +438,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is in list" operator', () => {
       it('will return 3 results if we have a list that includes 1 date', async () => {
         await importFile(supertest, log, 'date', ['2020-10-01T05:08:53.000Z'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -454,9 +453,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
           '2020-10-03T05:08:53.000Z',
@@ -472,7 +471,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['2020-10-01T05:08:53.000Z', '2020-10-03T05:08:53.000Z'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -487,9 +486,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-02T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
 
@@ -506,7 +505,7 @@ export default ({ getService }: FtrProviderContext) => {
           ],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -521,8 +520,8 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -530,7 +529,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 date', async () => {
         await importFile(supertest, log, 'date', ['2020-10-01T05:08:53.000Z'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -545,9 +544,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z']);
       });
 
@@ -559,7 +558,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['2020-10-01T05:08:53.000Z', '2020-10-03T05:08:53.000Z'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -574,9 +573,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z', '2020-10-03T05:08:53.000Z']);
       });
 
@@ -593,7 +592,7 @@ export default ({ getService }: FtrProviderContext) => {
           ],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['date']);
+        const rule = getRuleForAlertTesting(['date']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -608,9 +607,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
           '2020-10-02T05:08:53.000Z',
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/double.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/double.ts
similarity index 71%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/double.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/double.ts
index 39a878a82f896..20efdb98b631e 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/double.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/double.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type double', () => {
+  describe('@serverless @ess Rule exception operators for data type double', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/double');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/double_as_string');
@@ -47,7 +46,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -60,17 +59,17 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the double from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
 
       it('should filter 1 single double if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -82,14 +81,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
       it('should filter 2 double if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -109,14 +108,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
       it('should filter 3 double if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -144,14 +143,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.3']);
       });
 
       it('should filter 4 double if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -187,15 +186,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -207,13 +206,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -225,14 +224,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0']);
       });
 
       it('will return 0 results if we exclude two double', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -252,15 +251,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single double if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -272,14 +271,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
       it('should filter 2 double if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -291,14 +290,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
       it('should filter 3 double if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -310,14 +309,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.3']);
       });
 
       it('should filter 4 double if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -329,15 +328,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -349,13 +348,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -367,16 +366,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.3']);
       });
     });
 
     describe('"exists" operator', () => {
       it('will return 0 results if matching against double', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -387,15 +386,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against double', async () => {
-        const rule = getRuleForSignalTesting(['double']);
+        const rule = getRuleForAlertTesting(['double']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -406,9 +405,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
     });
@@ -417,7 +416,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against double values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 double', async () => {
           await importFile(supertest, log, 'double', ['1.0'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['double']);
+          const rule = getRuleForAlertTesting(['double']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -432,15 +431,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
         it('will return 2 results if we have a list that includes 2 double', async () => {
           await importFile(supertest, log, 'double', ['1.0', '1.2'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['double']);
+          const rule = getRuleForAlertTesting(['double']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -455,9 +454,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
@@ -469,7 +468,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['1.0', '1.1', '1.2', '1.3'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['double']);
+          const rule = getRuleForAlertTesting(['double']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -484,15 +483,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql([]);
         });
       });
       describe('working against string values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 double', async () => {
           await importFile(supertest, log, 'double', ['1.0'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['double_as_string']);
+          const rule = getRuleForAlertTesting(['double_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -507,15 +506,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
         it('will return 2 results if we have a list that includes 2 double', async () => {
           await importFile(supertest, log, 'double', ['1.0', '1.2'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['double_as_string']);
+          const rule = getRuleForAlertTesting(['double_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -530,9 +529,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
@@ -544,7 +543,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['1.0', '1.1', '1.2', '1.3'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['double_as_string']);
+          const rule = getRuleForAlertTesting(['double_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -559,8 +558,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql([]);
         });
 
@@ -569,7 +568,7 @@ export default ({ getService }: FtrProviderContext) => {
             '1.0',
             '1.2',
           ]);
-          const rule = getRuleForSignalTesting(['double_as_string']);
+          const rule = getRuleForAlertTesting(['double_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -584,9 +583,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.3']);
         });
       });
@@ -596,7 +595,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against double values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 double', async () => {
           await importFile(supertest, log, 'double', ['1.0'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['double']);
+          const rule = getRuleForAlertTesting(['double']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -611,15 +610,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0']);
         });
 
         it('will return 2 results if we have a list that excludes 2 double', async () => {
           await importFile(supertest, log, 'double', ['1.0', '1.2'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['double']);
+          const rule = getRuleForAlertTesting(['double']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -634,9 +633,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
@@ -648,7 +647,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['1.0', '1.1', '1.2', '1.3'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['double']);
+          const rule = getRuleForAlertTesting(['double']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -663,9 +662,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
       });
@@ -673,7 +672,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against string values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 double', async () => {
           await importFile(supertest, log, 'double', ['1.0'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['double_as_string']);
+          const rule = getRuleForAlertTesting(['double_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -688,15 +687,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0']);
         });
 
         it('will return 2 results if we have a list that excludes 2 double', async () => {
           await importFile(supertest, log, 'double', ['1.0', '1.2'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['double_as_string']);
+          const rule = getRuleForAlertTesting(['double_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -711,9 +710,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
@@ -725,7 +724,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['1.0', '1.1', '1.2', '1.3'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['double_as_string']);
+          const rule = getRuleForAlertTesting(['double_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -740,9 +739,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
 
@@ -751,7 +750,7 @@ export default ({ getService }: FtrProviderContext) => {
             '1.0',
             '1.2',
           ]);
-          const rule = getRuleForSignalTesting(['double_as_string']);
+          const rule = getRuleForAlertTesting(['double_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -766,9 +765,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/float.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/float.ts
similarity index 71%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/float.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/float.ts
index e67ae81da2398..25d7d2e83c77f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/float.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/float.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type float', () => {
+  describe('@serverless @ess Rule exception operators for data type float', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/float');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/float_as_string');
@@ -45,7 +44,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -58,17 +57,17 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the float from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
 
       it('should filter 1 single float if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -80,14 +79,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
       it('should filter 2 float if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -107,14 +106,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
       it('should filter 3 float if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -142,14 +141,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.3']);
       });
 
       it('should filter 4 float if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -185,15 +184,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -205,13 +204,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -223,14 +222,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0']);
       });
 
       it('will return 0 results if we exclude two float', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -250,15 +249,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single float if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -270,14 +269,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
       it('should filter 2 float if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -289,14 +288,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
       it('should filter 3 float if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -308,14 +307,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.3']);
       });
 
       it('should filter 4 float if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -327,15 +326,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -347,13 +346,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -365,16 +364,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.3']);
       });
     });
 
     describe('"exists" operator', () => {
       it('will return 0 results if matching against float', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -385,15 +384,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against float', async () => {
-        const rule = getRuleForSignalTesting(['float']);
+        const rule = getRuleForAlertTesting(['float']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -404,9 +403,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
     });
@@ -415,7 +414,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against float values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 float', async () => {
           await importFile(supertest, log, 'float', ['1.0'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float']);
+          const rule = getRuleForAlertTesting(['float']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -430,15 +429,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
         it('will return 2 results if we have a list that includes 2 float', async () => {
           await importFile(supertest, log, 'float', ['1.0', '1.2'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float']);
+          const rule = getRuleForAlertTesting(['float']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -453,15 +452,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
         it('will return 0 results if we have a list that includes all float', async () => {
           await importFile(supertest, log, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float']);
+          const rule = getRuleForAlertTesting(['float']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -476,8 +475,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -485,7 +484,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against string values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 float', async () => {
           await importFile(supertest, log, 'float', ['1.0'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float_as_string']);
+          const rule = getRuleForAlertTesting(['float_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -500,15 +499,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
         it('will return 2 results if we have a list that includes 2 float', async () => {
           await importFile(supertest, log, 'float', ['1.0', '1.2'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float_as_string']);
+          const rule = getRuleForAlertTesting(['float_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -523,15 +522,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
         it('will return 0 results if we have a list that includes all float', async () => {
           await importFile(supertest, log, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float_as_string']);
+          const rule = getRuleForAlertTesting(['float_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -546,8 +545,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql([]);
         });
 
@@ -556,7 +555,7 @@ export default ({ getService }: FtrProviderContext) => {
             '1.0',
             '1.2',
           ]);
-          const rule = getRuleForSignalTesting(['float_as_string']);
+          const rule = getRuleForAlertTesting(['float_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -571,9 +570,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.3']);
         });
       });
@@ -583,7 +582,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against float values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 float', async () => {
           await importFile(supertest, log, 'float', ['1.0'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float']);
+          const rule = getRuleForAlertTesting(['float']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -598,15 +597,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0']);
         });
 
         it('will return 2 results if we have a list that excludes 2 float', async () => {
           await importFile(supertest, log, 'float', ['1.0', '1.2'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float']);
+          const rule = getRuleForAlertTesting(['float']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -621,15 +620,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
         it('will return 4 results if we have a list that excludes all float', async () => {
           await importFile(supertest, log, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float']);
+          const rule = getRuleForAlertTesting(['float']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -644,9 +643,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
       });
@@ -654,7 +653,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against string values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 float', async () => {
           await importFile(supertest, log, 'float', ['1.0'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float_as_string']);
+          const rule = getRuleForAlertTesting(['float_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -669,15 +668,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0']);
         });
 
         it('will return 2 results if we have a list that excludes 2 float', async () => {
           await importFile(supertest, log, 'float', ['1.0', '1.2'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float_as_string']);
+          const rule = getRuleForAlertTesting(['float_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -692,15 +691,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
         it('will return 4 results if we have a list that excludes all float', async () => {
           await importFile(supertest, log, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['float_as_string']);
+          const rule = getRuleForAlertTesting(['float_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -715,9 +714,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
 
@@ -726,7 +725,7 @@ export default ({ getService }: FtrProviderContext) => {
             '1.0',
             '1.2',
           ]);
-          const rule = getRuleForSignalTesting(['float_as_string']);
+          const rule = getRuleForAlertTesting(['float_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -741,9 +740,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/index.ts
similarity index 82%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/index.ts
index 6b2cf915cc51b..2ba798031818e 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/index.ts
@@ -4,10 +4,8 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
-
-// eslint-disable-next-line import/no-default-export
 export default ({ loadTestFile }: FtrProviderContext): void => {
   describe('Detection exceptions data types and operators', function () {
     loadTestFile(require.resolve('./date'));
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/integer.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/integer.ts
similarity index 70%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/integer.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/integer.ts
index 90ce35d24c200..5df6119486113 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/exception_operators_data_types/integer.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/integer.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type integer', () => {
+  describe('@serverless @ess Rule exception operators for data type integer', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/integer');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/integer_as_string');
@@ -47,7 +46,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -60,17 +59,17 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the integer from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
 
       it('should filter 1 single integer if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -82,14 +81,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
       it('should filter 2 integer if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -109,14 +108,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
       it('should filter 3 integer if all 3 are as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -144,14 +143,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['4']);
       });
 
       it('should filter 4 integer if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -187,15 +186,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -207,13 +206,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -225,14 +224,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1']);
       });
 
       it('will return 0 results if we exclude two integer', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -252,15 +251,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single integer if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -272,14 +271,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
       it('should filter 2 integer if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -291,14 +290,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
       it('should filter 3 integer if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -310,14 +309,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['4']);
       });
 
       it('should filter 4 integer if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -329,15 +328,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -349,13 +348,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -367,16 +366,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '4']);
       });
     });
 
     describe('"exists" operator', () => {
       it('will return 0 results if matching against integer', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -387,15 +386,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against integer', async () => {
-        const rule = getRuleForSignalTesting(['integer']);
+        const rule = getRuleForAlertTesting(['integer']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -406,9 +405,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
     });
@@ -417,7 +416,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against integer values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 integer', async () => {
           await importFile(supertest, log, 'integer', ['1'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer']);
+          const rule = getRuleForAlertTesting(['integer']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -432,15 +431,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
         it('will return 2 results if we have a list that includes 2 integer', async () => {
           await importFile(supertest, log, 'integer', ['1', '3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer']);
+          const rule = getRuleForAlertTesting(['integer']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -455,15 +454,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
         it('will return 0 results if we have a list that includes all integer', async () => {
           await importFile(supertest, log, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer']);
+          const rule = getRuleForAlertTesting(['integer']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -478,8 +477,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -487,7 +486,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against string values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 integer', async () => {
           await importFile(supertest, log, 'integer', ['1'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer_as_string']);
+          const rule = getRuleForAlertTesting(['integer_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -502,15 +501,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
         it('will return 2 results if we have a list that includes 2 integer', async () => {
           await importFile(supertest, log, 'integer', ['1', '3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer_as_string']);
+          const rule = getRuleForAlertTesting(['integer_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -525,15 +524,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
         it('will return 0 results if we have a list that includes all integer', async () => {
           await importFile(supertest, log, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer_as_string']);
+          const rule = getRuleForAlertTesting(['integer_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -548,14 +547,14 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql([]);
         });
 
         it('will return 1 result if we have a list which contains the integer range of 1-3', async () => {
           await importFile(supertest, log, 'integer_range', ['1-3'], 'list_items.txt', ['1', '2']);
-          const rule = getRuleForSignalTesting(['integer_as_string']);
+          const rule = getRuleForAlertTesting(['integer_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -570,9 +569,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['4']);
         });
       });
@@ -582,7 +581,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against integer values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 integer', async () => {
           await importFile(supertest, log, 'integer', ['1'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer']);
+          const rule = getRuleForAlertTesting(['integer']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -597,15 +596,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1']);
         });
 
         it('will return 2 results if we have a list that excludes 2 integer', async () => {
           await importFile(supertest, log, 'integer', ['1', '3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer']);
+          const rule = getRuleForAlertTesting(['integer']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -620,15 +619,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
         it('will return 4 results if we have a list that excludes all integer', async () => {
           await importFile(supertest, log, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer']);
+          const rule = getRuleForAlertTesting(['integer']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -643,9 +642,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
       });
@@ -653,7 +652,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against string values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 integer', async () => {
           await importFile(supertest, log, 'integer', ['1'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer_as_string']);
+          const rule = getRuleForAlertTesting(['integer_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -668,15 +667,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1']);
         });
 
         it('will return 2 results if we have a list that excludes 2 integer', async () => {
           await importFile(supertest, log, 'integer', ['1', '3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer_as_string']);
+          const rule = getRuleForAlertTesting(['integer_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -691,15 +690,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
         it('will return 4 results if we have a list that excludes all integer', async () => {
           await importFile(supertest, log, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['integer_as_string']);
+          const rule = getRuleForAlertTesting(['integer_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -714,9 +713,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
 
@@ -726,7 +725,7 @@ export default ({ getService }: FtrProviderContext) => {
             '2',
             '3',
           ]);
-          const rule = getRuleForSignalTesting(['integer_as_string']);
+          const rule = getRuleForAlertTesting(['integer_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -741,9 +740,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
similarity index 59%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group7/config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
index 2430b8f2148d9..221f6d883bd35 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group7/config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
@@ -7,12 +7,17 @@
 
 import { FtrConfigProviderContext } from '@kbn/test';
 
-// eslint-disable-next-line import/no-default-export
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const functionalConfig = await readConfigFile(require.resolve('../config.base.ts'));
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../../../config/ess/config.base.trial')
+  );
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName:
+        'Detection Engine ESS/ Exception Operators Data Types API ips_text_array Integration Tests',
+    },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts
new file mode 100644
index 0000000000000..c81563fdad84b
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName:
+      'Detection Engine Serverless/ Exception Operators Data Types ips_text_array API Integration Tests',
+  },
+});
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/index.ts
similarity index 81%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/index.ts
index 22864980e2653..63f4639a96412 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/index.ts
@@ -5,9 +5,8 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ loadTestFile }: FtrProviderContext): void => {
   describe('Detection exceptions data types and operators', function () {
     loadTestFile(require.resolve('./text_array'));
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/ip.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip.ts
similarity index 71%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/ip.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip.ts
index 43a94d1215958..9e73771d11f09 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/ip.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type ip', () => {
+  describe('@serverless @ess Rule exception operators for data type ip', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/ip');
     });
@@ -43,7 +42,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -56,17 +55,17 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the ips from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 1 single ip if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -78,14 +77,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 2 ips if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -105,14 +104,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 3 ips if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -140,14 +139,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
       it('should filter 4 ips if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -183,13 +182,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('should filter a CIDR range of "127.0.0.1/30"', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -201,16 +200,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -222,13 +221,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -240,14 +239,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1']);
       });
 
       it('will return 0 results if we exclude two ips', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -267,15 +266,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single ip if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -287,14 +286,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 2 ips if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -306,14 +305,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 3 ips if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -325,14 +324,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
       it('should filter 4 ips if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -344,15 +343,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -364,13 +363,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -382,16 +381,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.4']);
       });
     });
 
     describe('"exists" operator', () => {
       it('will return 0 results if matching against ip', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -402,15 +401,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against ip', async () => {
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -421,9 +420,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
     });
@@ -431,7 +430,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is in list" operator', () => {
       it('will return 3 results if we have a list that includes 1 ip', async () => {
         await importFile(supertest, log, 'ip', ['127.0.0.1'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -446,15 +445,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('will return 2 results if we have a list that includes 2 ips', async () => {
         await importFile(supertest, log, 'ip', ['127.0.0.1', '127.0.0.3'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -469,9 +468,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.4']);
       });
 
@@ -483,7 +482,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -498,8 +497,8 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
@@ -509,7 +508,7 @@ export default ({ getService }: FtrProviderContext) => {
           '127.0.0.2',
           '127.0.0.3',
         ]);
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -524,9 +523,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
@@ -536,7 +535,7 @@ export default ({ getService }: FtrProviderContext) => {
           '127.0.0.2',
           '127.0.0.3',
         ]);
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -551,9 +550,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
@@ -566,7 +565,7 @@ export default ({ getService }: FtrProviderContext) => {
           'list_items.txt',
           ['127.0.0.1', '127.0.0.2', '127.0.0.3']
         );
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -581,9 +580,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
     });
@@ -591,7 +590,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 ip', async () => {
         await importFile(supertest, log, 'ip', ['127.0.0.1'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -606,15 +605,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1']);
       });
 
       it('will return 2 results if we have a list that excludes 2 ips', async () => {
         await importFile(supertest, log, 'ip', ['127.0.0.1', '127.0.0.3'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -629,9 +628,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.3']);
       });
 
@@ -643,7 +642,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -658,9 +657,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
@@ -670,7 +669,7 @@ export default ({ getService }: FtrProviderContext) => {
           '127.0.0.2',
           '127.0.0.3',
         ]);
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -685,9 +684,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3']);
       });
 
@@ -697,7 +696,7 @@ export default ({ getService }: FtrProviderContext) => {
           '127.0.0.2',
           '127.0.0.3',
         ]);
-        const rule = getRuleForSignalTesting(['ip']);
+        const rule = getRuleForAlertTesting(['ip']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -712,9 +711,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3']);
       });
     });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/ip_array.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip_array.ts
similarity index 71%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/ip_array.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip_array.ts
index 0fcdf1a03b14b..12c4eb6d55368 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/ip_array.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/ip_array.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type ip', () => {
+  describe('@serverless @ess Rule exception operators for data type ip', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/ip_as_array');
     });
@@ -43,7 +42,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -56,12 +55,12 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the ips from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
@@ -71,7 +70,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 1 single ip if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -83,9 +82,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -94,7 +93,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 ips if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -114,14 +113,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
       it('should filter 3 ips if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -149,14 +148,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips.flat(10)).to.eql([]);
       });
 
       it('should filter a CIDR range of "127.0.0.1/30"', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -168,9 +167,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -179,7 +178,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter a CIDR range of "127.0.0.4/31"', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -191,16 +190,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -212,13 +211,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -230,14 +229,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
       it('will return just 1 result we excluded 2 from the same array elements', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -255,14 +254,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
       it('will return 0 results if we exclude two ips', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -282,15 +281,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single ip if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -302,9 +301,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -313,7 +312,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 ips if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -325,14 +324,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
       it('should filter 3 ips if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -344,16 +343,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips.flat(10)).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -365,13 +364,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -383,9 +382,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -395,7 +394,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"exists" operator', () => {
       it('will return 1 empty result if matching against ip', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -406,16 +405,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips.flat(10)).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 3 results if matching against ip', async () => {
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -426,9 +425,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -440,7 +439,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is in list" operator', () => {
       it('will return 3 results if we have a list that includes 1 ip', async () => {
         await importFile(supertest, log, 'ip', ['127.0.0.1'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -455,9 +454,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -467,7 +466,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('will return 2 results if we have a list that includes 2 ips', async () => {
         await importFile(supertest, log, 'ip', ['127.0.0.1', '127.0.0.5'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -482,9 +481,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
@@ -496,7 +495,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['127.0.0.1', '127.0.0.5', '127.0.0.8'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -511,9 +510,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips.flat(10)).to.eql([]);
       });
 
