diff --git a/x-pack/legacy/plugins/alerting/mappings.json b/x-pack/legacy/plugins/alerting/mappings.json
index 9536187116031..bc4a7118666ed 100644
--- a/x-pack/legacy/plugins/alerting/mappings.json
+++ b/x-pack/legacy/plugins/alerting/mappings.json
@@ -20,6 +20,9 @@
           }
         }
       },
+      "consumer": {
+        "type": "keyword"
+      },
       "actions": {
         "type": "nested",
         "properties": {
diff --git a/x-pack/legacy/plugins/alerting/server/alerts_client.test.ts b/x-pack/legacy/plugins/alerting/server/alerts_client.test.ts
index b07dad68da72d..340b1bf766e24 100644
--- a/x-pack/legacy/plugins/alerting/server/alerts_client.test.ts
+++ b/x-pack/legacy/plugins/alerting/server/alerts_client.test.ts
@@ -47,6 +47,7 @@ function getMockData(overwrites: Record<string, any> = {}) {
     name: 'abc',
     tags: ['foo'],
     alertTypeId: '123',
+    consumer: 'bar',
     schedule: { interval: '10s' },
     throttle: null,
     params: {
@@ -184,6 +185,7 @@ describe('create()', () => {
         "alertTypeId": "123",
         "apiKey": undefined,
         "apiKeyOwner": undefined,
+        "consumer": "bar",
         "createdBy": "elastic",
         "enabled": true,
         "muteAll": false,
@@ -795,6 +797,7 @@ describe('create()', () => {
           },
         ],
         alertTypeId: '123',
+        consumer: 'bar',
         name: 'abc',
         params: { bar: true },
         apiKey: Buffer.from('123:abc').toString('base64'),
diff --git a/x-pack/legacy/plugins/alerting/server/routes/create.test.ts b/x-pack/legacy/plugins/alerting/server/routes/create.test.ts
index a804aff55ad42..c41e0d068aff2 100644
--- a/x-pack/legacy/plugins/alerting/server/routes/create.test.ts
+++ b/x-pack/legacy/plugins/alerting/server/routes/create.test.ts
@@ -12,6 +12,7 @@ server.route(createAlertRoute);
 
 const mockedAlert = {
   alertTypeId: '1',
+  consumer: 'bar',
   name: 'abc',
   schedule: { interval: '10s' },
   tags: ['foo'],
@@ -64,6 +65,7 @@ test('creates an alert with proper parameters', async () => {
         },
       ],
       "alertTypeId": "1",
+      "consumer": "bar",
       "id": "123",
       "name": "abc",
       "params": Object {
@@ -92,6 +94,7 @@ test('creates an alert with proper parameters', async () => {
             },
           ],
           "alertTypeId": "1",
+          "consumer": "bar",
           "enabled": true,
           "name": "abc",
           "params": Object {
diff --git a/x-pack/legacy/plugins/alerting/server/routes/create.ts b/x-pack/legacy/plugins/alerting/server/routes/create.ts
index 417072f978a92..362a23a3fa910 100644
--- a/x-pack/legacy/plugins/alerting/server/routes/create.ts
+++ b/x-pack/legacy/plugins/alerting/server/routes/create.ts
@@ -15,6 +15,7 @@ interface ScheduleRequest extends Hapi.Request {
     name: string;
     tags: string[];
     alertTypeId: string;
+    consumer: string;
     schedule: IntervalSchedule;
     actions: Array<{
       group: string;
@@ -43,6 +44,7 @@ export const createAlertRoute = {
             .items(Joi.string())
             .default([]),
           alertTypeId: Joi.string().required(),
+          consumer: Joi.string().required(),
           throttle: getDurationSchema().default(null),
           schedule: Joi.object()
             .keys({
diff --git a/x-pack/legacy/plugins/alerting/server/types.ts b/x-pack/legacy/plugins/alerting/server/types.ts
index e06e0c45e20b4..f11c36adbeb64 100644
--- a/x-pack/legacy/plugins/alerting/server/types.ts
+++ b/x-pack/legacy/plugins/alerting/server/types.ts
@@ -69,6 +69,7 @@ export interface Alert {
   name: string;
   tags: string[];
   alertTypeId: string;
+  consumer: string;
   schedule: IntervalSchedule;
   actions: AlertAction[];
   params: Record<string, any>;
@@ -87,6 +88,7 @@ export interface RawAlert extends SavedObjectAttributes {
   name: string;
   tags: string[];
   alertTypeId: string;
+  consumer: string;
   schedule: SavedObjectAttributes;
   actions: RawAlertAction[];
   params: SavedObjectAttributes;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
index 3c5182b5178b3..8cdc56b07c152 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
@@ -220,6 +220,7 @@ export const getResult = (): RuleAlertType => ({
   name: 'Detect Root/Admin Users',
   tags: [`${INTERNAL_RULE_ID_KEY}:rule-1`, `${INTERNAL_IMMUTABLE_KEY}:false`],
   alertTypeId: 'siem.signals',
+  consumer: 'siem',
   params: {
     createdAt: '2019-12-13T16:40:33.400Z',
     updatedAt: '2019-12-13T16:40:33.400Z',
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
index 84a0566bfa092..07cf0b0c716cc 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SIGNALS_ID } from '../../../../common/constants';
+import { APP_ID, SIGNALS_ID } from '../../../../common/constants';
 import { RuleParams } from './types';
 import { addTags } from './add_tags';
 
@@ -42,6 +42,7 @@ export const createRules = async ({
       name,
       tags: addTags(tags, ruleId, immutable),
       alertTypeId: SIGNALS_ID,
+      consumer: APP_ID,
       params: {
         createdAt: new Date().toISOString(),
         description,
diff --git a/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts b/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts
index 12b38e939712a..487f396d7a3dc 100644
--- a/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts
@@ -183,6 +183,7 @@ export class AlertUtils {
       throttle: '1m',
       tags: [],
       alertTypeId: 'test.always-firing',
+      consumer: 'bar',
       params: {
         index: ES_TEST_INDEX_NAME,
         reference,
diff --git a/x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts b/x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts
index 8655764e3fb8f..76f78809d5d11 100644
--- a/x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts
@@ -10,6 +10,7 @@ export function getTestAlertData(overwrites = {}) {
     name: 'abc',
     tags: ['foo'],
     alertTypeId: 'test.noop',
+    consumer: 'bar',
     schedule: { interval: '1m' },
     throttle: '1m',
     actions: [],
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
index 4a089e15eb458..b168cffe281a0 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
@@ -467,6 +467,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
               break;
             case 'space_1_all at space1':
             case 'superuser at space1':
+              expect(response.statusCode).to.eql(200);
               // Wait until alerts scheduled actions 3 times before disabling the alert and waiting for tasks to finish
               await esTestIndexTool.waitForDocs('alert:test.always-firing', reference, 3);
               await alertUtils.disable(response.body.id);
@@ -582,6 +583,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
               break;
             case 'space_1_all at space1':
             case 'superuser at space1':
+              expect(response.statusCode).to.eql(200);
               // Actions should execute twice before widning things down
               await esTestIndexTool.waitForDocs('action:test.index-record', reference, 2);
               await alertUtils.disable(response.body.id);
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts
index 3e736a2dcf8c4..a098a1fe02c1a 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts
@@ -87,6 +87,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                 ],
                