@@ -534,7 +533,7 @@ export default ({ getService }: FtrProviderContext) => {
             '127.0.0.7',
           ]
         );
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -549,9 +548,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
@@ -565,7 +564,7 @@ export default ({ getService }: FtrProviderContext) => {
           '127.0.0.6',
           '127.0.0.7',
         ]);
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -580,9 +579,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
     });
@@ -590,7 +589,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 ip', async () => {
         await importFile(supertest, log, 'ip', ['127.0.0.1'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -605,15 +604,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
       it('will return 2 results if we have a list that excludes 2 ips', async () => {
         await importFile(supertest, log, 'ip', ['127.0.0.1', '127.0.0.5'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -628,9 +627,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -645,7 +644,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['127.0.0.1', '127.0.0.5', '127.0.0.8'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -660,9 +659,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -687,7 +686,7 @@ export default ({ getService }: FtrProviderContext) => {
             '127.0.0.7',
           ]
         );
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -702,9 +701,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -721,7 +720,7 @@ export default ({ getService }: FtrProviderContext) => {
           '127.0.0.6',
           '127.0.0.7',
         ]);
-        const rule = getRuleForSignalTesting(['ip_as_array']);
+        const rule = getRuleForAlertTesting(['ip_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -736,9 +735,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const ips = alertsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/text_array.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/text_array.ts
similarity index 71%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/text_array.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/text_array.ts
index fe4a13fcc3c84..915d353281f66 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group9/exception_operators_data_types/text_array.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/text_array.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type text', () => {
+  describe('@serverless @ess Rule exception operators for data type text', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/text_as_array');
     });
@@ -43,7 +42,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -56,12 +55,12 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the text from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -71,7 +70,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 1 single text if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -83,9 +82,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -94,7 +93,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 text if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -114,14 +113,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
       it('should filter 3 text if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -149,16 +148,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -170,13 +169,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -188,14 +187,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 0 results if we exclude two text', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -215,15 +214,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single text if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -235,9 +234,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -246,7 +245,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 text if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -258,14 +257,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
       it('should filter 3 text if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -277,16 +276,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -298,13 +297,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -316,9 +315,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -328,7 +327,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"exists" operator', () => {
       it('will return 1 results if matching against text for the empty array', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -339,16 +338,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 3 results if matching against text', async () => {
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -359,9 +358,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
@@ -374,7 +373,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 4 results if we have two lists with an AND contradiction text === "word one" AND text === "word five"', async () => {
         await importFile(supertest, log, 'text', ['word one'], 'list_items_1.txt');
         await importFile(supertest, log, 'text', ['word five'], 'list_items_2.txt');
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -398,9 +397,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -412,7 +411,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 3 results if we have two lists with an AND text === "word one" AND text === "word two" since we have an array', async () => {
         await importFile(supertest, log, 'text', ['word one'], 'list_items_1.txt');
         await importFile(supertest, log, 'text', ['word two'], 'list_items_2.txt');
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -436,9 +435,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -448,7 +447,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('will return 3 results if we have a list that includes 1 text', async () => {
         await importFile(supertest, log, 'text', ['word one'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -463,9 +462,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -475,7 +474,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('will return 2 results if we have a list that includes 2 text', async () => {
         await importFile(supertest, log, 'text', ['word one', 'word six'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -490,9 +489,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
@@ -504,7 +503,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['word one', 'word five', 'word eight'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -519,9 +518,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
@@ -529,7 +528,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 text', async () => {
         await importFile(supertest, log, 'text', ['word one'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -544,15 +543,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 1 result if we have a list that excludes 1 text but repeat 2 elements from the array in the list', async () => {
         await importFile(supertest, log, 'text', ['word one', 'word two'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -567,15 +566,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 2 results if we have a list that excludes 2 text', async () => {
         await importFile(supertest, log, 'text', ['word one', 'word five'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -590,9 +589,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -607,7 +606,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['word one', 'word six', 'word ten'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['text_as_array']);
+        const rule = getRuleForAlertTesting(['text_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -622,9 +621,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
similarity index 58%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group8/config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
index 2430b8f2148d9..b968919430064 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
@@ -7,12 +7,17 @@
 
 import { FtrConfigProviderContext } from '@kbn/test';
 
-// eslint-disable-next-line import/no-default-export
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const functionalConfig = await readConfigFile(require.resolve('../config.base.ts'));
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../../../config/ess/config.base.trial')
+  );
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName:
+        'Detection Engine ESS/ Exception Operators Data Types API keyword_text_long Integration Tests',
+    },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
new file mode 100644
index 0000000000000..daf867a3a6839
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName:
+      'Detection Engine Serverless/ Exception Operators Data Types keyword_text_long API Integration Tests',
+  },
+});
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/index.ts
similarity index 82%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/index.ts
index cf87276aac3ae..ad0a5d847b0fd 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/index.ts
@@ -5,9 +5,8 @@
  * 2.0.
  */
 
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ loadTestFile }: FtrProviderContext): void => {
   describe('Detection exceptions data types and operators', function () {
     loadTestFile(require.resolve('./keyword'));
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/keyword.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword.ts
similarity index 70%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/keyword.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword.ts
index 2487fbcb7ab44..11289a31b1242 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/keyword.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type keyword', () => {
+  describe('@serverless @ess Rule exception operators for data type keyword', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/keyword');
     });
@@ -43,7 +42,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -56,17 +55,17 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the keyword from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('should filter 1 single keyword if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -78,14 +77,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -105,14 +104,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -140,14 +139,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should filter 4 keyword if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -183,15 +182,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -203,13 +202,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -221,14 +220,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('will return 0 results if we exclude two keyword', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -248,15 +247,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single keyword if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -268,14 +267,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -287,14 +286,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -306,14 +305,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should filter 4 keyword if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -325,15 +324,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -345,13 +344,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -363,16 +362,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one']);
       });
     });
 
     describe('"exists" operator', () => {
       it('will return 0 results if matching against keyword', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -383,15 +382,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against keyword', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -402,9 +401,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
     });
@@ -413,7 +412,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 4 results if we have two lists with an AND contradiction keyword === "word one" AND keyword === "word two"', async () => {
         await importFile(supertest, log, 'keyword', ['word one'], 'list_items_1.txt');
         await importFile(supertest, log, 'keyword', ['word two'], 'list_items_2.txt');
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -437,15 +436,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('will return 3 results if we have a list that includes 1 keyword', async () => {
         await importFile(supertest, log, 'keyword', ['word one'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -460,15 +459,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('will return 2 results if we have a list that includes 2 keyword', async () => {
         await importFile(supertest, log, 'keyword', ['word one', 'word three'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -483,9 +482,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word two']);
       });
 
@@ -497,7 +496,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['word one', 'word two', 'word three', 'word four'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -512,8 +511,8 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -521,7 +520,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 keyword', async () => {
         await importFile(supertest, log, 'keyword', ['word one'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -536,15 +535,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('will return 2 results if we have a list that excludes 2 keyword', async () => {
         await importFile(supertest, log, 'keyword', ['word one', 'word three'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -559,9 +558,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one', 'word three']);
       });
 
@@ -573,7 +572,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['word one', 'word two', 'word three', 'word four'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -588,16 +587,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
     });
 
     describe('"matches wildcard" operator', () => {
       it('should return 0 alerts if wildcard matches all words', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -610,13 +609,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('should return 1 alert if wildcard exceptions match one, two, and three', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -637,14 +636,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should return 3 alerts if one is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -657,14 +656,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should return 4 alerts if the wildcard matches nothing', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -676,16 +675,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
     });
 
     describe('"does not match wildcard" operator', () => {
       it('should return 4 results if excluded wildcard matches all 4 words', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -698,14 +697,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('should filter in 2 keywords if using a wildcard exception', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -718,14 +717,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word three', 'word two']);
       });
 
       it('should return 1 alert if "word one" is excluded', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -738,14 +737,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('should return 0 alerts if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['keyword']);
+        const rule = getRuleForAlertTesting(['keyword']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -757,8 +756,8 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/keyword_array.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword_array.ts
similarity index 70%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/keyword_array.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword_array.ts
index ff3611b4ab583..58f41321e7a86 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/keyword_array.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/keyword_array.ts
@@ -12,28 +12,28 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
+
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type keyword', () => {
+  describe('@serverless @ess Rule exception operators for data type keyword', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/keyword_as_array');
     });
@@ -45,7 +45,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -58,12 +58,12 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the keyword from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -73,7 +73,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 1 single keyword if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -85,9 +85,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -96,7 +96,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -116,14 +116,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -151,16 +151,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -172,13 +172,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -190,14 +190,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 0 results if we exclude two keyword', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -217,15 +217,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single keyword if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -237,9 +237,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -248,7 +248,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -260,14 +260,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -279,16 +279,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -300,13 +300,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -318,9 +318,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -330,7 +330,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"exists" operator', () => {
       it('will return 1 results if matching against keyword for the empty array', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -341,16 +341,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 3 results if matching against keyword', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -361,9 +361,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
@@ -376,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 4 results if we have two lists with an AND contradiction keyword === "word one" AND keyword === "word five"', async () => {
         await importFile(supertest, log, 'keyword', ['word one'], 'list_items_1.txt');
         await importFile(supertest, log, 'keyword', ['word five'], 'list_items_2.txt');
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -400,9 +400,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -414,7 +414,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 3 results if we have two lists with an AND keyword === "word one" AND keyword === "word two" since we have an array', async () => {
         await importFile(supertest, log, 'keyword', ['word one'], 'list_items_1.txt');
         await importFile(supertest, log, 'keyword', ['word two'], 'list_items_2.txt');
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -438,9 +438,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -450,7 +450,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('will return 3 results if we have a list that includes 1 keyword', async () => {
         await importFile(supertest, log, 'keyword', ['word one'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -465,9 +465,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -477,7 +477,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('will return 2 results if we have a list that includes 2 keyword', async () => {
         await importFile(supertest, log, 'keyword', ['word one', 'word six'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -492,9 +492,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
@@ -506,7 +506,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['word one', 'word five', 'word eight'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -521,9 +521,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
@@ -531,7 +531,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 keyword', async () => {
         await importFile(supertest, log, 'keyword', ['word one'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -546,15 +546,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 1 result if we have a list that excludes 1 keyword but repeat 2 elements from the array in the list', async () => {
         await importFile(supertest, log, 'keyword', ['word one', 'word two'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -569,15 +569,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 2 results if we have a list that excludes 2 keyword', async () => {
         await importFile(supertest, log, 'keyword', ['word one', 'word five'], 'list_items.txt');
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -592,9 +592,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -609,7 +609,7 @@ export default ({ getService }: FtrProviderContext) => {
           ['word one', 'word six', 'word ten'],
           'list_items.txt'
         );
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -624,9 +624,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
@@ -637,7 +637,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"matches wildcard" operator', () => {
       it('should filter 1 single keyword if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -649,9 +649,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -660,7 +660,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -672,14 +672,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word five', null, 'word six', 'word seven']]);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -691,16 +691,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(10)).to.eql([]);
       });
     });
 
     describe('"does not match wildcard" operator', () => {
       it('should filter 1 single keyword if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -712,14 +712,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -731,9 +731,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -741,7 +741,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['keyword_as_array']);
+        const rule = getRuleForAlertTesting(['keyword_as_array']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -753,9 +753,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/long.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/long.ts
similarity index 71%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/long.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/long.ts
index 93005464a8fe7..69803854e9306 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/long.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/long.ts
@@ -12,28 +12,27 @@ import {
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type long', () => {
+  describe('@serverless @ess Rule exception operators for data type long', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/long');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/long_as_string');
@@ -45,7 +44,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -58,17 +57,17 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the long from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
 
       it('should filter 1 single long if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -80,14 +79,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
       it('should filter 2 long if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -107,14 +106,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
       it('should filter 3 long if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -142,14 +141,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['4']);
       });
 
       it('should filter 4 long if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -185,15 +184,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -205,13 +204,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -223,14 +222,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1']);
       });
 
       it('will return 0 results if we exclude two long', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -250,15 +249,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single long if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -270,14 +269,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
       it('should filter 2 long if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -289,14 +288,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
       it('should filter 3 long if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -308,14 +307,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['4']);
       });
 
       it('should filter 4 long if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -327,15 +326,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -347,13 +346,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -365,16 +364,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '4']);
       });
     });
 
     describe('"exists" operator', () => {
       it('will return 0 results if matching against long', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -385,15 +384,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against long', async () => {
-        const rule = getRuleForSignalTesting(['long']);
+        const rule = getRuleForAlertTesting(['long']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -404,9 +403,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
     });
@@ -415,7 +414,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against long values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 long', async () => {
           await importFile(supertest, log, 'long', ['1'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long']);
+          const rule = getRuleForAlertTesting(['long']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -430,15 +429,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
         it('will return 2 results if we have a list that includes 2 long', async () => {
           await importFile(supertest, log, 'long', ['1', '3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long']);
+          const rule = getRuleForAlertTesting(['long']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -453,15 +452,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
         it('will return 0 results if we have a list that includes all long', async () => {
           await importFile(supertest, log, 'long', ['1', '2', '3', '4'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long']);
+          const rule = getRuleForAlertTesting(['long']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -476,8 +475,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -485,7 +484,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against string values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 long', async () => {
           await importFile(supertest, log, 'long', ['1'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long_as_string']);
+          const rule = getRuleForAlertTesting(['long_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -500,15 +499,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
         it('will return 2 results if we have a list that includes 2 long', async () => {
           await importFile(supertest, log, 'long', ['1', '3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long_as_string']);
+          const rule = getRuleForAlertTesting(['long_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -523,15 +522,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
         it('will return 0 results if we have a list that includes all long', async () => {
           await importFile(supertest, log, 'long', ['1', '2', '3', '4'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long_as_string']);
+          const rule = getRuleForAlertTesting(['long_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -546,8 +545,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql([]);
         });
 
@@ -557,7 +556,7 @@ export default ({ getService }: FtrProviderContext) => {
             '2',
             '3',
           ]);
-          const rule = getRuleForSignalTesting(['long_as_string']);
+          const rule = getRuleForAlertTesting(['long_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -572,9 +571,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['4']);
         });
       });
@@ -584,7 +583,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against long values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 long', async () => {
           await importFile(supertest, log, 'long', ['1'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long']);
+          const rule = getRuleForAlertTesting(['long']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -599,15 +598,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1']);
         });
 
         it('will return 2 results if we have a list that excludes 2 long', async () => {
           await importFile(supertest, log, 'long', ['1', '3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long']);
+          const rule = getRuleForAlertTesting(['long']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -622,15 +621,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
         it('will return 4 results if we have a list that excludes all long', async () => {
           await importFile(supertest, log, 'long', ['1', '2', '3', '4'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long']);
+          const rule = getRuleForAlertTesting(['long']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -645,9 +644,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
       });
@@ -655,7 +654,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against string values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 long', async () => {
           await importFile(supertest, log, 'long', ['1'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long_as_string']);
+          const rule = getRuleForAlertTesting(['long_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -670,15 +669,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1']);
         });
 
         it('will return 2 results if we have a list that excludes 2 long', async () => {
           await importFile(supertest, log, 'long', ['1', '3'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long_as_string']);
+          const rule = getRuleForAlertTesting(['long_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -693,15 +692,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
         it('will return 4 results if we have a list that excludes all long', async () => {
           await importFile(supertest, log, 'long', ['1', '2', '3', '4'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['long_as_string']);
+          const rule = getRuleForAlertTesting(['long_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -716,9 +715,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
 
@@ -728,7 +727,7 @@ export default ({ getService }: FtrProviderContext) => {
             '2',
             '3',
           ]);
-          const rule = getRuleForSignalTesting(['long_as_string']);
+          const rule = getRuleForAlertTesting(['long_as_string']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -743,9 +742,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/text.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/text.ts
similarity index 71%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/text.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/text.ts
index 81ccdcc8fa7f2..df7a42dc88de2 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/text.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/text.ts
@@ -13,28 +13,27 @@ import {
   deleteListsIndex,
   importFile,
   importTextFile,
-} from '../../../../lists_api_integration/utils';
-import { FtrProviderContext } from '../../../common/ftr_provider_context';
+} from '../../../../../../../lists_api_integration/utils';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../../utils';
+  waitForAlertsToBePresent,
+} from '../../../../utils';
+import { FtrProviderContext } from '../../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
 
-  describe('Rule exception operators for data type text', () => {
+  describe('@serverless @ess Rule exception operators for data type text', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/text');
       await esArchiver.load('x-pack/test/functional/es_archives/rule_exceptions/text_no_spaces');
@@ -46,7 +45,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -59,17 +58,17 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should find all the text from the data set when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('should filter 1 single text if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -81,14 +80,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter 2 text if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -108,14 +107,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
       it('should filter 3 text if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -143,14 +142,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should filter 4 text if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -186,13 +185,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('should filter 1 single text using a single word', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -204,14 +203,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter all words using a common piece of text', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -223,13 +222,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('should filter 1 single text with punctuation added', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -241,16 +240,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
     });
 
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -262,13 +261,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -280,14 +279,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('will return 0 results if we exclude two text', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -307,13 +306,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('should filter 1 single text using a single word', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -325,14 +324,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('should filter all words using a common piece of text', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -344,14 +343,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('should filter 1 single text with punctuation added', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -363,16 +362,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
     });
 
     describe('"is one of" operator', () => {
       it('should filter 1 single text if it is set as an exception', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -384,14 +383,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter 2 text if both are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -403,14 +402,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
       it('should filter 3 text if all 3 are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -422,14 +421,14 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should filter 4 text if all are set as exceptions', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -441,15 +440,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -461,13 +460,13 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -479,16 +478,16 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one']);
       });
     });
 
     describe('"exists" operator', () => {
       it('will return 0 results if matching against text', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -499,15 +498,15 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
     });
 
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against text', async () => {
-        const rule = getRuleForSignalTesting(['text']);
+        const rule = getRuleForAlertTesting(['text']);
         const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
@@ -518,9 +517,9 @@ export default ({ getService }: FtrProviderContext) => {
           ],
         ]);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, log, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
+        const alertsOpen = await getAlertsById(supertest, log, id);
+        const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
     });
@@ -529,7 +528,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against text values without spaces', () => {
         it('will return 3 results if we have a list that includes 1 text', async () => {
           await importFile(supertest, log, 'text', ['one'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['text_no_spaces']);
+          const rule = getRuleForAlertTesting(['text_no_spaces']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -544,15 +543,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'three', 'two']);
         });
 
         it('will return 2 results if we have a list that includes 2 text', async () => {
           await importFile(supertest, log, 'text', ['one', 'three'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['text_no_spaces']);
+          const rule = getRuleForAlertTesting(['text_no_spaces']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -567,9 +566,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'two']);
         });
 
@@ -581,7 +580,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['one', 'two', 'three', 'four'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['text_no_spaces']);
+          const rule = getRuleForAlertTesting(['text_no_spaces']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -596,8 +595,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -605,7 +604,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against text values with spaces', () => {
         it('will return 3 results if we have a list that includes 1 text', async () => {
           await importTextFile(supertest, log, 'text', ['word one'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['text']);
+          const rule = getRuleForAlertTesting(['text']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -620,9 +619,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word three', 'word two']);
         });
 
@@ -634,7 +633,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['word one additional wording'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['text']);
+          const rule = getRuleForAlertTesting(['text']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -649,15 +648,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word three', 'word two']);
         });
 
         it('will return 2 results if we have a list that includes 2 text', async () => {
           await importFile(supertest, log, 'text', ['word one', 'word three'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['text']);
+          const rule = getRuleForAlertTesting(['text']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -672,9 +671,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word two']);
         });
 
@@ -686,7 +685,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['word one', 'word two', 'word three', 'word four'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['text']);
+          const rule = getRuleForAlertTesting(['text']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -701,8 +700,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -712,7 +711,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against text values without spaces', () => {
         it('will return 1 result if we have a list that excludes 1 text', async () => {
           await importTextFile(supertest, log, 'text', ['one'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['text_no_spaces']);
+          const rule = getRuleForAlertTesting(['text_no_spaces']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -727,15 +726,15 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['one']);
         });
 
         it('will return 2 results if we have a list that excludes 2 text', async () => {
           await importTextFile(supertest, log, 'text', ['one', 'three'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['text_no_spaces']);
+          const rule = getRuleForAlertTesting(['text_no_spaces']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -750,9 +749,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['one', 'three']);
         });
 
@@ -764,7 +763,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['one', 'two', 'three', 'four'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['text_no_spaces']);
+          const rule = getRuleForAlertTesting(['text_no_spaces']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -779,9 +778,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'one', 'three', 'two']);
         });
       });
@@ -789,7 +788,7 @@ export default ({ getService }: FtrProviderContext) => {
       describe('working against text values with spaces', () => {
         it('will return 1 result if we have a list that excludes 1 text', async () => {
           await importTextFile(supertest, log, 'text', ['word one'], 'list_items.txt');
-          const rule = getRuleForSignalTesting(['text']);
+          const rule = getRuleForAlertTesting(['text']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -804,9 +803,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one']);
         });
 
@@ -818,7 +817,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['word one additional wording'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['text']);
+          const rule = getRuleForAlertTesting(['text']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -833,9 +832,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 1, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one']);
         });
 
@@ -847,7 +846,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['word one', 'word three'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['text']);
+          const rule = getRuleForAlertTesting(['text']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -862,9 +861,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one', 'word three']);
         });
 
@@ -876,7 +875,7 @@ export default ({ getService }: FtrProviderContext) => {
             ['word one', 'word two', 'word three', 'word four'],
             'list_items.txt'
           );
-          const rule = getRuleForSignalTesting(['text']);
+          const rule = getRuleForAlertTesting(['text']);
           const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
@@ -891,9 +890,9 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           ]);
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, log, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
+          const alertsOpen = await getAlertsById(supertest, log, id);
+          const hits = alertsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group3/config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
similarity index 62%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group3/config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
index 2430b8f2148d9..19391784466d3 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group3/config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
@@ -7,12 +7,16 @@
 
 import { FtrConfigProviderContext } from '@kbn/test';
 
-// eslint-disable-next-line import/no-default-export
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
-  const functionalConfig = await readConfigFile(require.resolve('../config.base.ts'));
+  const functionalConfig = await readConfigFile(
+    require.resolve('../../../../../../config/ess/config.base.trial')
+  );
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    testFiles: [require.resolve('..')],
+    junit: {
+      reportName: 'Detection Engine ESS/ Exception Workflows API Integration Tests',
+    },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts
new file mode 100644
index 0000000000000..1702c03591b64
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../../../../../config/serverless/config.base';
+
+export default createTestConfig({
+  testFiles: [require.resolve('..')],
+  junit: {
+    reportName: 'Detection Engine Serverless/ Exception Workflows API Integration Tests',
+  },
+});
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group2/create_endpoint_exceptions.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_endpoint_exceptions.ts
similarity index 75%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group2/create_endpoint_exceptions.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_endpoint_exceptions.ts
index a9ee0dc7c182c..1c647fe52810c 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group2/create_endpoint_exceptions.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_endpoint_exceptions.ts
@@ -9,30 +9,24 @@ import { ToolingLog } from '@kbn/tooling-log';
 import expect from 'expect';
 
 import type SuperTest from 'supertest';
-import { ROLES } from '@kbn/security-solution-plugin/common/test';
-import { EXCEPTION_LIST_ITEM_URL, EXCEPTION_LIST_URL } from '@kbn/securitysolution-list-constants';
-import { getCreateExceptionListMinimalSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_schema.mock';
-import { UpdateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
-import { getUpdateMinimalExceptionListItemSchemaMock } from '@kbn/lists-plugin/common/schemas/request/update_exception_list_item_schema.mock';
-import { getCreateExceptionListItemMinimalSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_item_schema.mock';
-import { createUserAndRole, deleteUserAndRole } from '../../../common/services/security_solution';
 import {
   createRule,
   createRuleWithExceptionEntries,
-  createSignalsIndex,
+  createAlertsIndex,
   deleteAllRules,
   deleteAllAlerts,
-  getRuleForSignalTesting,
-  getSignalsById,
+  getRuleForAlertTesting,
+  getAlertsById,
   waitForRuleSuccess,
-  waitForSignalsToBePresent,
-} from '../../utils';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+  waitForAlertsToBePresent,
+} from '../../../utils';
 import {
   createListsIndex,
   deleteAllExceptions,
   deleteListsIndex,
-} from '../../../lists_api_integration/utils';
+} from '../../../../../../lists_api_integration/utils';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
 interface Host {
   os: {
@@ -42,10 +36,10 @@ interface Host {
 }
 
 /**
- * Convenience method to get signals by host and sort them for better deterministic testing
+ * Convenience method to get Alerts by host and sort them for better deterministic testing
  * since Elastic can return the hits back in any order we want to sort them on return for testing.
  * @param supertest Super test for testing.
- * @param id The signals id
+ * @param id The Alerts id
  * @returns The array of hosts sorted
  */
 export const getHostHits = async (
@@ -53,8 +47,8 @@ export const getHostHits = async (
   log: ToolingLog,
   id: string
 ): Promise<Host[]> => {
-  const signalsOpen = await getSignalsById(supertest, log, id);
-  return signalsOpen.hits.hits
+  const AlertsOpen = await getAlertsById(supertest, log, id);
+  return AlertsOpen.hits.hits
     .map<Host>((hit) => hit._source?.host as Host)
     .sort((a, b) => {
       let sortOrder = 0;
@@ -74,15 +68,13 @@ export const getHostHits = async (
     });
 };
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
-  const supertestWithoutAuth = getService('supertestWithoutAuth');
   const log = getService('log');
   const es = getService('es');
 
-  describe('create_endpoint_exceptions', () => {
+  describe('@serverless @ess create_endpoint_exceptions', () => {
     before(async () => {
       await esArchiver.load(
         'x-pack/test/functional/es_archives/rule_exceptions/endpoint_without_host_type'
@@ -98,7 +90,7 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest, log);
+      await createAlertsIndex(supertest, log);
       await createListsIndex(supertest, log);
     });
 
@@ -111,10 +103,10 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('no exceptions set', () => {
       it('should find all the "hosts" from a "agent" index when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['agent']);
+        const rule = getRuleForAlertTesting(['agent']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
         const hits = await getHostHits(supertest, log, id);
         expect(hits).toEqual([
           {
@@ -133,10 +125,10 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should find all the "hosts" from a "endpoint_without_host_type" index when no exceptions are set on the rule', async () => {
-        const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
+        const rule = getRuleForAlertTesting(['endpoint_without_host_type']);
         const { id } = await createRule(supertest, log, rule);
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
         const hits = await getHostHits(supertest, log, id);
         expect(hits).toEqual([
           {
@@ -158,7 +150,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('operating system types (os_types)', () => {
       describe('endpoints', () => {
         it('should filter 1 operating system types (os_type) if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
+          const rule = getRuleForAlertTesting(['endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -179,7 +171,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -195,7 +187,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter 2 operating system types as an "OR" (os_type) if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
+          const rule = getRuleForAlertTesting(['endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -216,7 +208,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -232,7 +224,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter multiple operating system types if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
+          const rule = getRuleForAlertTesting(['endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -264,7 +256,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -277,7 +269,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter multiple operating system types (os_type) with multiple filter items for an endpoint', async () => {
-          const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
+          const rule = getRuleForAlertTesting(['endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -309,7 +301,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -324,7 +316,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('agent', () => {
         it('should filter 1 operating system types (os_type) if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['agent']);
+          const rule = getRuleForAlertTesting(['agent']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -345,7 +337,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -361,7 +353,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter 1 operating system type as an "OR" (os_type) if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['agent']);
+          const rule = getRuleForAlertTesting(['agent']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -382,7 +374,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          await waitForAlertsToBePresent(supertest, log, 3, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -398,7 +390,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter multiple operating system types if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['agent']);
+          const rule = getRuleForAlertTesting(['agent']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -430,7 +422,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -443,7 +435,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter multiple operating system types (os_type) with multiple filter items for an endpoint', async () => {
-          const rule = getRuleForSignalTesting(['agent']);
+          const rule = getRuleForAlertTesting(['agent']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -475,7 +467,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          await waitForAlertsToBePresent(supertest, log, 2, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -490,7 +482,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('agent and endpoint', () => {
         it('should filter 2 operating system types (os_type) if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['agent', 'endpoint_without_host_type']);
+          const rule = getRuleForAlertTesting(['agent', 'endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -511,7 +503,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 6, [id]);
+          await waitForAlertsToBePresent(supertest, log, 6, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -536,7 +528,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter 2 operating system types as an "OR" (os_type) if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['agent', 'endpoint_without_host_type']);
+          const rule = getRuleForAlertTesting(['agent', 'endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -557,7 +549,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 6, [id]);
+          await waitForAlertsToBePresent(supertest, log, 6, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -582,7 +574,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter multiple operating system types if it is set as part of an endpoint exception', async () => {
-          const rule = getRuleForSignalTesting(['agent', 'endpoint_without_host_type']);
+          const rule = getRuleForAlertTesting(['agent', 'endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -614,7 +606,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -633,7 +625,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should filter multiple operating system types (os_type) with multiple filter items for an endpoint', async () => {
-          const rule = getRuleForSignalTesting(['agent', 'endpoint_without_host_type']);
+          const rule = getRuleForAlertTesting(['agent', 'endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
             log,
@@ -665,7 +657,7 @@ export default ({ getService }: FtrProviderContext) => {
             ]
           );
           await waitForRuleSuccess({ supertest, log, id });
-          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          await waitForAlertsToBePresent(supertest, log, 4, [id]);
           const hits = await getHostHits(supertest, log, id);
           expect(hits).toEqual([
             {
@@ -687,7 +679,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is" operator', () => {
       it('should filter 1 value set as an endpoint exception and 1 value set as a normal rule exception ', async () => {
-        const rule = getRuleForSignalTesting(['agent']);
+        const rule = getRuleForAlertTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
           log,
@@ -717,7 +709,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]
         );
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
         const hits = await getHostHits(supertest, log, id);
         expect(hits).toEqual([
           {
@@ -727,7 +719,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 1 value set as an endpoint exception and 1 value set as a normal rule exception with os_type set', async () => {
-        const rule = getRuleForSignalTesting(['agent']);
+        const rule = getRuleForAlertTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
           log,
@@ -757,7 +749,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]
         );
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        await waitForAlertsToBePresent(supertest, log, 1, [id]);
         const hits = await getHostHits(supertest, log, id);
         expect(hits).toEqual([
           {
@@ -769,7 +761,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is one of" operator', () => {
       it('should filter 1 single value if it is set as an exception and the os_type is set to only 1 value', async () => {
-        const rule = getRuleForSignalTesting(['agent']);
+        const rule = getRuleForAlertTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
           log,
@@ -790,7 +782,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]
         );
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        await waitForAlertsToBePresent(supertest, log, 3, [id]);
         const hits = await getHostHits(supertest, log, id);
         expect(hits).toEqual([
           {
@@ -806,7 +798,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 values if it is set as an exception and the os_type is set to 2 values', async () => {
-        const rule = getRuleForSignalTesting(['agent']);
+        const rule = getRuleForAlertTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
           log,
@@ -827,7 +819,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]
         );
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
         const hits = await getHostHits(supertest, log, id);
         expect(hits).toEqual([
           {
@@ -840,7 +832,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter 2 values if it is set as an exception and the os_type is set to undefined', async () => {
-        const rule = getRuleForSignalTesting(['agent']);
+        const rule = getRuleForAlertTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
           log,
@@ -861,7 +853,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]
         );
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        await waitForAlertsToBePresent(supertest, log, 2, [id]);
         const hits = await getHostHits(supertest, log, id);
         expect(hits).toEqual([
           {
@@ -874,7 +866,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should filter no values if they are set as an exception but the os_type is set to something not within the documents', async () => {
-        const rule = getRuleForSignalTesting(['agent']);
+        const rule = getRuleForAlertTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
           log,
@@ -895,7 +887,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]
         );
         await waitForRuleSuccess({ supertest, log, id });
-        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        await waitForAlertsToBePresent(supertest, log, 4, [id]);
         const hits = await getHostHits(supertest, log, id);
         expect(hits).toEqual([
           {
@@ -913,113 +905,5 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
       });
     });
-    describe('Add/edit exception comments by different users', () => {
-      const socManager = ROLES.soc_manager;
-      const detectionAdmin = ROLES.detections_admin;
-
-      beforeEach(async () => {
-        await createUserAndRole(getService, detectionAdmin);
-        await createUserAndRole(getService, socManager);
-      });
-
-      afterEach(async () => {
-        await deleteUserAndRole(getService, detectionAdmin);
-        await deleteUserAndRole(getService, socManager);
-        await deleteAllExceptions(supertest, log);
-      });
-
-      it('Add comment on a new exception, add another comment has unicode from a different user', async () => {
-        await supertestWithoutAuth
-          .post(EXCEPTION_LIST_URL)
-          .auth(detectionAdmin, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send(getCreateExceptionListMinimalSchemaMock())
-          .expect(200);
-
-        // Add comment by the Detection Admin
-        await supertestWithoutAuth
-          .post(EXCEPTION_LIST_ITEM_URL)
-          .auth(detectionAdmin, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send({
-            ...getCreateExceptionListItemMinimalSchemaMock(),
-            comments: [{ comment: 'Comment by user@detections_admin' }],
-          })
-          .expect(200);
-
-        const { body: items } = await supertestWithoutAuth
-          .get(
-            `${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${
-              getCreateExceptionListMinimalSchemaMock().list_id
-            }`
-          )
-          .auth(detectionAdmin, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send()
-          .expect(200);
-
-        // Validate the first user comment
-        expect(items.total).toEqual(1);
-        const [item] = items.data;
-        const detectionAdminComments = item.comments;
-        expect(detectionAdminComments.length).toEqual(1);
-
-        expect(detectionAdminComments[0]).toEqual(
-          expect.objectContaining({
-            created_by: 'detections_admin',
-            comment: 'Comment by user@detections_admin',
-          })
-        );
-
-        const expectedId = item.id;
-
-        // Update exception comment by different user Soc-manager
-        const { item_id: _, ...updateItemWithoutItemId } =
-          getUpdateMinimalExceptionListItemSchemaMock();
-
-        const updatePayload: UpdateExceptionListItemSchema = {
-          ...updateItemWithoutItemId,
-          comments: [
-            ...(updateItemWithoutItemId.comments || []),
-            { comment: 'Comment by user@soc_manager' },
-          ],
-          id: expectedId,
-        };
-        await supertestWithoutAuth
-          .put(EXCEPTION_LIST_ITEM_URL)
-          .auth(socManager, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send(updatePayload)
-          .expect(200);
-
-        const { body: itemsAfterUpdate } = await supertest
-          .get(
-            `${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${
-              getCreateExceptionListMinimalSchemaMock().list_id
-            }`
-          )
-          .auth(socManager, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send()
-          .expect(200);
-        const [itemAfterUpdate] = itemsAfterUpdate.data;
-        const detectionAdminAndSocManagerComments = itemAfterUpdate.comments;
-
-        expect(detectionAdminAndSocManagerComments.length).toEqual(2);
-
-        expect(detectionAdminAndSocManagerComments).toEqual(
-          expect.arrayContaining([
-            expect.objectContaining({
-              created_by: 'detections_admin',
-              comment: 'Comment by user@detections_admin',
-            }),
-            expect.objectContaining({
-              created_by: 'soc_manager',
-              comment: 'Comment by user@soc_manager',
-            }),
-          ])
-        );
-      });
-    });
   });
 };
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/exceptions/rule_exception/create_rule_exceptions.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_rule_exceptions.ts
similarity index 98%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/exceptions/rule_exception/create_rule_exceptions.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_rule_exceptions.ts
index c48767b9a6586..8d78a0d7e48c4 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/exceptions/rule_exception/create_rule_exceptions.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/create_rule_exceptions.ts
@@ -15,8 +15,6 @@ import {
   ExceptionListTypeEnum,
 } from '@kbn/securitysolution-io-ts-list-types';
 import { getCreateExceptionListMinimalSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_schema.mock';
-
-import { FtrProviderContext } from '../../../../ftr_provider_context';
 import {
   getRule,
   createRule,
@@ -25,11 +23,12 @@ import {
   deleteAllRules,
   createExceptionList,
   deleteAllAlerts,
-} from '../../utils';
+} from '../../../utils';
 import {
   deleteAllExceptions,
   removeExceptionListItemServerGeneratedProperties,
-} from '../../../../../lists_api_integration/utils';
+} from '../../../../../../lists_api_integration/utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
 const getRuleExceptionItemMock = (): CreateRuleExceptionListItemSchema => ({
   description: 'Exception item for rule default exception list',
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/find_rule_exception_references.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/find_rule_exception_references.ts
new file mode 100644
index 0000000000000..a2f996539f199
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/find_rule_exception_references.ts
@@ -0,0 +1,230 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/naming-convention */
+
+import expect from '@kbn/expect';
+
+import {
+  CreateExceptionListSchema,
+  ExceptionListTypeEnum,
+} from '@kbn/securitysolution-io-ts-list-types';
+
+import { getCreateExceptionListMinimalSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_schema.mock';
+import {
+  DETECTION_ENGINE_RULES_EXCEPTIONS_REFERENCE_URL,
+  RuleReferencesSchema,
+} from '@kbn/security-solution-plugin/common/api/detection_engine/rule_exceptions';
+
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
+import {
+  createRule,
+  getSimpleRule,
+  deleteAllRules,
+  createExceptionList,
+  deleteAllAlerts,
+  createAlertsIndex,
+} from '../../../utils';
+import { deleteAllExceptions } from '../../../../../../lists_api_integration/utils';
+
+export default ({ getService }: FtrProviderContext) => {
+  const supertest = getService('supertest');
+  const log = getService('log');
+  const es = getService('es');
+
+  describe('@serverless @ess find_rule_exception_references', () => {
+    before(async () => {
+      await createAlertsIndex(supertest, log);
+    });
+
+    after(async () => {
+      await deleteAllAlerts(supertest, log, es);
+      await deleteAllRules(supertest, log);
+    });
+
+    afterEach(async () => {
+      await deleteAllExceptions(supertest, log);
+    });
+
+    it('returns empty array per list_id if no references are found', async () => {
+      // create exception list
+      const newExceptionList: CreateExceptionListSchema = {
+        ...getCreateExceptionListMinimalSchemaMock(),
+        list_id: 'i_exist',
+        namespace_type: 'single',
+        type: ExceptionListTypeEnum.DETECTION,
+      };
+      const exceptionList = await createExceptionList(supertest, log, newExceptionList);
+
+      // create rule
+      await createRule(supertest, log, getSimpleRule('rule-1'));
+
+      const { body: references } = await supertest
+        .get(DETECTION_ENGINE_RULES_EXCEPTIONS_REFERENCE_URL)
+        .set('kbn-xsrf', 'true')
+        .set('elastic-api-version', '1')
+        .query({
+          ids: `${exceptionList.id}`,
+          list_ids: `${exceptionList.list_id}`,
+          namespace_types: `${exceptionList.namespace_type}`,
+        })
+        .expect(200);
+
+      const {
+        _version,
+        id,
+        created_at,
+        created_by,
+        tie_breaker_id,
+        updated_at,
+        updated_by,
+        ...referencesWithoutServerValues
+      } = references.references[0].i_exist;
+
+      expect({
+        references: [
+          {
+            i_exist: {
+              ...referencesWithoutServerValues,
+            },
+          },
+        ],
+      }).to.eql({
+        references: [
+          {
+            i_exist: {
+              description: 'some description',
+              immutable: false,
+              list_id: 'i_exist',
+              name: 'some name',
+              namespace_type: 'single',
+              os_types: [],
+              tags: [],
+              type: 'detection',
+              version: 1,
+              referenced_rules: [],
+            },
+          },
+        ],
+      });
+    });
+
+    it('returns empty array per list_id if list does not exist', async () => {
+      // create rule
+      await createRule(supertest, log, getSimpleRule('rule-1'));
+
+      const { body: references } = await supertest
+        .get(DETECTION_ENGINE_RULES_EXCEPTIONS_REFERENCE_URL)
+        .set('kbn-xsrf', 'true')
+        .set('elastic-api-version', '1')
+        .query({
+          ids: `1234`,
+          list_ids: `i_dont_exist`,
+          namespace_types: `single`,
+        })
+        .expect(200);
+
+      expect(references).to.eql({ references: [] });
+    });
+
+    it('returns found references', async () => {
+      // create exception list
+      const newExceptionList: CreateExceptionListSchema = {
+        ...getCreateExceptionListMinimalSchemaMock(),
+        list_id: 'i_exist',
+        namespace_type: 'single',
+        type: ExceptionListTypeEnum.DETECTION,
+      };
+      const exceptionList = await createExceptionList(supertest, log, newExceptionList);
+      const exceptionList2 = await createExceptionList(supertest, log, {
+        ...newExceptionList,
+        list_id: 'i_exist_2',
+      });
+
+      // create rule
+      await createRule(supertest, log, {
+        ...getSimpleRule('rule-2'),
+        exceptions_list: [
+          {
+            id: `${exceptionList.id}`,
+            list_id: `${exceptionList.list_id}`,
+            namespace_type: `${exceptionList.namespace_type}`,
+            type: `${exceptionList.type}`,
+          },
+          {
+            id: `${exceptionList2.id}`,
+            list_id: `${exceptionList2.list_id}`,
+            namespace_type: `${exceptionList2.namespace_type}`,
+            type: `${exceptionList2.type}`,
+          },
+        ],
+      });
+
+      const { body: references } = await supertest
+        .get(DETECTION_ENGINE_RULES_EXCEPTIONS_REFERENCE_URL)
+        .set('kbn-xsrf', 'true')
+        .set('elastic-api-version', '1')
+        .query({
+          ids: `${exceptionList.id},${exceptionList2.id}`,
+          list_ids: `${exceptionList.list_id},${exceptionList2.list_id}`,
+          namespace_types: `${exceptionList.namespace_type},${exceptionList2.namespace_type}`,
+        })
+        .expect(200);
+
+      const refs = references.references.flatMap((ref: RuleReferencesSchema) => Object.keys(ref));
+
+      expect(refs.sort()).to.eql(['i_exist', 'i_exist_2'].sort());
+    });
+
+    it('returns found references for all existing exception lists if no list id/list_id passed in', async () => {
+      // create exception list
+      const newExceptionList: CreateExceptionListSchema = {
+        ...getCreateExceptionListMinimalSchemaMock(),
+        list_id: 'i_exist',
+        namespace_type: 'single',
+        type: ExceptionListTypeEnum.DETECTION,
+      };
+      const exceptionList = await createExceptionList(supertest, log, newExceptionList);
+      const exceptionList2 = await createExceptionList(supertest, log, {
+        ...newExceptionList,
+        list_id: 'i_exist_2',
+      });
+
+      // create rule
+      await createRule(supertest, log, {
+        ...getSimpleRule('rule-2'),
+        exceptions_list: [
+          {
+            id: `${exceptionList.id}`,
+            list_id: `${exceptionList.list_id}`,
+            namespace_type: `${exceptionList.namespace_type}`,
+            type: `${exceptionList.type}`,
+          },
+          {
+            id: `${exceptionList2.id}`,
+            list_id: `${exceptionList2.list_id}`,
+            namespace_type: `${exceptionList2.namespace_type}`,
+            type: `${exceptionList2.type}`,
+          },
+        ],
+      });
+
+      const { body: references } = await supertest
+        .get(DETECTION_ENGINE_RULES_EXCEPTIONS_REFERENCE_URL)
+        .set('kbn-xsrf', 'true')
+        .set('elastic-api-version', '1')
+        .query({
+          namespace_types: 'single,agnostic',
+        })
+        .expect(200);
+
+      const refs = references.references.flatMap((ref: RuleReferencesSchema) => Object.keys(ref));
+      expect(refs.sort()).to.eql(['i_exist', 'i_exist_2', 'endpoint_list'].sort());
+    });
+  });
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/index.ts
new file mode 100644
index 0000000000000..d42c92d7c09b5
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/index.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('Exceptions API', function () {
+    loadTestFile(require.resolve('./create_rule_exceptions'));
+    loadTestFile(require.resolve('./create_rule_exceptions'));
+    loadTestFile(require.resolve('./role_based_rule_exceptions_workflows'));
+    loadTestFile(require.resolve('./create_endpoint_exceptions'));
+    loadTestFile(require.resolve('./role_based_add_edit_comments'));
+    loadTestFile(require.resolve('./rule_exception_synchronizations'));
+  });
+}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_add_edit_comments.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_add_edit_comments.ts
new file mode 100644
index 0000000000000..3ce0aa0bed874
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_add_edit_comments.ts
@@ -0,0 +1,250 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/naming-convention */
+
+import expect from 'expect';
+
+import { EXCEPTION_LIST_ITEM_URL, EXCEPTION_LIST_URL } from '@kbn/securitysolution-list-constants';
+import {
+  getCreateExceptionListDetectionSchemaMock,
+  getCreateExceptionListMinimalSchemaMock,
+} from '@kbn/lists-plugin/common/schemas/request/create_exception_list_schema.mock';
+import { getCreateExceptionListItemMinimalSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_item_schema.mock';
+import { ROLES } from '@kbn/security-solution-plugin/common/test';
+import { getUpdateMinimalExceptionListItemSchemaMock } from '@kbn/lists-plugin/common/schemas/request/update_exception_list_item_schema.mock';
+import { UpdateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import { deleteAllExceptions } from '../../../../../../lists_api_integration/utils';
+import {
+  createUserAndRole,
+  deleteUserAndRole,
+} from '../../../../../../common/services/security_solution';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
+export default ({ getService }: FtrProviderContext) => {
+  const supertest = getService('supertest');
+  const log = getService('log');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
+
+  describe('@serverless @ess @brokenInServerless role_based_add_edit_comments', () => {
+    const socManager = ROLES.soc_manager;
+    const detectionAdmin = ROLES.detections_admin;
+
+    describe('Rule Exceptions', () => {
+      beforeEach(async () => {
+        await createUserAndRole(getService, detectionAdmin);
+        await createUserAndRole(getService, socManager);
+      });
+
+      afterEach(async () => {
+        await deleteUserAndRole(getService, detectionAdmin);
+        await deleteUserAndRole(getService, socManager);
+        await deleteAllExceptions(supertest, log);
+      });
+
+      it('Add comment on a new exception, add another comment has unicode from a different user', async () => {
+        await supertestWithoutAuth
+          .post(EXCEPTION_LIST_URL)
+          .auth(detectionAdmin, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListDetectionSchemaMock())
+          .expect(200);
+
+        const { os_types, ...ruleException } = getCreateExceptionListItemMinimalSchemaMock();
+
+        // Add comment by the Detection Admin
+        await supertestWithoutAuth
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .auth(detectionAdmin, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send({
+            ...ruleException,
+            comments: [{ comment: 'Comment by user@detections_admin' }],
+          })
+          .expect(200);
+
+        const { body: items } = await supertestWithoutAuth
+          .get(
+            `${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${
+              getCreateExceptionListMinimalSchemaMock().list_id
+            }`
+          )
+          .auth(detectionAdmin, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        // Validate the first user comment
+        expect(items.total).toEqual(1);
+        const [item] = items.data;
+        const detectionAdminComments = item.comments;
+        expect(detectionAdminComments.length).toEqual(1);
+
+        expect(detectionAdminComments[0]).toEqual(
+          expect.objectContaining({
+            created_by: 'detections_admin',
+            comment: 'Comment by user@detections_admin',
+          })
+        );
+
+        const expectedId = item.id;
+
+        // Update exception comment by different user Soc-manager
+        const { item_id: _, ...updateItemWithoutItemId } =
+          getUpdateMinimalExceptionListItemSchemaMock();
+
+        const updatePayload: UpdateExceptionListItemSchema = {
+          ...updateItemWithoutItemId,
+          comments: [
+            ...(updateItemWithoutItemId.comments || []),
+            { comment: 'Comment by user@soc_manager' },
+          ],
+          id: expectedId,
+        };
+        await supertestWithoutAuth
+          .put(EXCEPTION_LIST_ITEM_URL)
+          .auth(socManager, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send(updatePayload)
+          .expect(200);
+
+        const { body: itemsAfterUpdate } = await supertest
+          .get(
+            `${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${
+              getCreateExceptionListMinimalSchemaMock().list_id
+            }`
+          )
+          .auth(socManager, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+        const [itemAfterUpdate] = itemsAfterUpdate.data;
+        const detectionAdminAndSocManagerComments = itemAfterUpdate.comments;
+
+        expect(detectionAdminAndSocManagerComments.length).toEqual(2);
+
+        expect(detectionAdminAndSocManagerComments).toEqual(
+          expect.arrayContaining([
+            expect.objectContaining({
+              created_by: 'detections_admin',
+              comment: 'Comment by user@detections_admin',
+            }),
+            expect.objectContaining({
+              created_by: 'soc_manager',
+              comment: 'Comment by user@soc_manager',
+            }),
+          ])
+        );
+      });
+    });
+    describe('Endpoint Exceptions', () => {
+      beforeEach(async () => {
+        await createUserAndRole(getService, detectionAdmin);
+        await createUserAndRole(getService, socManager);
+      });
+
+      afterEach(async () => {
+        await deleteUserAndRole(getService, detectionAdmin);
+        await deleteUserAndRole(getService, socManager);
+        await deleteAllExceptions(supertest, log);
+      });
+
+      it('Add comment on a new exception, add another comment has unicode from a different user', async () => {
+        await supertestWithoutAuth
+          .post(EXCEPTION_LIST_URL)
+          .auth(detectionAdmin, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send(getCreateExceptionListMinimalSchemaMock())
+          .expect(200);
+
+        // Add comment by the Detection Admin
+        await supertestWithoutAuth
+          .post(EXCEPTION_LIST_ITEM_URL)
+          .auth(detectionAdmin, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send({
+            ...getCreateExceptionListItemMinimalSchemaMock(),
+            comments: [{ comment: 'Comment by user@detections_admin' }],
+          })
+          .expect(200);
+
+        const { body: items } = await supertestWithoutAuth
+          .get(
+            `${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${
+              getCreateExceptionListMinimalSchemaMock().list_id
+            }`
+          )
+          .auth(detectionAdmin, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+
+        // Validate the first user comment
+        expect(items.total).toEqual(1);
+        const [item] = items.data;
+        const detectionAdminComments = item.comments;
+        expect(detectionAdminComments.length).toEqual(1);
+
+        expect(detectionAdminComments[0]).toEqual(
+          expect.objectContaining({
+            created_by: 'detections_admin',
+            comment: 'Comment by user@detections_admin',
+          })
+        );
+
+        const expectedId = item.id;
+
+        // Update exception comment by different user Soc-manager
+        const { item_id: _, ...updateItemWithoutItemId } =
+          getUpdateMinimalExceptionListItemSchemaMock();
+
+        const updatePayload: UpdateExceptionListItemSchema = {
+          ...updateItemWithoutItemId,
+          comments: [
+            ...(updateItemWithoutItemId.comments || []),
+            { comment: 'Comment by user@soc_manager' },
+          ],
+          id: expectedId,
+        };
+        await supertestWithoutAuth
+          .put(EXCEPTION_LIST_ITEM_URL)
+          .auth(socManager, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send(updatePayload)
+          .expect(200);
+
+        const { body: itemsAfterUpdate } = await supertest
+          .get(
+            `${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${
+              getCreateExceptionListMinimalSchemaMock().list_id
+            }`
+          )
+          .auth(socManager, 'changeme')
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(200);
+        const [itemAfterUpdate] = itemsAfterUpdate.data;
+        const detectionAdminAndSocManagerComments = itemAfterUpdate.comments;
+
+        expect(detectionAdminAndSocManagerComments.length).toEqual(2);
+
+        expect(detectionAdminAndSocManagerComments).toEqual(
+          expect.arrayContaining([
+            expect.objectContaining({
+              created_by: 'detections_admin',
+              comment: 'Comment by user@detections_admin',
+            }),
+            expect.objectContaining({
+              created_by: 'soc_manager',
+              comment: 'Comment by user@soc_manager',
+            }),
+          ])
+        );
+      });
+    });
+  });
+};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group3/exceptions_workflows.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_rule_exceptions_workflows.ts
similarity index 72%
rename from x-pack/test/detection_engine_api_integration/security_and_spaces/group3/exceptions_workflows.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_rule_exceptions_workflows.ts
index d2a471174c304..a83aa609949ca 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group3/exceptions_workflows.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/role_based_rule_exceptions_workflows.ts
@@ -8,10 +8,7 @@
 /* eslint-disable @typescript-eslint/naming-convention */
 
 import expect from 'expect';
-import type {
-  CreateExceptionListItemSchema,
-  UpdateExceptionListItemSchema,
-} from '@kbn/securitysolution-io-ts-list-types';
+import type { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
 import {
   EXCEPTION_LIST_ITEM_URL,
   EXCEPTION_LIST_URL,
@@ -25,68 +22,76 @@ import type {
   ThresholdRuleCreateProps,
 } from '@kbn/security-solution-plugin/common/api/detection_engine';
 import { getCreateExceptionListItemMinimalSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_item_schema.mock';
-import {
-  getCreateExceptionListDetectionSchemaMock,
-  getCreateExceptionListMinimalSchemaMock,
-} from '@kbn/lists-plugin/common/schemas/request/create_exception_list_schema.mock';
+import { getCreateExceptionListMinimalSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_schema.mock';
 
 import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common/constants';
 import { ROLES } from '@kbn/security-solution-plugin/common/test';
 import { ELASTIC_SECURITY_RULE_ID } from '@kbn/security-solution-plugin/common';
-import { getUpdateMinimalExceptionListItemSchemaMock } from '@kbn/lists-plugin/common/schemas/request/update_exception_list_item_schema.mock';
-import { FtrProviderContext } from '../../common/ftr_provider_context';
+
+import { EsArchivePathBuilder } from '../../../../../es_archive_path_builder';
 import {
-  createSignalsIndex,
-  deleteAllRules,
-  deleteAllAlerts,
+  createAlertsIndex,
+  getRule,
+  createRule,
   getSimpleRule,
+  deleteAllRules,
+  createExceptionList,
+  createExceptionListItem,
+  getThresholdRuleForAlertTesting,
   getSimpleRuleOutput,
   removeServerGeneratedProperties,
   downgradeImmutableRule,
-  createRule,
   waitForRuleSuccess,
   installMockPrebuiltRules,
-  getRule,
-  createExceptionList,
-  createExceptionListItem,
-  waitForSignalsToBePresent,
-  getSignalsByIds,
+  waitForAlertsToBePresent,
+  getAlertsByIds,
   findImmutableRuleById,
   getPrebuiltRulesAndTimelinesStatus,
-  getOpenSignals,
+  getOpenAlerts,
   createRuleWithExceptionEntries,
-  getEqlRuleForSignalTesting,
-  getThresholdRuleForSignalTesting,
-} from '../../utils';
+  getEqlRuleForAlertTesting,
+  SAMPLE_PREBUILT_RULES,
+  deleteAllAlerts,
+  updateUsername,
+} from '../../../utils';
+
 import {
   createListsIndex,
   deleteAllExceptions,
   deleteListsIndex,
   importFile,
-} from '../../../lists_api_integration/utils';
-import { createUserAndRole, deleteUserAndRole } from '../../../common/services/security_solution';
-import { SAMPLE_PREBUILT_RULES } from '../../utils/prebuilt_rules/create_prebuilt_rule_saved_objects';
+} from '../../../../../../lists_api_integration/utils';
+import {
+  createUserAndRole,
+  deleteUserAndRole,
+} from '../../../../../../common/services/security_solution';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
 
-// eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const esArchiver = getService('esArchiver');
   const log = getService('log');
   const es = getService('es');
-
-  describe('create_rules_with_exceptions', () => {
+  // TODO: add a new service
+  const config = getService('config');
+  const ELASTICSEARCH_USERNAME = config.get('servers.kibana.username');
+  const isServerless = config.get('serverless');
+  const dataPathBuilder = new EsArchivePathBuilder(isServerless);
+  const path = dataPathBuilder.getPath('auditbeat/hosts');
+
+  describe('@serverless @ess role_based_rule_exceptions_workflows', () => {
     before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.load(path);
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+      await esArchiver.unload(path);
     });
 
     describe('creating rules with exceptions', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest, log);
+        await createAlertsIndex(supertest, log);
       });
 
       afterEach(async () => {
@@ -116,10 +121,10 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           };
-
+          const expectedRule = updateUsername(getSimpleRuleOutput(), ELASTICSEARCH_USERNAME);
           const rule = await createRule(supertest, log, ruleWithException);
           const expected = {
-            ...getSimpleRuleOutput(),
+            ...expectedRule,
             exceptions_list: [
               {
                 id,
@@ -158,9 +163,10 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = await createRule(supertest, log, ruleWithException);
           await waitForRuleSuccess({ supertest, log, id: rule.id });
           const bodyToCompare = removeServerGeneratedProperties(rule);
+          const expectedRule = updateUsername(getSimpleRuleOutput(), ELASTICSEARCH_USERNAME);
 
           const expected = {
-            ...getSimpleRuleOutput(),
+            ...expectedRule,
             enabled: true,
             exceptions_list: [
               {
@@ -497,7 +503,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
       });
 
-      describe('t1_analyst', () => {
+      describe('@brokenInServerless t1_analyst', () => {
         const role = ROLES.t1_analyst;
 
         beforeEach(async () => {
@@ -529,15 +535,15 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('tests with auditbeat data', () => {
         before(async () => {
-          await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
+          await esArchiver.load(path);
         });
 
         after(async () => {
-          await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
+          await esArchiver.unload(path);
         });
 
         beforeEach(async () => {
-          await createSignalsIndex(supertest, log);
+          await createAlertsIndex(supertest, log);
         });
 
         afterEach(async () => {
@@ -546,7 +552,7 @@ export default ({ getService }: FtrProviderContext) => {
           await deleteAllExceptions(supertest, log);
         });
 
-        it('should be able to execute against an exception list that does not include valid entries and get back 10 signals', async () => {
+        it('should be able to execute against an exception list that does not include valid entries and get back 10 alerts', async () => {
           const { id, list_id, namespace_type, type } = await createExceptionList(
             supertest,
             log,
@@ -588,12 +594,12 @@ export default ({ getService }: FtrProviderContext) => {
           };
           const { id: createdId } = await createRule(supertest, log, ruleWithException);
           await waitForRuleSuccess({ supertest, log, id: createdId });
-          await waitForSignalsToBePresent(supertest, log, 10, [createdId]);
-          const signalsOpen = await getSignalsByIds(supertest, log, [createdId]);
-          expect(signalsOpen.hits.hits.length).toEqual(10);
+          await waitForAlertsToBePresent(supertest, log, 10, [createdId]);
+          const alertsOpen = await getAlertsByIds(supertest, log, [createdId]);
+          expect(alertsOpen.hits.hits.length).toEqual(10);
         });
 
-        it('should be able to execute against an exception list that does include valid entries and get back 0 signals', async () => {
+        it('should be able to execute against an exception list that does include valid entries and get back 0 alerts', async () => {
           const rule: QueryRuleCreateProps = {
             name: 'Simple Rule Query',
             description: 'Simple Rule Query',
@@ -616,11 +622,11 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-          expect(signalsOpen.hits.hits.length).toEqual(0);
+          const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+          expect(alertsOpen.hits.hits.length).toEqual(0);
         });
 
-        it('should be able to execute against an exception list that does include valid case sensitive entries and get back 0 signals', async () => {
+        it('should be able to execute against an exception list that does include valid case sensitive entries and get back 0 alerts', async () => {
           const rule: QueryRuleCreateProps = {
             name: 'Simple Rule Query',
             description: 'Simple Rule Query',
@@ -665,19 +671,19 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-          const signalsOpen2 = await getOpenSignals(supertest, log, es, createdRule2);
-          // Expect signals here because all values are "Ubuntu"
+          const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+          const alertsOpen2 = await getOpenAlerts(supertest, log, es, createdRule2);
+          // Expect alerts here because all values are "Ubuntu"
           // and exception is one of ["ubuntu"]
-          expect(signalsOpen.hits.hits.length).toEqual(10);
-          // Expect no signals here because all values are "Ubuntu"
+          expect(alertsOpen.hits.hits.length).toEqual(10);
+          // Expect no alerts here because all values are "Ubuntu"
           // and exception is one of ["ubuntu", "Ubuntu"]
-          expect(signalsOpen2.hits.hits.length).toEqual(0);
+          expect(alertsOpen2.hits.hits.length).toEqual(0);
         });
 
-        it('generates no signals when an exception is added for an EQL rule', async () => {
+        it('generates no alerts when an exception is added for an EQL rule', async () => {
           const rule: EqlRuleCreateProps = {
-            ...getEqlRuleForSignalTesting(['auditbeat-*']),
+            ...getEqlRuleForAlertTesting(['auditbeat-*']),
             query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
           };
           const createdRule = await createRuleWithExceptionEntries(supertest, log, rule, [
@@ -690,13 +696,13 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-          expect(signalsOpen.hits.hits.length).toEqual(0);
+          const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+          expect(alertsOpen.hits.hits.length).toEqual(0);
         });
 
-        it('generates no signals when an exception is added for a threshold rule', async () => {
+        it('generates no alerts when an exception is added for a threshold rule', async () => {
           const rule: ThresholdRuleCreateProps = {
-            ...getThresholdRuleForSignalTesting(['auditbeat-*']),
+            ...getThresholdRuleForAlertTesting(['auditbeat-*']),
             threshold: {
               field: 'host.id',
               value: 700,
@@ -712,11 +718,11 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-          expect(signalsOpen.hits.hits.length).toEqual(0);
+          const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+          expect(alertsOpen.hits.hits.length).toEqual(0);
         });
 
-        it('generates no signals when an exception is added for a threat match rule', async () => {
+        it('generates no alerts when an exception is added for a threat match rule', async () => {
           const rule: ThreatMatchRuleCreateProps = {
             description: 'Detecting root and admin users',
             name: 'Query with a rule id',
@@ -755,8 +761,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-          expect(signalsOpen.hits.hits.length).toEqual(0);
+          const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+          expect(alertsOpen.hits.hits.length).toEqual(0);
         });
         describe('rules with value list exceptions', () => {
           beforeEach(async () => {
@@ -767,7 +773,7 @@ export default ({ getService }: FtrProviderContext) => {
             await deleteListsIndex(supertest, log);
           });
 
-          it('generates no signals when a value list exception is added for a query rule', async () => {
+          it('generates no alerts when a value list exception is added for a query rule', async () => {
             const valueListId = 'value-list-id';
             await importFile(supertest, log, 'keyword', ['suricata-sensor-amsterdam'], valueListId);
             const rule: QueryRuleCreateProps = {
@@ -795,11 +801,11 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
             ]);
-            const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-            expect(signalsOpen.hits.hits.length).toEqual(0);
+            const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+            expect(alertsOpen.hits.hits.length).toEqual(0);
           });
 
-          it('generates no signals when a value list exception is added for a threat match rule', async () => {
+          it('generates no alerts when a value list exception is added for a threat match rule', async () => {
             const valueListId = 'value-list-id';
             await importFile(supertest, log, 'keyword', ['zeek-sensor-amsterdam'], valueListId);
             const rule: ThreatMatchRuleCreateProps = {
@@ -843,11 +849,11 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
             ]);
-            const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-            expect(signalsOpen.hits.hits.length).toEqual(0);
+            const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+            expect(alertsOpen.hits.hits.length).toEqual(0);
           });
 
-          it('generates no signals when a value list exception is added for a threshold rule', async () => {
+          it('generates no alerts when a value list exception is added for a threshold rule', async () => {
             const valueListId = 'value-list-id';
             await importFile(supertest, log, 'keyword', ['zeek-sensor-amsterdam'], valueListId);
             const rule: ThresholdRuleCreateProps = {
@@ -880,15 +886,15 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
             ]);
-            const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-            expect(signalsOpen.hits.hits.length).toEqual(0);
+            const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+            expect(alertsOpen.hits.hits.length).toEqual(0);
           });
 
-          it('generates no signals when a value list exception is added for an EQL rule', async () => {
+          it('generates no alerts when a value list exception is added for an EQL rule', async () => {
             const valueListId = 'value-list-id';
             await importFile(supertest, log, 'keyword', ['zeek-sensor-amsterdam'], valueListId);
             const rule: EqlRuleCreateProps = {
-              ...getEqlRuleForSignalTesting(['auditbeat-*']),
+              ...getEqlRuleForAlertTesting(['auditbeat-*']),
               query: 'configuration where host.name=="zeek-sensor-amsterdam"',
             };
 
@@ -905,8 +911,8 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
             ]);
-            const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
-            expect(signalsOpen.hits.hits.length).toEqual(0);
+            const alertsOpen = await getOpenAlerts(supertest, log, es, createdRule);
+            expect(alertsOpen.hits.hits.length).toEqual(0);
           });
           it('should Not allow deleting value list when there are references and ignoreReferences is false', async () => {
             const valueListId = 'value-list-id';
@@ -944,252 +950,5 @@ export default ({ getService }: FtrProviderContext) => {
         });
       });
     });
-    describe('Synchronizations', () => {
-      afterEach(async () => {
-        await deleteAllAlerts(supertest, log, es);
-        await deleteAllRules(supertest, log);
-        await deleteAllExceptions(supertest, log);
-      });
-      /*
-        This test to mimic if we have two browser tabs, and the user tried to 
-        edit an exception in a tab after deleting it in another 
-      */
-      it('should Not edit an exception after being deleted', async () => {
-        const { list_id: skippedListId, ...newExceptionItem } =
-          getCreateExceptionListDetectionSchemaMock();
-        const {
-          body: { id, list_id, namespace_type, type },
-        } = await supertest
-          .post(EXCEPTION_LIST_URL)
-          .set('kbn-xsrf', 'true')
-          .send(newExceptionItem)
-          .expect(200);
-
-        const ruleWithException: RuleCreateProps = {
-          ...getSimpleRule(),
-          exceptions_list: [
-            {
-              id,
-              list_id,
-              namespace_type,
-              type,
-            },
-          ],
-        };
-
-        await createRule(supertest, log, ruleWithException);
-
-        // Delete the exception
-        await supertest
-          .delete(`${EXCEPTION_LIST_ITEM_URL}?id=${id}&namespace_type=single`)
-          .set('kbn-xsrf', 'true')
-          .send()
-          .expect(200);
-
-        // Edit after delete as if it was opened in another browser tab
-        const { body } = await supertest
-          .put(`${EXCEPTION_LIST_ITEM_URL}`)
-          .set('kbn-xsrf', 'true')
-          .send({
-            id: list_id,
-            item_id: id,
-            name: 'edit',
-            entries: [{ field: 'ss', operator: 'included', type: 'match', value: 'ss' }],
-            namespace_type,
-            description: 'Exception list item - Edit',
-            type: 'simple',
-          })
-          .expect(404);
-
-        expect(body).toEqual({
-          message: `exception list item id: "${list_id}" does not exist`,
-          status_code: 404,
-        });
-      });
-      /*
-        This test to mimic if we have two browser tabs, and the user tried to 
-        edit an exception with value-list was deleted in another tab
-      */
-      it('should Not allow editing an Exception with deleted ValueList', async () => {
-        await createListsIndex(supertest, log);
-
-        const valueListId = 'value-list-id';
-        await importFile(supertest, log, 'keyword', ['suricata-sensor-amsterdam'], valueListId);
-        const rule: QueryRuleCreateProps = {
-          ...getSimpleRule(),
-          query: 'host.name: "suricata-sensor-amsterdam"',
-        };
-        const { exceptions_list: exceptionsList } = await createRuleWithExceptionEntries(
-          supertest,
-          log,
-          rule,
-          [
-            [
-              {
-                field: 'host.name',
-                operator: 'included',
-                type: 'list',
-                list: {
-                  id: valueListId,
-                  type: 'keyword',
-                },
-              },
-            ],
-          ]
-        );
-
-        const deleteReferences = false;
-        const ignoreReferences = true;
-
-        const { id, list_id, namespace_type } = exceptionsList[0];
-
-        // Delete the value list
-        await supertest
-          .delete(
-            `${LIST_URL}?deleteReferences=${deleteReferences}&id=${valueListId}&ignoreReferences=${ignoreReferences}`
-          )
-          .set('kbn-xsrf', 'true')
-          .send()
-          .expect(200);
-
-        // edit the exception with the deleted value list
-        await supertest
-          .put(`${EXCEPTION_LIST_ITEM_URL}`)
-          .set('kbn-xsrf', 'true')
-          .send({
-            id: list_id,
-            item_id: id,
-            name: 'edit',
-            entries: [
-              {
-                field: 'host.name',
-                operator: 'included',
-                type: 'list',
-                list: {
-                  id: valueListId,
-                  type: 'keyword',
-                },
-              },
-            ],
-            namespace_type,
-            description: 'Exception list item - Edit',
-            type: 'simple',
-          })
-          .expect(404);
-
-        await deleteListsIndex(supertest, log);
-      });
-    });
-
-    describe('Add/edit exception comments by different users', () => {
-      const socManager = ROLES.soc_manager;
-      const detectionAdmin = ROLES.detections_admin;
-
-      beforeEach(async () => {
-        await createUserAndRole(getService, detectionAdmin);
-        await createUserAndRole(getService, socManager);
-      });
-
-      afterEach(async () => {
-        await deleteUserAndRole(getService, detectionAdmin);
-        await deleteUserAndRole(getService, socManager);
-        await deleteAllExceptions(supertest, log);
-      });
-
-      it('Add comment on a new exception, add another comment has unicode from a different user', async () => {
-        await supertestWithoutAuth
-          .post(EXCEPTION_LIST_URL)
-          .auth(detectionAdmin, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send(getCreateExceptionListDetectionSchemaMock())
-          .expect(200);
-
-        const { os_types, ...ruleException } = getCreateExceptionListItemMinimalSchemaMock();
-
-        // Add comment by the Detection Admin
-        await supertestWithoutAuth
-          .post(EXCEPTION_LIST_ITEM_URL)
-          .auth(detectionAdmin, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send({
-            ...ruleException,
-            comments: [{ comment: 'Comment by user@detections_admin' }],
-          })
-          .expect(200);
-
-        const { body: items } = await supertestWithoutAuth
-          .get(
-            `${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${
-              getCreateExceptionListMinimalSchemaMock().list_id
-            }`
-          )
-          .auth(detectionAdmin, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send()
-          .expect(200);
-
-        // Validate the first user comment
-        expect(items.total).toEqual(1);
-        const [item] = items.data;
-        const detectionAdminComments = item.comments;
-        expect(detectionAdminComments.length).toEqual(1);
-
-        expect(detectionAdminComments[0]).toEqual(
-          expect.objectContaining({
-            created_by: 'detections_admin',
-            comment: 'Comment by user@detections_admin',
-          })
-        );
-
-        const expectedId = item.id;
-
-        // Update exception comment by different user Soc-manager
-        const { item_id: _, ...updateItemWithoutItemId } =
-          getUpdateMinimalExceptionListItemSchemaMock();
-
-        const updatePayload: UpdateExceptionListItemSchema = {
-          ...updateItemWithoutItemId,
-          comments: [
-            ...(updateItemWithoutItemId.comments || []),
-            { comment: 'Comment by user@soc_manager' },
-          ],
-          id: expectedId,
-        };
-        await supertestWithoutAuth
-          .put(EXCEPTION_LIST_ITEM_URL)
-          .auth(socManager, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send(updatePayload)
-          .expect(200);
-
-        const { body: itemsAfterUpdate } = await supertest
-          .get(
-            `${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${
-              getCreateExceptionListMinimalSchemaMock().list_id
-            }`
-          )
-          .auth(socManager, 'changeme')
-          .set('kbn-xsrf', 'true')
-          .send()
-          .expect(200);
-        const [itemAfterUpdate] = itemsAfterUpdate.data;
-        const detectionAdminAndSocManagerComments = itemAfterUpdate.comments;
-
-        expect(detectionAdminAndSocManagerComments.length).toEqual(2);
-
-        expect(detectionAdminAndSocManagerComments).toEqual(
-          expect.arrayContaining([
-            expect.objectContaining({
-              created_by: 'detections_admin',
-              comment: 'Comment by user@detections_admin',
-            }),
-            expect.objectContaining({
-              created_by: 'soc_manager',
-              comment: 'Comment by user@soc_manager',
-            }),
-          ])
-        );
-      });
-    });
   });
 };
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/rule_exception_synchronizations.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/rule_exception_synchronizations.ts
new file mode 100644
index 0000000000000..d89055f698ce6
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/rule_exception_synchronizations.ts
@@ -0,0 +1,177 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+/* eslint-disable @typescript-eslint/naming-convention */
+
+import expect from 'expect';
+
+import {
+  EXCEPTION_LIST_ITEM_URL,
+  EXCEPTION_LIST_URL,
+  LIST_URL,
+} from '@kbn/securitysolution-list-constants';
+import type {
+  QueryRuleCreateProps,
+  RuleCreateProps,
+} from '@kbn/security-solution-plugin/common/api/detection_engine';
+import { getCreateExceptionListDetectionSchemaMock } from '@kbn/lists-plugin/common/schemas/request/create_exception_list_schema.mock';
+import {
+  deleteAllAlerts,
+  getSimpleRule,
+  createRuleWithExceptionEntries,
+  deleteAllRules,
+  createRule,
+} from '../../../utils';
+import {
+  createListsIndex,
+  deleteAllExceptions,
+  deleteListsIndex,
+  importFile,
+} from '../../../../../../lists_api_integration/utils';
+import { FtrProviderContext } from '../../../../../ftr_provider_context';
+
+export default ({ getService }: FtrProviderContext) => {
+  const supertest = getService('supertest');
+  const log = getService('log');
+  const es = getService('es');
+
+  describe('@serverless @ess Synchronizations', () => {
+    afterEach(async () => {
+      await deleteAllAlerts(supertest, log, es);
+      await deleteAllRules(supertest, log);
+      await deleteAllExceptions(supertest, log);
+    });
+    /*
+        This test to mimic if we have two browser tabs, and the user tried to 
+        edit an exception in a tab after deleting it in another 
+      */
+    it('should Not edit an exception after being deleted', async () => {
+      const { list_id: skippedListId, ...newExceptionItem } =
+        getCreateExceptionListDetectionSchemaMock();
+      const {
+        body: { id, list_id, namespace_type, type },
+      } = await supertest
+        .post(EXCEPTION_LIST_URL)
+        .set('kbn-xsrf', 'true')
+        .send(newExceptionItem)
+        .expect(200);
+
+      const ruleWithException: RuleCreateProps = {
+        ...getSimpleRule(),
+        exceptions_list: [
+          {
+            id,
+            list_id,
+            namespace_type,
+            type,
+          },
+        ],
+      };
+
+      await createRule(supertest, log, ruleWithException);
+
+      // Delete the exception
+      await supertest
+        .delete(`${EXCEPTION_LIST_ITEM_URL}?id=${id}&namespace_type=single`)
+        .set('kbn-xsrf', 'true')
+        .send()
+        .expect(200);
+
+      // Edit after delete as if it was opened in another browser tab
+      const { body } = await supertest
+        .put(`${EXCEPTION_LIST_ITEM_URL}`)
+        .set('kbn-xsrf', 'true')
+        .send({
+          id: list_id,
+          item_id: id,
+          name: 'edit',
+          entries: [{ field: 'ss', operator: 'included', type: 'match', value: 'ss' }],
+          namespace_type,
+          description: 'Exception list item - Edit',
+          type: 'simple',
+        })
+        .expect(404);
+
+      expect(body).toEqual({
+        message: `exception list item id: "${list_id}" does not exist`,
+        status_code: 404,
+      });
+    });
+    /*
+        This test to mimic if we have two browser tabs, and the user tried to 
+        edit an exception with value-list was deleted in another tab
+      */
+    it('should Not allow editing an Exception with deleted ValueList', async () => {
+      await createListsIndex(supertest, log);
+
+      const valueListId = 'value-list-id';
+      await importFile(supertest, log, 'keyword', ['suricata-sensor-amsterdam'], valueListId);
+      const rule: QueryRuleCreateProps = {
+        ...getSimpleRule(),
+        query: 'host.name: "suricata-sensor-amsterdam"',
+      };
+      const { exceptions_list: exceptionsList } = await createRuleWithExceptionEntries(
+        supertest,
+        log,
+        rule,
+        [
+          [
+            {
+              field: 'host.name',
+              operator: 'included',
+              type: 'list',
+              list: {
+                id: valueListId,
+                type: 'keyword',
+              },
+            },
+          ],
+        ]
+      );
+
+      const deleteReferences = false;
+      const ignoreReferences = true;
+
+      const { id, list_id, namespace_type } = exceptionsList[0];
+
+      // Delete the value list
+      await supertest
+        .delete(
+          `${LIST_URL}?deleteReferences=${deleteReferences}&id=${valueListId}&ignoreReferences=${ignoreReferences}`
+        )
+        .set('kbn-xsrf', 'true')
+        .send()
+        .expect(200);
+
+      // edit the exception with the deleted value list
+      await supertest
+        .put(`${EXCEPTION_LIST_ITEM_URL}`)
+        .set('kbn-xsrf', 'true')
+        .send({
+          id: list_id,
+          item_id: id,
+          name: 'edit',
+          entries: [
+            {
+              field: 'host.name',
+              operator: 'included',
+              type: 'list',
+              list: {
+                id: valueListId,
+                type: 'keyword',
+              },
+            },
+          ],
+          namespace_type,
+          description: 'Exception list item - Edit',
+          type: 'simple',
+        })
+        .expect(404);
+
+      await deleteListsIndex(supertest, log);
+    });
+  });
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/ess.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts
similarity index 73%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/ess.config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts
index 98564672f53c0..4fbad71828a44 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/ess.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts
@@ -9,14 +9,14 @@ import { FtrConfigProviderContext } from '@kbn/test';
 
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   const functionalConfig = await readConfigFile(
-    require.resolve('../../config/ess/config.base.trial.ts')
+    require.resolve('../../../../../config/ess/config.base.trial')
   );
 
   return {
     ...functionalConfig.getAll(),
-    testFiles: [require.resolve('.')],
+    testFiles: [require.resolve('..')],
     junit: {
-      reportName: 'Detection Engine ESS API Integration Tests',
+      reportName: 'Detection Engine ESS/ Rule creation API Integration Tests',
     },
   };
 }
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/serverless.config.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts
similarity index 60%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/serverless.config.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts
index 8e9cbe781e5aa..3c214b340ab74 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/serverless.config.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-import { createTestConfig } from '../../config/serverless/config.base';
+import { createTestConfig } from '../../../../../config/serverless/config.base';
 
 export default createTestConfig({
-  testFiles: [require.resolve('.')],
+  testFiles: [require.resolve('..')],
   junit: {
-    reportName: 'Detection Engine Serverless API Integration Tests',
+    reportName: 'Detection Engine Serverless/ Rule creation API Integration Tests',
   },
 });
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rule_creation/create_rules.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/create_rules.ts
similarity index 99%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/rule_creation/create_rules.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/create_rules.ts
index 2cc5afa9f7340..297470d452d4e 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rule_creation/create_rules.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/create_rules.ts
@@ -17,7 +17,7 @@ import { RuleCreateProps } from '@kbn/security-solution-plugin/common/api/detect
 import { ExceptionListTypeEnum } from '@kbn/securitysolution-io-ts-list-types';
 import { ROLES } from '@kbn/security-solution-plugin/common/test';
 
-import { FtrProviderContext } from '../../../ftr_provider_context';
+import { FtrProviderContext } from '../../../../ftr_provider_context';
 import {
   createAlertsIndex,
   deleteAllRules,
@@ -43,12 +43,12 @@ import {
   getActionsWithoutFrequencies,
   getSomeActionsWithFrequencies,
   updateUsername,
-} from '../utils';
+} from '../../utils';
 import {
   createUserAndRole,
   deleteUserAndRole,
-} from '../../../../common/services/security_solution';
-import { EsArchivePathBuilder } from '../../../es_archive_path_builder';
+} from '../../../../../common/services/security_solution';
+import { EsArchivePathBuilder } from '../../../../es_archive_path_builder';
 
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
@@ -56,6 +56,7 @@ export default ({ getService }: FtrProviderContext) => {
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const log = getService('log');
   const es = getService('es');
+  // TODO: add a new service
   const config = getService('config');
   const ELASTICSEARCH_USERNAME = config.get('servers.kibana.username');
   const isServerless = config.get('serverless');
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rule_creation/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/index.ts
similarity index 85%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/rule_creation/index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/index.ts
index e6069caf96ee0..49268f31ed9f9 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rule_creation/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/index.ts
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { FtrProviderContext } from '../../../ftr_provider_context';
+import { FtrProviderContext } from '../../../../ftr_provider_context';
 
 export default function ({ loadTestFile }: FtrProviderContext) {
   describe('Rule creation API', function () {
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/exceptions/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/exceptions/index.ts
deleted file mode 100644
index 171e6a095d8a5..0000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/exceptions/index.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { FtrProviderContext } from '../../../ftr_provider_context';
-
-export default function ({ loadTestFile }: FtrProviderContext) {
-  describe('Exceptions API', function () {
-    loadTestFile(require.resolve('./rule_exception/create_rule_exceptions'));
-  });
-}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/index.ts
deleted file mode 100644
index 1a507b5ffd8e1..0000000000000
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/index.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrProviderContext } from '../../ftr_provider_context';
-
-export default function ({ loadTestFile }: FtrProviderContext) {
-  describe('Detections response API', function () {
-    loadTestFile(require.resolve('./exceptions'));
-    loadTestFile(require.resolve('./rule_creation'));
-  });
-}
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/action/get_slack_action.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/get_slack_action.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/action/get_slack_action.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/get_slack_action.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/action/get_web_hook_action.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/get_web_hook_action.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/action/get_web_hook_action.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/get_web_hook_action.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/index.ts
new file mode 100644
index 0000000000000..438d983a69e05
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export * from './get_slack_action';
+export * from './get_web_hook_action';
+export * from './remove_uuid_from_actions';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/action/remove_uuid_from_actions.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/remove_uuid_from_actions.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/action/remove_uuid_from_actions.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/actions/remove_uuid_from_actions.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/create_alerts_index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/create_alerts_index.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/create_alerts_index.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/create_alerts_index.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/delete_all_alerts.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/delete_all_alerts.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/delete_all_alerts.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/delete_all_alerts.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_alerts_by_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_alerts_by_id.ts
new file mode 100644
index 0000000000000..1a3f7e29c26c6
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_alerts_by_id.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import type SuperTest from 'supertest';
+import { SearchResponse } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import type { DetectionAlert } from '@kbn/security-solution-plugin/common/api/detection_engine';
+
+import { DETECTION_ENGINE_QUERY_SIGNALS_URL as DETECTION_ENGINE_QUERY_ALERTS_URL } from '@kbn/security-solution-plugin/common/constants';
+import { countDownTest } from '../count_down_test';
+import { getQueryAlertsId } from './get_query_alerts_ids';
+
+/**
+ * Given a single rule id this will return only alerts based on that rule id.
+ * @param supertest agent
+ * @param ids Rule id
+ */
+export const getAlertsById = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
+  id: string
+): Promise<SearchResponse<DetectionAlert>> => {
+  const alertsOpen = await countDownTest<SearchResponse<DetectionAlert>>(
+    async () => {
+      const response = await supertest
+        .post(DETECTION_ENGINE_QUERY_ALERTS_URL)
+        .set('kbn-xsrf', 'true')
+        .send(getQueryAlertsId([id]));
+      if (response.status !== 200) {
+        return {
+          passed: false,
+          returnValue: undefined,
+        };
+      } else {
+        return {
+          passed: true,
+          returnValue: response.body,
+        };
+      }
+    },
+    'getAlertsById',
+    log
+  );
+  if (alertsOpen == null) {
+    throw new Error('Alerts not defined after countdown, cannot continue');
+  } else {
+    return alertsOpen;
+  }
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/get_alerts_by_ids.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_alerts_by_ids.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/get_alerts_by_ids.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_alerts_by_ids.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_open_alerts.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_open_alerts.ts
new file mode 100644
index 0000000000000..26e2459d7e2a3
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_open_alerts.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type SuperTest from 'supertest';
+import type { Client } from '@elastic/elasticsearch';
+import type { ToolingLog } from '@kbn/tooling-log';
+import {
+  RuleExecutionStatus,
+  RuleExecutionStatusEnum,
+} from '@kbn/security-solution-plugin/common/api/detection_engine/rule_monitoring';
+import type { RuleResponse } from '@kbn/security-solution-plugin/common/api/detection_engine';
+
+import { waitForRuleStatus } from '../rules';
+import { refreshIndex } from '..';
+import { getAlertsByIds } from './get_alerts_by_ids';
+
+export const getOpenAlerts = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
+  es: Client,
+  rule: RuleResponse,
+  status: RuleExecutionStatus = RuleExecutionStatusEnum.succeeded,
+  size?: number,
+  afterDate?: Date
+) => {
+  await waitForRuleStatus(status, { supertest, log, id: rule.id, afterDate });
+  // Critically important that we wait for rule success AND refresh the write index in that order before we
+  // assert that no Alerts were created. Otherwise, Alerts could be written but not available to query yet
+  // when we search, causing tests that check that Alerts are NOT created to pass when they should fail.
+  await refreshIndex(es, '.alerts-security.alerts-default*');
+  return getAlertsByIds(supertest, log, [rule.id], size);
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/get_query_alerts_ids.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_query_alerts_ids.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/get_query_alerts_ids.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/get_query_alerts_ids.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/index.ts
new file mode 100644
index 0000000000000..0671df4d65c36
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+// TODO rename signal to alert
+export * from './create_alerts_index';
+export * from './delete_all_alerts';
+export * from './wait_for_alert_to_complete';
+export * from './wait_for_alerts_to_be_present';
+export * from './wait_for_alert_to_complete';
+export * from './get_open_alerts';
+export * from './get_alerts_by_ids';
+export * from './get_query_alerts_ids';
+export * from './get_alerts_by_id';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/wait_for_alert_to_complete.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/wait_for_alert_to_complete.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/wait_for_alert_to_complete.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/wait_for_alert_to_complete.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/wait_for_alerts_to_be_present.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/wait_for_alerts_to_be_present.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alert/wait_for_alerts_to_be_present.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/alerts/wait_for_alerts_to_be_present.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/count_down_es.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/count_down_es.ts
new file mode 100644
index 0000000000000..cfbcafbc06cb6
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/count_down_es.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { TransportResult } from '@elastic/elasticsearch';
+import type { ToolingLog } from '@kbn/tooling-log';
+import { countDownTest } from './count_down_test';
+
+/**
+ * Does a plain countdown and checks against es queries for either conflicts in the error
+ * or for any over the wire issues such as timeouts or temp 404's to make the tests more
+ * reliant.
+ * @param esFunction The function to test against
+ * @param esFunctionName The name of the function to print if we encounter errors
+ * @param log The tooling logger
+ * @param retryCount The number of times to retry before giving up (has default)
+ * @param timeoutWait Time to wait before trying again (has default)
+ */
+export const countDownES = async (
+  esFunction: () => Promise<TransportResult<Record<string, any>, unknown>>,
+  esFunctionName: string,
+  log: ToolingLog,
+  retryCount: number = 50,
+  timeoutWait = 250
+): Promise<void> => {
+  await countDownTest(
+    async () => {
+      const result = await esFunction();
+      if (result.body.version_conflicts !== 0) {
+        return {
+          passed: false,
+          errorMessage: 'Version conflicts for ${result.body.version_conflicts}',
+        };
+      } else {
+        return { passed: true };
+      }
+    },
+    esFunctionName,
+    log,
+    retryCount,
+    timeoutWait
+  );
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/index.ts
new file mode 100644
index 0000000000000..9fee06e191b86
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/index.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export * from './list/create_exception_list';
+export * from './list/delete_exception_list';
+export * from './list/create_container_with_entries';
+export * from './list/create_container_with_endpoint_entries';
+
+export * from './item/create_exception_list_item';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/item/create_exception_list_item.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/item/create_exception_list_item.ts
new file mode 100644
index 0000000000000..fccbd3e243b17
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/item/create_exception_list_item.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import type SuperTest from 'supertest';
+import type {
+  CreateExceptionListItemSchema,
+  ExceptionListItemSchema,
+} from '@kbn/securitysolution-io-ts-list-types';
+
+import { EXCEPTION_LIST_ITEM_URL } from '@kbn/securitysolution-list-constants';
+
+/**
+ * Helper to cut down on the noise in some of the tests. This checks for
+ * an expected 200 still and does not try to any retries. Creates exception lists
+ * @param supertest The supertest deps
+ * @param exceptionListItem The exception list item to create
+ * @param log The tooling logger
+ */
+export const createExceptionListItem = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
+  exceptionListItem: CreateExceptionListItemSchema
+): Promise<ExceptionListItemSchema> => {
+  const response = await supertest
+    .post(EXCEPTION_LIST_ITEM_URL)
+    .set('kbn-xsrf', 'true')
+    .send(exceptionListItem);
+
+  if (response.status !== 200) {
+    log.error(
+      `Did not get an expected 200 "ok" when creating an exception list item (createExceptionListItem). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
+        response.body
+      )}, status: ${JSON.stringify(response.status)}`
+    );
+  }
+  return response.body;
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/create_container_with_endpoint_entries.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/create_container_with_endpoint_entries.ts
new file mode 100644
index 0000000000000..9c48f80019c4e
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/create_container_with_endpoint_entries.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import type SuperTest from 'supertest';
+import type {
+  CreateExceptionListItemSchema,
+  ListArray,
+  NonEmptyEntriesArray,
+  OsTypeArray,
+} from '@kbn/securitysolution-io-ts-list-types';
+
+import { EXCEPTION_LIST_ITEM_URL } from '@kbn/securitysolution-list-constants';
+import { createExceptionListItem } from '../item/create_exception_list_item';
+import { waitFor } from '../../wait_for';
+import { createExceptionList } from './create_exception_list';
+
+/**
+ * Convenience testing function where you can pass in just the endpoint entries and you will
+ * get a container created with the entries.
+ * @param supertest super test agent
+ * @param endpointEntries The endpoint entries to create the rule and exception list from
+ * @param osTypes The os types to optionally add or not to add to the container
+ */
+export const createContainerWithEndpointEntries = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
+  endpointEntries: Array<{
+    entries: NonEmptyEntriesArray;
+    osTypes: OsTypeArray | undefined;
+  }>
+): Promise<ListArray> => {
+  // If not given any endpoint entries, return without any
+  if (endpointEntries.length === 0) {
+    return [];
+  }
+
+  // create the endpoint exception list container
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  const { id, list_id, namespace_type, type } = await createExceptionList(supertest, log, {
+    description: 'endpoint description',
+    list_id: 'endpoint_list',
+    name: 'endpoint_list',
+    type: 'endpoint',
+  });
+
+  // Add the endpoint exception list container to the backend
+  await Promise.all(
+    endpointEntries.map((endpointEntry) => {
+      const exceptionListItem: CreateExceptionListItemSchema = {
+        description: 'endpoint description',
+        entries: endpointEntry.entries,
+        list_id: 'endpoint_list',
+        name: 'endpoint_list',
+        os_types: endpointEntry.osTypes,
+        type: 'simple',
+      };
+      return createExceptionListItem(supertest, log, exceptionListItem);
+    })
+  );
+
+  // To reduce the odds of in-determinism and/or bugs we ensure we have
+  // the same length of entries before continuing.
+  await waitFor(
+    async () => {
+      const { body } = await supertest.get(`${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`);
+      return body.data.length === endpointEntries.length;
+    },
+    `within createContainerWithEndpointEntries ${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`,
+    log
+  );
+
+  return [
+    {
+      id,
+      list_id,
+      namespace_type,
+      type,
+    },
+  ];
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/create_container_with_entries.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/create_container_with_entries.ts
new file mode 100644
index 0000000000000..dba2a1e1e3276
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/create_container_with_entries.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import type SuperTest from 'supertest';
+import type { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import type { ListArray, NonEmptyEntriesArray } from '@kbn/securitysolution-io-ts-list-types';
+
+import { EXCEPTION_LIST_ITEM_URL } from '@kbn/securitysolution-list-constants';
+import { createExceptionList } from './create_exception_list';
+import { createExceptionListItem } from '../item/create_exception_list_item';
+import { waitFor } from '../../wait_for';
+
+/**
+ * Convenience testing function where you can pass in just the endpoint entries and you will
+ * get a container created with the entries.
+ * @param supertest super test agent
+ * @param entries The entries to create the rule and exception list from
+ * @param osTypes The os types to optionally add or not to add to the container
+ */
+export const createContainerWithEntries = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
+  entries: NonEmptyEntriesArray[]
+): Promise<ListArray> => {
+  // If not given any endpoint entries, return without any
+  if (entries.length === 0) {
+    return [];
+  }
+  // Create the rule exception list container
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  const { id, list_id, namespace_type, type } = await createExceptionList(supertest, log, {
+    description: 'some description',
+    list_id: 'some-list-id',
+    name: 'some name',
+    type: 'detection',
+  });
+
+  // Add the rule exception list container to the backend
+  await Promise.all(
+    entries.map((entry) => {
+      const exceptionListItem: CreateExceptionListItemSchema = {
+        description: 'some description',
+        list_id: 'some-list-id',
+        name: 'some name',
+        type: 'simple',
+        entries: entry,
+      };
+      return createExceptionListItem(supertest, log, exceptionListItem);
+    })
+  );
+
+  // To reduce the odds of in-determinism and/or bugs we ensure we have
+  // the same length of entries before continuing.
+  await waitFor(
+    async () => {
+      const { body } = await supertest.get(`${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`);
+      return body.data.length === entries.length;
+    },
+    `within createContainerWithEntries ${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`,
+    log
+  );
+
+  return [
+    {
+      id,
+      list_id,
+      namespace_type,
+      type,
+    },
+  ];
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/exception_list/create_exception_list.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/create_exception_list.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/exception_list/create_exception_list.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/create_exception_list.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/exception_list/delete_exception_list.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/delete_exception_list.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/exception_list/delete_exception_list.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/exception_list_and_item/list/delete_exception_list.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/index.ts
index 15681d103d8a0..571ed891d22fd 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/index.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/index.ts
@@ -4,38 +4,12 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-export * from './rule/get_rule';
-export * from './rule/get_simple_rule';
-export * from './rule/create_rule';
-export * from './rule/delete_all_rules';
-export * from './rule/delete_rule';
-export * from './rule/get_simple_rule_output';
-export * from './rule/get_simple_rule_output_without_rule_id';
-export * from './rule/get_simple_rule_without_rule_id';
-export * from './rule/get_simple_rule_without_rule_id';
-export * from './rule/remove_server_generated_properties';
-export * from './rule/remove_server_generated_properties_including_rule_id';
-export * from './rule/get_simple_ml_rule';
-export * from './rule/get_simple_ml_rule_output';
-export * from './rule/wait_for_rule_status';
-export * from './rule/get_rule_for_alert_testing_with_timestamp_override';
-export * from './rule/get_rule_for_alert_testing';
-export * from './rule/get_threshold_rule_for_alert_testing';
-export * from './rule/get_rule_actions';
-
-export * from './exception_list_and_item/exception_list/create_exception_list';
-export * from './exception_list_and_item/exception_list/delete_exception_list';
-
-// TODO rename signal to alert
-export * from './alert/create_alerts_index';
-export * from './alert/delete_all_alerts';
-export * from './alert/wait_for_alert_to_complete';
-export * from './alert/wait_for_alerts_to_be_present';
-export * from './alert/wait_for_alert_to_complete';
-
-export * from './action/get_slack_action';
-export * from './action/get_web_hook_action';
-export * from './action/remove_uuid_from_actions';
+export * from './rules';
+export * from './exception_list_and_item';
+export * from './alerts';
+export * from './actions';
 
 export * from './count_down_test';
+export * from './count_down_es';
 export * from './update_username';
+export * from './refresh_index';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/refresh_index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/refresh_index.ts
new file mode 100644
index 0000000000000..f888216cb6eed
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/refresh_index.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Client } from '@elastic/elasticsearch';
+
+/**
+ * Refresh an index, making changes available to search.
+ * Useful for tests where we want to ensure that a rule does NOT create alerts, e.g. testing exceptions.
+ * @param es The ElasticSearch handle
+ */
+export const refreshIndex = async (es: Client, index?: string) => {
+  await es.indices.refresh({
+    index,
+  });
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/create_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/create_rule.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/create_rule.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/create_rule.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/create_rule_with_exception_entries.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/create_rule_with_exception_entries.ts
new file mode 100644
index 0000000000000..ea608c48e7b8b
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/create_rule_with_exception_entries.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import type SuperTest from 'supertest';
+import type { NonEmptyEntriesArray, OsTypeArray } from '@kbn/securitysolution-io-ts-list-types';
+import type {
+  RuleCreateProps,
+  RuleResponse,
+} from '@kbn/security-solution-plugin/common/api/detection_engine';
+
+import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common/constants';
+import {
+  createContainerWithEntries,
+  createContainerWithEndpointEntries,
+} from '../exception_list_and_item';
+import { createRule } from './create_rule';
+
+/**
+ * Convenience testing function where you can pass in just the entries and you will
+ * get a rule created with the entries added to an exception list and exception list item
+ * all auto-created at once.
+ * @param supertest super test agent
+ * @param rule The rule to create and attach an exception list to
+ * @param entries The entries to create the rule and exception list from
+ * @param endpointEntries The endpoint entries to create the rule and exception list from
+ * @param osTypes The os types to optionally add or not to add to the container
+ */
+export const createRuleWithExceptionEntries = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
+  rule: RuleCreateProps,
+  entries: NonEmptyEntriesArray[],
+  endpointEntries?: Array<{
+    entries: NonEmptyEntriesArray;
+    osTypes: OsTypeArray | undefined;
+  }>
+): Promise<RuleResponse> => {
+  const maybeExceptionList = await createContainerWithEntries(supertest, log, entries);
+  const maybeEndpointList = await createContainerWithEndpointEntries(
+    supertest,
+    log,
+    endpointEntries ?? []
+  );
+
+  // create the rule but don't run it immediately as running it immediately can cause
+  // the rule to sometimes not filter correctly the first time with an exception list
+  // or other timing issues. Then afterwards wait for the rule to have succeeded before
+  // returning.
+  const ruleWithException: RuleCreateProps = {
+    ...rule,
+    enabled: false,
+    exceptions_list: [...maybeExceptionList, ...maybeEndpointList],
+  };
+  const ruleResponse = await createRule(supertest, log, ruleWithException);
+  const response = await supertest
+    .patch(DETECTION_ENGINE_RULES_URL)
+    .set('kbn-xsrf', 'true')
+    .set('elastic-api-version', '2023-10-31')
+    .send({ rule_id: ruleResponse.rule_id, enabled: true });
+
+  if (response.status !== 200) {
+    log.error(
+      `Did not get an expected 200 "ok" when patching a rule with exception entries (createRuleWithExceptionEntries). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
+        response.body
+      )}, status: ${JSON.stringify(response.status)}`
+    );
+  }
+  return ruleResponse;
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/delete_all_rules.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/delete_all_rules.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/delete_all_rules.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/delete_all_rules.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/delete_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/delete_rule.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/delete_rule.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/delete_rule.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/downgrade_immutable_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/downgrade_immutable_rule.ts
new file mode 100644
index 0000000000000..fc81e2fc30cb4
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/downgrade_immutable_rule.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import type { Client } from '@elastic/elasticsearch';
+import { ALERTING_CASES_SAVED_OBJECT_INDEX } from '@kbn/core-saved-objects-server';
+import { countDownES } from '../count_down_es';
+
+export const downgradeImmutableRule = async (
+  es: Client,
+  log: ToolingLog,
+  ruleId: string
+): Promise<void> => {
+  return countDownES(
+    async () => {
+      return es.updateByQuery(
+        {
+          index: ALERTING_CASES_SAVED_OBJECT_INDEX,
+          refresh: true,
+          wait_for_completion: true,
+          body: {
+            script: {
+              lang: 'painless',
+              source: 'ctx._source.alert.params.version--',
+            },
+            query: {
+              term: {
+                'alert.params.ruleId': ruleId,
+              },
+            },
+          },
+        },
+        { meta: true }
+      );
+    },
+    'downgradeImmutableRule',
+    log
+  );
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/find_immutable_rule_by_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/find_immutable_rule_by_id.ts
new file mode 100644
index 0000000000000..55e7375c48986
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/find_immutable_rule_by_id.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ToolingLog } from '@kbn/tooling-log';
+import type SuperTest from 'supertest';
+import type { RuleResponse } from '@kbn/security-solution-plugin/common/api/detection_engine';
+
+import { DETECTION_ENGINE_RULES_URL } from '@kbn/security-solution-plugin/common/constants';
+
+/**
+ * Helper to cut down on the noise in some of the tests. This
+ * uses the find API to get an immutable rule by id.
+ * @param supertest The supertest deps
+ */
+export const findImmutableRuleById = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
+  ruleId: string
+): Promise<{
+  page: number;
+  perPage: number;
+  total: number;
+  data: RuleResponse[];
+}> => {
+  const response = await supertest
+    .get(
+      `${DETECTION_ENGINE_RULES_URL}/_find?filter=alert.attributes.params.immutable: true AND alert.attributes.params.ruleId: "${ruleId}"`
+    )
+    .set('kbn-xsrf', 'true')
+    .set('elastic-api-version', '2023-10-31')
+    .send();
+  if (response.status !== 200) {
+    log.error(
+      `Did not get an expected 200 "ok" when finding an immutable rule by id (findImmutableRuleById). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
+        response.body
+      )}, status: ${JSON.stringify(response.status)}`
+    );
+  }
+  return response.body;
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_eql_rule_for_alert_testing.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_eql_rule_for_alert_testing.ts
new file mode 100644
index 0000000000000..b8253e0f9afec
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_eql_rule_for_alert_testing.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { EqlRuleCreateProps } from '@kbn/security-solution-plugin/common/api/detection_engine';
+import { getRuleForAlertTesting } from './get_rule_for_alert_testing';
+
+/**
+ * This is a typical alert testing rule that is easy for most basic testing of output of EQL alerts.
+ * It starts out in an enabled true state. The 'from' is set very far back to test the basics of alert
+ * creation for EQL and testing by getting all the alerts at once.
+ * @param ruleId The optional ruleId which is eql-rule by default.
+ * @param enabled Enables the rule on creation or not. Defaulted to true.
+ */
+export const getEqlRuleForAlertTesting = (
+  index: string[],
+  ruleId = 'eql-rule',
+  enabled = true
+): EqlRuleCreateProps => ({
+  ...getRuleForAlertTesting(index, ruleId, enabled),
+  type: 'eql',
+  language: 'eql',
+  query: 'any where true',
+});
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_rule.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_rule_actions.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_actions.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_rule_actions.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_actions.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_rule_for_alert_testing.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_rule_for_alert_testing.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_rule_for_alert_testing_with_timestamp_override.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing_with_timestamp_override.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_rule_for_alert_testing_with_timestamp_override.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_rule_for_alert_testing_with_timestamp_override.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_ml_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_ml_rule.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_ml_rule_output.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule_output.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_ml_rule_output.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_ml_rule_output.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_rule.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_rule.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_rule_output.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_output.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_rule_output.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_output.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_rule_output_without_rule_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_output_without_rule_id.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_rule_output_without_rule_id.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_output_without_rule_id.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_rule_without_rule_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_without_rule_id.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_simple_rule_without_rule_id.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_simple_rule_without_rule_id.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_threshold_rule_for_alert_testing.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_threshold_rule_for_alert_testing.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/get_threshold_rule_for_alert_testing.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/get_threshold_rule_for_alert_testing.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/index.ts
new file mode 100644
index 0000000000000..ba91dea27743e
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/index.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export * from './get_rule';
+export * from './get_simple_rule';
+export * from './create_rule';
+export * from './delete_all_rules';
+export * from './delete_rule';
+export * from './get_simple_rule_output';
+export * from './get_simple_rule_output_without_rule_id';
+export * from './get_simple_rule_without_rule_id';
+export * from './get_simple_rule_without_rule_id';
+export * from './remove_server_generated_properties';
+export * from './remove_server_generated_properties_including_rule_id';
+export * from './get_simple_ml_rule';
+export * from './get_simple_ml_rule_output';
+export * from './wait_for_rule_status';
+export * from './get_rule_for_alert_testing_with_timestamp_override';
+export * from './get_rule_for_alert_testing';
+export * from './get_threshold_rule_for_alert_testing';
+export * from './get_rule_actions';
+export * from './find_immutable_rule_by_id';
+export * from './create_rule_with_exception_entries';
+export * from './downgrade_immutable_rule';
+export * from './get_eql_rule_for_alert_testing';
+
+export * from './prebuilt_rules';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/create_prebuilt_rule_saved_objects.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/create_prebuilt_rule_saved_objects.ts
new file mode 100644
index 0000000000000..0b4bfd9254b15
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/create_prebuilt_rule_saved_objects.ts
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Client } from '@elastic/elasticsearch';
+import { PrebuiltRuleAsset } from '@kbn/security-solution-plugin/server/lib/detection_engine/prebuilt_rules';
+import {
+  getPrebuiltRuleMock,
+  getPrebuiltRuleWithExceptionsMock,
+} from '@kbn/security-solution-plugin/server/lib/detection_engine/prebuilt_rules/mocks';
+import { ELASTIC_SECURITY_RULE_ID } from '@kbn/security-solution-plugin/common';
+import { SECURITY_SOLUTION_SAVED_OBJECT_INDEX } from '@kbn/core-saved-objects-server';
+
+/**
+ * A helper function to create a rule asset saved object
+ *
+ * @param overrideParams Params to override the default mock
+ * @returns Created rule asset saved object
+ */
+export const createRuleAssetSavedObject = (overrideParams: Partial<PrebuiltRuleAsset>) => ({
+  'security-rule': {
+    ...getPrebuiltRuleMock(),
+    ...overrideParams,
+  },
+  type: 'security-rule',
+  references: [],
+  coreMigrationVersion: '8.6.0',
+  updated_at: '2022-11-01T12:56:39.717Z',
+  created_at: '2022-11-01T12:56:39.717Z',
+});
+
+export const SAMPLE_PREBUILT_RULES = [
+  createRuleAssetSavedObject({
+    ...getPrebuiltRuleWithExceptionsMock(),
+    rule_id: ELASTIC_SECURITY_RULE_ID,
+    tags: ['test-tag-1'],
+    enabled: true,
+  }),
+  createRuleAssetSavedObject({
+    rule_id: '000047bb-b27a-47ec-8b62-ef1a5d2c9e19',
+    tags: ['test-tag-2'],
+  }),
+  createRuleAssetSavedObject({
+    rule_id: '00140285-b827-4aee-aa09-8113f58a08f3',
+    tags: ['test-tag-3'],
+  }),
+];
+
+export const SAMPLE_PREBUILT_RULES_WITH_HISTORICAL_VERSIONS = [
+  createRuleAssetSavedObject({ rule_id: 'rule-1', version: 1 }),
+  createRuleAssetSavedObject({ rule_id: 'rule-1', version: 2 }),
+  createRuleAssetSavedObject({ rule_id: 'rule-2', version: 1 }),
+  createRuleAssetSavedObject({ rule_id: 'rule-2', version: 2 }),
+  createRuleAssetSavedObject({ rule_id: 'rule-2', version: 3 }),
+];
+
+/**
+ * Creates saved objects with prebuilt rule assets which can be used for
+ * installing actual prebuilt rules after that. It creates saved objects with
+ * only latest versions of the rules. Tha matches the behavior of a rules
+ * package without historical versions.
+ *
+ * NOTE: Version is not added to the rule asset saved object id.
+ *
+ * @param es Elasticsearch client
+ */
+export const createPrebuiltRuleAssetSavedObjects = async (
+  es: Client,
+  rules = SAMPLE_PREBUILT_RULES
+): Promise<void> => {
+  await es.bulk({
+    refresh: true,
+    body: rules.flatMap((doc) => [
+      {
+        index: {
+          _index: SECURITY_SOLUTION_SAVED_OBJECT_INDEX,
+          _id: `security-rule:${doc['security-rule'].rule_id}`,
+        },
+      },
+      doc,
+    ]),
+  });
+};
+
+/**
+ * Creates saved objects with prebuilt rule assets which can be used for
+ * installing actual prebuilt rules after that. It creates saved objects with
+ * historical versions of the rules.
+ *
+ * NOTE: Version is added to the rule asset saved object id.
+ *
+ * @param es Elasticsearch client
+ */
+export const createHistoricalPrebuiltRuleAssetSavedObjects = async (
+  es: Client,
+  rules = SAMPLE_PREBUILT_RULES_WITH_HISTORICAL_VERSIONS
+): Promise<void> => {
+  await es.bulk({
+    refresh: true,
+    body: rules.flatMap((doc) => [
+      {
+        index: {
+          _index: SECURITY_SOLUTION_SAVED_OBJECT_INDEX,
+          _id: `security-rule:${doc['security-rule'].rule_id}_${doc['security-rule'].version}`,
+        },
+      },
+      doc,
+    ]),
+  });
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/get_prebuilt_rules_and_timelines_status.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/get_prebuilt_rules_and_timelines_status.ts
new file mode 100644
index 0000000000000..2d03e597dc5af
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/get_prebuilt_rules_and_timelines_status.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  GetPrebuiltRulesAndTimelinesStatusResponse,
+  PREBUILT_RULES_STATUS_URL,
+} from '@kbn/security-solution-plugin/common/api/detection_engine/prebuilt_rules';
+import type SuperTest from 'supertest';
+
+/**
+ * (LEGACY)
+ * Helper to retrieve the prebuilt rules status
+ *
+ * @param supertest The supertest deps
+ */
+export const getPrebuiltRulesAndTimelinesStatus = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>
+): Promise<GetPrebuiltRulesAndTimelinesStatusResponse> => {
+  const response = await supertest
+    .get(PREBUILT_RULES_STATUS_URL)
+    .set('kbn-xsrf', 'true')
+    .set('elastic-api-version', '2023-10-31')
+    .send()
+    .expect(200);
+
+  return response.body;
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/index.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/index.ts
new file mode 100644
index 0000000000000..9970b6b13eeec
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+export * from './create_prebuilt_rule_saved_objects';
+export * from './get_prebuilt_rules_and_timelines_status';
+export * from './install_mock_prebuilt_rules';
+export * from './install_prebuilt_rules_and_timelines';
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/install_mock_prebuilt_rules.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/install_mock_prebuilt_rules.ts
new file mode 100644
index 0000000000000..0e15f416e1238
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/install_mock_prebuilt_rules.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Client } from '@elastic/elasticsearch';
+import { InstallPrebuiltRulesAndTimelinesResponse } from '@kbn/security-solution-plugin/common/api/detection_engine/prebuilt_rules';
+import type SuperTest from 'supertest';
+import { createPrebuiltRuleAssetSavedObjects } from './create_prebuilt_rule_saved_objects';
+import { installPrebuiltRulesAndTimelines } from './install_prebuilt_rules_and_timelines';
+
+/**
+ * Creates prebuilt rule mocks and installs them
+ *
+ * @param supertest Supertest instance
+ * @param es Elasticsearch client
+ * @returns Install prebuilt rules response
+ */
+export const installMockPrebuiltRules = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  es: Client
+): Promise<InstallPrebuiltRulesAndTimelinesResponse> => {
+  // Ensure there are prebuilt rule saved objects before installing rules
+  await createPrebuiltRuleAssetSavedObjects(es);
+  return installPrebuiltRulesAndTimelines(es, supertest);
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/install_prebuilt_rules_and_timelines.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/install_prebuilt_rules_and_timelines.ts
new file mode 100644
index 0000000000000..776af6074e07e
--- /dev/null
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/prebuilt_rules/install_prebuilt_rules_and_timelines.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  InstallPrebuiltRulesAndTimelinesResponse,
+  PREBUILT_RULES_URL,
+} from '@kbn/security-solution-plugin/common/api/detection_engine/prebuilt_rules';
+import type { Client } from '@elastic/elasticsearch';
+import type SuperTest from 'supertest';
+import { ALL_SAVED_OBJECT_INDICES } from '@kbn/core-saved-objects-server';
+
+/**
+ * (LEGACY)
+ * Installs all prebuilt rules and timelines available in Kibana. Rules are
+ * installed from the security-rule saved objects.
+ * This is a legacy endpoint and has been replaced by:
+ * POST /internal/detection_engine/prebuilt_rules/installation/_perform
+ *
+ * - No rules will be installed if there are no security-rule assets (e.g., the
+ *   package is not installed or mocks are not created).
+ *
+ * - If some prebuilt rules are already installed, they will be upgraded in case
+ *   there are newer versions of them in security-rule assets.
+ *
+ * @param supertest SuperTest instance
+ * @returns Install prebuilt rules response
+ */
+export const installPrebuiltRulesAndTimelines = async (
+  es: Client,
+  supertest: SuperTest.SuperTest<SuperTest.Test>
+): Promise<InstallPrebuiltRulesAndTimelinesResponse> => {
+  const response = await supertest
+    .put(PREBUILT_RULES_URL)
+    .set('kbn-xsrf', 'true')
+    .set('elastic-api-version', '2023-10-31')
+    .send()
+    .expect(200);
+
+  // Before we proceed, we need to refresh saved object indices.
+  // At the previous step we installed the prebuilt detection rules SO of type 'security-rule'.
+  // The savedObjectsClient does this with a call with explicit `refresh: false`.
+  // So, despite of the fact that the endpoint waits until the prebuilt rule will be
+  // successfully indexed, it doesn't wait until they become "visible" for subsequent read
+  // operations.
+  // And this is usually what we do next in integration tests: we read these SOs with utility
+  // function such as getPrebuiltRulesAndTimelinesStatus().
+  // This can cause race condition between a write and subsequent read operation, and to
+  // fix it deterministically we have to refresh saved object indices and wait until it's done.
+  await es.indices.refresh({ index: ALL_SAVED_OBJECT_INDICES });
+
+  return response.body;
+};
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/remove_server_generated_properties.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/remove_server_generated_properties.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/remove_server_generated_properties.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/remove_server_generated_properties.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/remove_server_generated_properties_including_rule_id.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/remove_server_generated_properties_including_rule_id.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/remove_server_generated_properties_including_rule_id.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/remove_server_generated_properties_including_rule_id.ts
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/wait_for_rule_status.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/wait_for_rule_status.ts
similarity index 100%
rename from x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rule/wait_for_rule_status.ts
rename to x-pack/test/security_solution_api_integration/test_suites/detections_response/utils/rules/wait_for_rule_status.ts
diff --git a/x-pack/test/security_solution_api_integration/tsconfig.json b/x-pack/test/security_solution_api_integration/tsconfig.json
index 81d57dd0617fb..cb46d96f11a7f 100644
--- a/x-pack/test/security_solution_api_integration/tsconfig.json
+++ b/x-pack/test/security_solution_api_integration/tsconfig.json
@@ -26,6 +26,7 @@
     "@kbn/securitysolution-io-ts-alerting-types",
     "@kbn/tooling-log",
     "@kbn/rule-data-utils",
-    "@kbn/securitysolution-list-constants"
+    "@kbn/securitysolution-list-constants",
+    "@kbn/core-saved-objects-server"
   ]
 }
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts
index 5d56239e74c99..ca90e9b72efd1 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts
@@ -29,6 +29,7 @@ import { visit } from '../../../tasks/navigation';
 
 import { ALERTS_URL } from '../../../urls/navigation';
 
+// FLAKY: https://github.com/elastic/kibana/issues/169091
 describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
   before(() => {
     cy.task('esArchiverLoad', { archiveName: 'auditbeat_big' });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_creation/esql_rule_ess.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_creation/esql_rule_ess.cy.ts
index 254deb99f3259..a22d24a9fd537 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_creation/esql_rule_ess.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_creation/esql_rule_ess.cy.ts
@@ -125,7 +125,7 @@ describe('Detection ES|QL rules, creation', { tags: ['@ess'] }, () => {
       getDefineContinueButton().click();
 
       cy.get(ESQL_QUERY_BAR).contains(
-        'write query that returns _id field from [metadata _id, _version, _index] operator'
+        'must include the [metadata _id, _version, _index] operator after the source command'
       );
     });
 
@@ -139,7 +139,7 @@ describe('Detection ES|QL rules, creation', { tags: ['@ess'] }, () => {
       getDefineContinueButton().click();
 
       cy.get(ESQL_QUERY_BAR).contains(
-        'write query that returns _id field from [metadata _id, _version, _index] operator'
+        'must include the [metadata _id, _version, _index] operator after the source command'
       );
     });
 
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/entity_analytics/enrichments.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/entity_analytics/enrichments.cy.ts
index 0c5662146b810..2bc04ec68c332 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/entity_analytics/enrichments.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/entity_analytics/enrichments.cy.ts
@@ -50,7 +50,8 @@ describe('Enrichment', { tags: ['@ess', '@serverless', '@brokenInServerless'] },
   });
 
   describe('Custom query rule', () => {
-    describe('from legacy risk scores', () => {
+    // FLAKY: https://github.com/elastic/kibana/issues/169154
+    describe.skip('from legacy risk scores', () => {
       beforeEach(() => {
         disableExpandableFlyout();
         cy.task('esArchiverLoad', { archiveName: 'risk_hosts' });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/dashboards/entity_analytics.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/dashboards/entity_analytics.cy.ts
index 3ec2943223a81..3cc088f53d301 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/dashboards/entity_analytics.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/dashboards/entity_analytics.cy.ts
@@ -69,7 +69,7 @@ describe('Entity Analytics Dashboard', { tags: ['@ess', '@serverless'] }, () =>
     deleteRiskEngineConfiguration();
   });
 
-  describe('legcay risk score', () => {
+  describe('legacy risk score', () => {
     describe('Without data', () => {
       beforeEach(() => {
         login();
@@ -135,8 +135,7 @@ describe('Entity Analytics Dashboard', { tags: ['@ess', '@serverless'] }, () =>
       });
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/168490
-    describe.skip('With host risk data', () => {
+    describe('With host risk data', () => {
       before(() => {
         cy.task('esArchiverLoad', { archiveName: 'risk_hosts' });
       });
@@ -163,7 +162,8 @@ describe('Entity Analytics Dashboard', { tags: ['@ess', '@serverless'] }, () =>
         cy.get(HOSTS_TABLE_ALERT_CELL).should('have.length', 5);
       });
 
-      it('filters by risk level', () => {
+      // FLAKY: https://github.com/elastic/kibana/issues/168490
+      it.skip('filters by risk level', () => {
         openRiskTableFilterAndSelectTheLowOption();
 
         cy.get(HOSTS_DONUT_CHART).should('include.text', '1Total');
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/host_details/risk_tab.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/host_details/risk_tab.cy.ts
index 6c5af8a1601c3..ea8362ee17541 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/host_details/risk_tab.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/host_details/risk_tab.cy.ts
@@ -17,7 +17,9 @@ import { RISK_INFORMATION_FLYOUT_HEADER } from '../../../screens/entity_analytic
 import { navigateToHostRiskDetailTab } from '../../../tasks/host_risk';
 
 describe('risk tab', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
-  describe('with legacy risk score', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/169033
+  // FLAKY: https://github.com/elastic/kibana/issues/169034
+  describe.skip('with legacy risk score', () => {
     before(() => {
       cleanKibana();
       // illegal_argument_exception: unknown setting [index.lifecycle.rollover_alias]
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/events_viewer.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/events_viewer.cy.ts
index 82bc6251b276f..20884e070cf9a 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/events_viewer.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/events_viewer.cy.ts
@@ -46,7 +46,7 @@ const defaultHeadersInDefaultEcsCategory = [
   { id: 'destination.ip' },
 ];
 
-describe('Events Viewer', { tags: ['@ess', '@brokenInServerless'] }, () => {
+describe('Events Viewer', { tags: ['@ess', '@serverless'] }, () => {
   before(() => {
     cy.task('esArchiverLoad', { archiveName: 'auditbeat_big' });
   });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/host_risk_tab.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/host_risk_tab.cy.ts
index 695f261c599d0..6a11e27bcc81a 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/host_risk_tab.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/host_risk_tab.cy.ts
@@ -20,12 +20,12 @@ import {
 import { login } from '../../../tasks/login';
 import { visitWithTimeRange } from '../../../tasks/navigation';
 import { hostsUrl } from '../../../urls/navigation';
-import { clearSearchBar, kqlSearch } from '../../../tasks/security_header';
+import { kqlSearch } from '../../../tasks/security_header';
 import { deleteRiskEngineConfiguration } from '../../../tasks/api_calls/risk_engine';
 import { enableRiskEngine } from '../../../tasks/entity_analytics';
 
 // Tracked by https://github.com/elastic/security-team/issues/7696
-describe('risk tab', { tags: ['@ess', '@brokenInServerless'] }, () => {
+describe('risk tab', { tags: ['@ess', '@serverless'] }, () => {
   describe('with legacy risk score', () => {
     before(() => {
       cleanKibana();
@@ -52,7 +52,6 @@ describe('risk tab', { tags: ['@ess', '@brokenInServerless'] }, () => {
       cy.get(HOST_BY_RISK_TABLE_CELL).eq(3).should('have.text', 'siem-kibana');
       cy.get(HOST_BY_RISK_TABLE_CELL).eq(4).should('have.text', '21');
       cy.get(HOST_BY_RISK_TABLE_CELL).eq(5).should('have.text', 'Low');
-      clearSearchBar();
     });
 
     it.skip('filters the table', () => {
@@ -73,7 +72,6 @@ describe('risk tab', { tags: ['@ess', '@brokenInServerless'] }, () => {
     it('should not allow page change when page is empty', () => {
       kqlSearch('host.name: "nonexistent_host" {enter}');
       cy.get(HOST_BY_RISK_TABLE_NEXT_PAGE_BUTTON).should(`not.exist`);
-      clearSearchBar();
     });
   });
 
@@ -104,7 +102,6 @@ describe('risk tab', { tags: ['@ess', '@brokenInServerless'] }, () => {
       cy.get(HOST_BY_RISK_TABLE_CELL).eq(3).should('have.text', 'siem-kibana');
       cy.get(HOST_BY_RISK_TABLE_CELL).eq(4).should('have.text', '90');
       cy.get(HOST_BY_RISK_TABLE_CELL).eq(5).should('have.text', 'Critical');
-      clearSearchBar();
     });
 
     it.skip('filters the table', () => {
@@ -125,7 +122,6 @@ describe('risk tab', { tags: ['@ess', '@brokenInServerless'] }, () => {
     it('should not allow page change when page is empty', () => {
       kqlSearch('host.name: "nonexistent_host" {enter}');
       cy.get(HOST_BY_RISK_TABLE_NEXT_PAGE_BUTTON).should(`not.exist`);
-      clearSearchBar();
     });
   });
 });
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/hosts_risk_column.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/hosts_risk_column.cy.ts
index a1bdff9a35072..d5ca12dc63f6f 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/hosts_risk_column.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/hosts/hosts_risk_column.cy.ts
@@ -15,7 +15,7 @@ import { kqlSearch } from '../../../tasks/security_header';
 import { deleteRiskEngineConfiguration } from '../../../tasks/api_calls/risk_engine';
 import { enableRiskEngine } from '../../../tasks/entity_analytics';
 
-describe('All hosts table', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
+describe('All hosts table', { tags: ['@ess', '@serverless'] }, () => {
   describe('with legacy risk score', () => {
     before(() => {
       cleanKibana();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/dasbhoards/detection_response.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/dasbhoards/detection_response.cy.ts
index 0192d85bd6f23..fd7d1ec688d14 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/dasbhoards/detection_response.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/dasbhoards/detection_response.cy.ts
@@ -43,7 +43,9 @@ import { ALERTS_URL, DASHBOARDS_URL, DETECTION_AND_RESPONSE_URL } from '../../..
 const TEST_USER_NAME = 'test';
 const SIEM_KIBANA_HOST_NAME = 'siem-kibana';
 
-describe('Detection response view', { tags: ['@ess', '@serverless'] }, () => {
+// FLAKY: https://github.com/elastic/kibana/issues/168772
+// FLAKY: https://github.com/elastic/kibana/issues/168771
+describe.skip('Detection response view', { tags: ['@ess', '@serverless'] }, () => {
   before(() => {
     cleanKibana();
     createRule(getNewRule());
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
index ef79bf8bf4d48..23396da6e3174 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/timelines/esql/esql_state.cy.ts
@@ -29,7 +29,8 @@ const INITIAL_END_DATE = 'Jan 19, 2024 @ 20:33:29.186';
 const DEFAULT_ESQL_QUERY =
   'from .alerts-security.alerts-default,apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,traces-apm*,winlogbeat-*,-*elastic-cloud-logs-* | limit 10';
 
-describe(
+// FLAKY: https://github.com/elastic/kibana/issues/169093
+describe.skip(
   'Timeline Discover ESQL State',
   {
     tags: ['@ess'],
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/security_header.ts b/x-pack/test/security_solution_cypress/cypress/tasks/security_header.ts
index 8824d41536a8e..4cca17aa18dae 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/security_header.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/security_header.ts
@@ -14,7 +14,7 @@ export const clearSearchBar = () => {
 };
 
 export const kqlSearch = (search: string) => {
-  cy.get(KQL_INPUT).type(search);
+  cy.get(KQL_INPUT).type(search, { force: true });
 };
 
 export const navigateFromHeaderTo = (page: string) => {
diff --git a/x-pack/test_serverless/api_integration/test_suites/common/alerting/summary_actions.ts b/x-pack/test_serverless/api_integration/test_suites/common/alerting/summary_actions.ts
index 7daddff58ce76..72c718f9042b5 100644
--- a/x-pack/test_serverless/api_integration/test_suites/common/alerting/summary_actions.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/common/alerting/summary_actions.ts
@@ -40,7 +40,10 @@ export default function ({ getService }: FtrProviderContext) {
   const esClient = getService('es');
   const esDeleteAllIndices = getService('esDeleteAllIndices');
 
-  describe('Summary actions', () => {
+  describe('Summary actions', function () {
+    // flaky on MKI, see https://github.com/elastic/kibana/issues/169204
+    this.tags(['failsOnMKI']);
+
     const RULE_TYPE_ID = '.es-query';
     const ALERT_ACTION_INDEX = 'alert-action-es-query';
     const ALERT_INDEX = '.alerts-stack.alerts-default';
diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/telemetry/telemetry_config.ts b/x-pack/test_serverless/api_integration/test_suites/observability/telemetry/telemetry_config.ts
index d803cf06b4c52..5d25fef27daa8 100644
--- a/x-pack/test_serverless/api_integration/test_suites/observability/telemetry/telemetry_config.ts
+++ b/x-pack/test_serverless/api_integration/test_suites/observability/telemetry/telemetry_config.ts
@@ -11,7 +11,8 @@ export default function telemetryConfigTest({ getService }: FtrProviderContext)
   const svlCommonApi = getService('svlCommonApi');
   const supertest = getService('supertest');
 
-  describe('/api/telemetry/v2/config API Telemetry config', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/169134
+  describe.skip('/api/telemetry/v2/config API Telemetry config', () => {
     const baseConfig = {
       allowChangingOptInStatus: false,
       optIn: true,
diff --git a/x-pack/test_serverless/functional/page_objects/svl_common_navigation.ts b/x-pack/test_serverless/functional/page_objects/svl_common_navigation.ts
index 56351af9b43f1..a5f6a03329037 100644
--- a/x-pack/test_serverless/functional/page_objects/svl_common_navigation.ts
+++ b/x-pack/test_serverless/functional/page_objects/svl_common_navigation.ts
@@ -19,6 +19,8 @@ type NavigationId = MlNavId | AlNavId | MgmtNavId | DevNavId | string;
 import type { FtrProviderContext } from '../ftr_provider_context';
 import type { WebElementWrapper } from '../../../../test/functional/services/lib/web_element_wrapper';
 
+const getSectionIdTestSubj = (sectionId: NavigationId) => `~nav-item-${sectionId} `;
+
 export function SvlCommonNavigationProvider(ctx: FtrProviderContext) {
   const testSubjects = ctx.getService('testSubjects');
   const browser = ctx.getService('browser');
@@ -95,11 +97,11 @@ export function SvlCommonNavigationProvider(ctx: FtrProviderContext) {
       },
       async expectSectionExists(sectionId: NavigationId) {
         log.debug('ServerlessCommonNavigation.sidenav.expectSectionExists', sectionId);
-        await testSubjects.existOrFail(`~nav-bucket-${sectionId}`);
+        await testSubjects.existOrFail(getSectionIdTestSubj(sectionId));
       },
       async isSectionOpen(sectionId: NavigationId) {
         await this.expectSectionExists(sectionId);
-        const section = await testSubjects.find(`~nav-bucket-${sectionId}`);
+        const section = await testSubjects.find(getSectionIdTestSubj(sectionId));
         const collapseBtn = await section.findByCssSelector(
           `[aria-controls="${sectionId}"][aria-expanded]`
         );
@@ -126,7 +128,7 @@ export function SvlCommonNavigationProvider(ctx: FtrProviderContext) {
         await this.expectSectionExists(sectionId);
         const isOpen = await this.isSectionOpen(sectionId);
         if (isOpen) return;
-        const section = await testSubjects.find(`~nav-bucket-${sectionId}`);
+        const section = await testSubjects.find(getSectionIdTestSubj(sectionId));
         const collapseBtn = await section.findByCssSelector(
           `[aria-controls="${sectionId}"][aria-expanded]`
         );
@@ -137,7 +139,7 @@ export function SvlCommonNavigationProvider(ctx: FtrProviderContext) {
         await this.expectSectionExists(sectionId);
         const isOpen = await this.isSectionOpen(sectionId);
         if (!isOpen) return;
-        const section = await testSubjects.find(`~nav-bucket-${sectionId}`);
+        const section = await testSubjects.find(getSectionIdTestSubj(sectionId));
         const collapseBtn = await section.findByCssSelector(
           `[aria-controls="${sectionId}"][aria-expanded]`
         );
@@ -192,10 +194,10 @@ export function SvlCommonNavigationProvider(ctx: FtrProviderContext) {
     search: new SvlNavigationSearchPageObject(ctx),
     recent: {
       async expectExists() {
-        await testSubjects.existOrFail('nav-bucket-recentlyAccessed');
+        await testSubjects.existOrFail('nav-item-recentlyAccessed');
       },
       async expectHidden() {
-        await testSubjects.missingOrFail('nav-bucket-recentlyAccessed', { timeout: 1000 });
+        await testSubjects.missingOrFail('nav-item-recentlyAccessed', { timeout: 1000 });
       },
       async expectLinkExists(text: string) {
         await this.expectExists();
@@ -203,7 +205,7 @@ export function SvlCommonNavigationProvider(ctx: FtrProviderContext) {
         await retry.try(async () => {
           foundLink = await getByVisibleText(
             async () =>
-              (await testSubjects.find('nav-bucket-recentlyAccessed')).findAllByTagName('a'),
+              (await testSubjects.find('nav-item-recentlyAccessed')).findAllByTagName('a'),
             text
           );
           expect(!!foundLink).to.be(true);
diff --git a/x-pack/test_serverless/functional/services/ml/observability_navigation.ts b/x-pack/test_serverless/functional/services/ml/observability_navigation.ts
index f09467263deff..ec26c87be1d27 100644
--- a/x-pack/test_serverless/functional/services/ml/observability_navigation.ts
+++ b/x-pack/test_serverless/functional/services/ml/observability_navigation.ts
@@ -11,9 +11,11 @@ export function MachineLearningNavigationProviderObservability({ getService }: F
   const testSubjects = getService('testSubjects');
 
   async function navigateToArea(id: string) {
-    await testSubjects.click('~nav-item-id-aiops');
-    await testSubjects.existOrFail(`~nav-item-id-ml:${id}`, { timeout: 60 * 1000 });
-    await testSubjects.click(`~nav-item-id-ml:${id}`);
+    await testSubjects.click('~nav-item-id-observability_project_nav.aiops');
+    await testSubjects.existOrFail(`~nav-item-id-observability_project_nav.aiops.ml:${id}`, {
+      timeout: 60 * 1000,
+    });
+    await testSubjects.click(`~nav-item-id-observability_project_nav.aiops.ml:${id}`);
   }
 
   return {
diff --git a/x-pack/test_serverless/functional/test_suites/common/visualizations/group2/index.ts b/x-pack/test_serverless/functional/test_suites/common/visualizations/group2/index.ts
index f3abd6dccef91..4b7e3588669d1 100644
--- a/x-pack/test_serverless/functional/test_suites/common/visualizations/group2/index.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/visualizations/group2/index.ts
@@ -10,7 +10,8 @@ import { FtrProviderContext } from '../../../../ftr_provider_context';
 export default ({ loadTestFile, getPageObject }: FtrProviderContext) => {
   const svlCommonPage = getPageObject('svlCommonPage');
 
-  describe('Visualizations - Group 2', function () {
+  // FLAKY: https://github.com/elastic/kibana/issues/168985
+  describe.skip('Visualizations - Group 2', function () {
     before(async () => {
       await svlCommonPage.login();
     });
diff --git a/x-pack/test_serverless/functional/test_suites/observability/cases/attachment_framework.ts b/x-pack/test_serverless/functional/test_suites/observability/cases/attachment_framework.ts
index cafe2d867241d..cd0647a1a35d7 100644
--- a/x-pack/test_serverless/functional/test_suites/observability/cases/attachment_framework.ts
+++ b/x-pack/test_serverless/functional/test_suites/observability/cases/attachment_framework.ts
@@ -20,7 +20,8 @@ export default ({ getPageObject, getService }: FtrProviderContext) => {
   const cases = getService('cases');
   const find = getService('find');
 
-  describe('Cases persistable attachments', function () {
+  // failing test https://github.com/elastic/kibana/issues/166592
+  describe.skip('Cases persistable attachments', function () {
     // security_exception: action [indices:data/write/delete/byquery] is unauthorized for user [elastic] with effective roles [superuser] on restricted indices [.kibana_alerting_cases], this action is granted by the index privileges [delete,write,all]
     this.tags(['failsOnMKI']);
     describe('lens visualization', () => {
diff --git a/x-pack/test_serverless/functional/test_suites/observability/cypress/e2e/navigation.cy.ts b/x-pack/test_serverless/functional/test_suites/observability/cypress/e2e/navigation.cy.ts
index 22b59a9e3ed05..b3d6c225f50c4 100644
--- a/x-pack/test_serverless/functional/test_suites/observability/cypress/e2e/navigation.cy.ts
+++ b/x-pack/test_serverless/functional/test_suites/observability/cypress/e2e/navigation.cy.ts
@@ -96,22 +96,31 @@ describe.skip('Serverless', () => {
 
   it('sets service nav item as active', () => {
     cy.visitKibana('/app/apm/service-groups');
-    cy.getByTestSubj('nav-item-id-apm').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-apm:services').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm.apm:services').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
 
     cy.visitKibana('/app/apm/service-maps');
-    cy.getByTestSubj('nav-item-id-apm').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-apm:services').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm.apm:services').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
 
     cy.visitKibana('/app/apm/mobile-services/foo');
-    cy.getByTestSubj('nav-item-id-apm').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-apm:services').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm.apm:services').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
@@ -119,15 +128,21 @@ describe.skip('Serverless', () => {
 
   it('sets dependencies nav item as active', () => {
     cy.visitKibana('/app/apm/dependencies/inventory');
-    cy.getByTestSubj('nav-item-id-apm').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-apm:dependencies').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm.apm:dependencies').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
 
     cy.visitKibana('/app/apm/dependencies/operations?dependencyName=foo');
-    cy.getByTestSubj('nav-item-id-apm').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-apm:dependencies').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm.apm:dependencies').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
@@ -136,15 +151,21 @@ describe.skip('Serverless', () => {
   it('sets traces nav item as active', () => {
     cy.visitKibana('/app/apm/traces/explorer/waterfall');
 
-    cy.getByTestSubj('nav-item-id-apm').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-apm:traces').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm.apm:traces').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
 
     cy.visitKibana('/app/apm/traces/explorer/critical_path');
-    cy.getByTestSubj('nav-item-id-apm').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-apm:traces').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.apm.apm:traces').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
@@ -153,15 +174,21 @@ describe.skip('Serverless', () => {
   it('sets AIOps nav item as active', () => {
     cy.visitKibana('/app/ml/aiops/explain_log_rate_spikes');
 
-    cy.getByTestSubj('nav-item-id-aiops').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-ml:logRateAnalysis').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.aiops').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.aiops.ml:logRateAnalysis').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
 
     cy.visitKibana('/app/ml/aiops/change_point_detection');
-    cy.getByTestSubj('nav-item-id-aiops').should('have.class', 'euiSideNavItemButton-isOpen');
-    cy.getByTestSubj('nav-item-id-ml:changePointDetections').should(
+    cy.getByTestSubj('nav-item-id-observability_project_nav.aiops').should(
+      'have.class',
+      'euiSideNavItemButton-isOpen'
+    );
+    cy.getByTestSubj('nav-item-id-observability_project_nav.aiops.ml:changePointDetections').should(
       'have.class',
       'euiSideNavItemButton-isSelected'
     );
diff --git a/x-pack/test_serverless/functional/test_suites/observability/navigation.ts b/x-pack/test_serverless/functional/test_suites/observability/navigation.ts
index 278da0f02d1d7..0b18ae0440e9b 100644
--- a/x-pack/test_serverless/functional/test_suites/observability/navigation.ts
+++ b/x-pack/test_serverless/functional/test_suites/observability/navigation.ts
@@ -51,7 +51,7 @@ export default function ({ getPageObject, getService }: FtrProviderContext) {
       await expect(await browser.getCurrentUrl()).contain('/app/observability-log-explorer');
 
       // check the aiops subsection
-      await svlCommonNavigation.sidenav.clickLink({ navId: 'aiops' }); // open ai ops subsection
+      await svlCommonNavigation.sidenav.clickLink({ navId: 'observability_project_nav.aiops' }); // open ai ops subsection
       await svlCommonNavigation.sidenav.clickLink({ deepLinkId: 'ml:anomalyDetection' });
       await svlCommonNavigation.sidenav.expectLinkActive({ deepLinkId: 'ml:anomalyDetection' });
       await svlCommonNavigation.breadcrumbs.expectBreadcrumbExists({ text: 'AIOps' });
@@ -75,7 +75,9 @@ export default function ({ getPageObject, getService }: FtrProviderContext) {
       await expectNoPageReload();
     });
 
-    it('active sidenav section is auto opened on load', async () => {
+    // Skipping this test as it is not supported in the new navigation for now.
+    // Will be fixed in https://github.com/elastic/kibana/issues/167328
+    it.skip('active sidenav section is auto opened on load', async () => {
       await svlCommonNavigation.sidenav.openSection('project_settings_project_nav');
       await svlCommonNavigation.sidenav.clickLink({ deepLinkId: 'management' });
       await browser.refresh();
diff --git a/x-pack/test_serverless/functional/test_suites/security/ftr/management.ts b/x-pack/test_serverless/functional/test_suites/security/ftr/management.ts
deleted file mode 100644
index ab9d75f4b08c0..0000000000000
--- a/x-pack/test_serverless/functional/test_suites/security/ftr/management.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrProviderContext } from '../../../ftr_provider_context';
-
-export default function ({ getPageObject }: FtrProviderContext) {
-  const PageObject = getPageObject('common');
-  const svlCommonPage = getPageObject('svlCommonPage');
-
-  describe('Management', function () {
-    before(async () => {
-      await svlCommonPage.login();
-    });
-
-    after(async () => {
-      await svlCommonPage.forceLogout();
-    });
-
-    it('redirects from common management url to security specific page', async () => {
-      const SUB_URL = '';
-      await PageObject.navigateToUrl('management', SUB_URL, {
-        ensureCurrentUrl: false,
-        shouldLoginIfPrompted: false,
-        shouldUseHashForSubUrl: false,
-      });
-
-      await PageObject.waitUntilUrlIncludes('/security/project_settings');
-    });
-  });
-}
diff --git a/x-pack/test_serverless/functional/test_suites/security/index.ts b/x-pack/test_serverless/functional/test_suites/security/index.ts
index 8525b10e9b91a..cadf61fdf5eda 100644
--- a/x-pack/test_serverless/functional/test_suites/security/index.ts
+++ b/x-pack/test_serverless/functional/test_suites/security/index.ts
@@ -11,7 +11,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
   describe('serverless security UI', function () {
     loadTestFile(require.resolve('./ftr/landing_page'));
     loadTestFile(require.resolve('./ftr/navigation'));
-    loadTestFile(require.resolve('./ftr/management'));
     loadTestFile(require.resolve('./ftr/cases/attachment_framework'));
     loadTestFile(require.resolve('./ftr/cases/view_case'));
     loadTestFile(require.resolve('./ftr/cases/create_case_form'));
diff --git a/yarn.lock b/yarn.lock
index d704bf985e9ad..1dcea68abfd5b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1605,10 +1605,10 @@
     "@elastic/transport" "^8.3.3"
     tslib "^2.4.0"
 
-"@elastic/ems-client@8.4.0":
-  version "8.4.0"
-  resolved "https://registry.yarnpkg.com/@elastic/ems-client/-/ems-client-8.4.0.tgz#e77bbddda998a77e29b86767fe4ff403c5a62133"
-  integrity sha512-uMxZl6BxCPLvIJiG80gqQbOlxKqNLYCo0KtHDFVwUGpTgUQnrVzAZUJ9PZ7fSD7cUDW6pE+QekDddDxB2nOCwA==
+"@elastic/ems-client@8.5.0":
+  version "8.5.0"
+  resolved "https://registry.yarnpkg.com/@elastic/ems-client/-/ems-client-8.5.0.tgz#5e3988ab01dee54bace9f8c2f9e71470b26a1bfa"
+  integrity sha512-uEI8teyS3gWErlEL4mEYh0MDHms9Rp3eEHKnMMSdMtAkaa3xs60SOm3Vd0ld9sIPsyarQHrAybAw30GXVXXRjw==
   dependencies:
     "@types/geojson" "^7946.0.10"
     "@types/lru-cache" "^5.1.0"
@@ -1617,7 +1617,7 @@
     chroma-js "^2.1.0"
     lodash "^4.17.15"
     lru-cache "^6.0.0"
-    semver "^7.3.8"
+    semver "7.5.4"
     topojson-client "^3.1.0"
 
 "@elastic/eslint-plugin-eui@0.0.2":
@@ -2180,6 +2180,11 @@
   resolved "https://registry.yarnpkg.com/@eslint/js/-/js-8.46.0.tgz#3f7802972e8b6fe3f88ed1aabc74ec596c456db6"
   integrity sha512-a8TLtmPi8xzPkCbp/OGFUo5yhRkHM2Ko9kOWP4znJr0WAhWyThaw3PnwX4vOTWOAMsV2uRt32PPDcEz63esSaA==
 
+"@fastify/busboy@^2.0.0":
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/@fastify/busboy/-/busboy-2.0.0.tgz#f22824caff3ae506b18207bad4126dbc6ccdb6b8"
+  integrity sha512-JUFJad5lv7jxj926GPgymrWQxxjPYuJNiNjNMzqT+HiuP6Vl3dk5xzG+8sTX96np0ZAluvaMzPsjhHZ5rNuNQQ==
+
 "@foliojs-fork/fontkit@^1.9.1":
   version "1.9.1"
   resolved "https://registry.yarnpkg.com/@foliojs-fork/fontkit/-/fontkit-1.9.1.tgz#8124649168eb5273f580f66697a139fb5041296b"
@@ -5090,6 +5095,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/observability-alerting-test-data@link:x-pack/packages/observability/alerting_test_data":
+  version "0.0.0"
+  uid ""
+
 "@kbn/observability-fixtures-plugin@link:x-pack/test/cases_api_integration/common/plugins/observability":
   version "0.0.0"
   uid ""
@@ -12277,13 +12286,6 @@ builtin-status-codes@^3.0.0:
   resolved "https://registry.yarnpkg.com/builtin-status-codes/-/builtin-status-codes-3.0.0.tgz#85982878e21b98e1c66425e03d0174788f569ee8"
   integrity sha1-hZgoeOIbmOHGZCXgPQF0eI9Wnug=
 
-busboy@^1.6.0:
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/busboy/-/busboy-1.6.0.tgz#966ea36a9502e43cdb9146962523b92f531f6893"
-  integrity sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==
-  dependencies:
-    streamsearch "^1.1.0"
-
 byte-size@^8.1.0:
   version "8.1.0"
   resolved "https://registry.yarnpkg.com/byte-size/-/byte-size-8.1.0.tgz#6353d0bc14ab7a69abcefbf11f8db0145a862cb5"
@@ -17852,6 +17854,13 @@ got@^9.6.0:
     to-readable-stream "^1.0.0"
     url-parse-lax "^3.0.0"
 
+gpt-tokenizer@^2.1.2:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/gpt-tokenizer/-/gpt-tokenizer-2.1.2.tgz#14f7ce424cf2309fb5be66e112d1836080c2791a"
+  integrity sha512-HSuI5d6uey+c7x/VzQlPfCoGrfLyAc28vxWofKbjR9PJHm0AjQGSWkKw/OJnb+8S1g7nzgRsf0WH3dK+NNWYbg==
+  dependencies:
+    rfc4648 "^1.5.2"
+
 graceful-fs@4.X, graceful-fs@^4.1.11, graceful-fs@^4.1.15, graceful-fs@^4.1.2, graceful-fs@^4.1.6, graceful-fs@^4.1.9, graceful-fs@^4.2.0, graceful-fs@^4.2.10, graceful-fs@^4.2.11, graceful-fs@^4.2.2, graceful-fs@^4.2.4, graceful-fs@^4.2.6, graceful-fs@^4.2.8, graceful-fs@^4.2.9:
   version "4.2.11"
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.11.tgz#4183e4e8bf08bb6e05bbb2f7d2e0c8f712ca40e3"
@@ -26765,6 +26774,11 @@ reusify@^1.0.4:
   resolved "https://registry.yarnpkg.com/reusify/-/reusify-1.0.4.tgz#90da382b1e126efc02146e90845a88db12925d76"
   integrity sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==
 
+rfc4648@^1.5.2:
+  version "1.5.2"
+  resolved "https://registry.yarnpkg.com/rfc4648/-/rfc4648-1.5.2.tgz#cf5dac417dd83e7f4debf52e3797a723c1373383"
+  integrity sha512-tLOizhR6YGovrEBLatX1sdcuhoSCXddw3mqNVAcKxGJ+J0hFeJ+SjeWCv5UPA/WU3YzWPPuCVYgXBKZUPGpKtg==
+
 rfdc@^1.2.0:
   version "1.3.0"
   resolved "https://registry.yarnpkg.com/rfdc/-/rfdc-1.3.0.tgz#d0b7c441ab2720d05dc4cf26e01c89631d9da08b"
@@ -27141,6 +27155,13 @@ semver@5.6.0:
   resolved "https://registry.yarnpkg.com/semver/-/semver-5.6.0.tgz#7e74256fbaa49c75aa7c7a205cc22799cac80004"
   integrity sha512-RS9R6R35NYgQn++fkDWaOmqGoj4Ek9gGs+DPxNUZKuwE183xjJroKvyo1IzVFeXvUrvmALy6FWD5xrdJT25gMg==
 
+semver@7.5.4:
+  version "7.5.4"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.5.4.tgz#483986ec4ed38e1c6c48c34894a9182dbff68a6e"
+  integrity sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==
+  dependencies:
+    lru-cache "^6.0.0"
+
 semver@^6.0.0, semver@^6.1.0, semver@^6.1.1, semver@^6.1.2, semver@^6.2.0, semver@^6.3.0, semver@^6.3.1:
   version "6.3.1"
   resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.1.tgz#556d2ef8689146e46dcea4bfdd095f3434dffcb4"
@@ -28137,11 +28158,6 @@ stream-slicer@0.0.6:
   resolved "https://registry.yarnpkg.com/stream-slicer/-/stream-slicer-0.0.6.tgz#f86b2ac5c2440b7a0a87b71f33665c0788046138"
   integrity sha1-+GsqxcJEC3oKh7cfM2ZcB4gEYTg=
 
-streamsearch@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/streamsearch/-/streamsearch-1.1.0.tgz#404dd1e2247ca94af554e841a8ef0eaa238da764"
-  integrity sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==
-
 streamx@^2.12.0, streamx@^2.12.5, streamx@^2.13.2, streamx@^2.14.0:
   version "2.15.0"
   resolved "https://registry.yarnpkg.com/streamx/-/streamx-2.15.0.tgz#f58c92e6f726b5390dcabd6dd9094d29a854d698"
@@ -29558,11 +29574,11 @@ unc-path-regex@^0.1.2:
   integrity sha1-5z3T17DXxe2G+6xrCufYxqadUPo=
 
 undici@^5.21.2, undici@^5.22.1:
-  version "5.22.1"
-  resolved "https://registry.yarnpkg.com/undici/-/undici-5.22.1.tgz#877d512effef2ac8be65e695f3586922e1a57d7b"
-  integrity sha512-Ji2IJhFXZY0x/0tVBXeQwgPlLWw13GVzpsWPQ3rV50IFMMof2I55PZZxtm4P6iNq+L5znYN9nSTAq0ZyE6lSJw==
+  version "5.26.3"
+  resolved "https://registry.yarnpkg.com/undici/-/undici-5.26.3.tgz#ab3527b3d5bb25b12f898dfd22165d472dd71b79"
+  integrity sha512-H7n2zmKEWgOllKkIUkLvFmsJQj062lSm3uA4EYApG8gLuiOM0/go9bIoC3HVaSnfg4xunowDE2i9p8drkXuvDw==
   dependencies:
-    busboy "^1.6.0"
+    "@fastify/busboy" "^2.0.0"
 
 unfetch@^4.2.0:
   version "4.2.0"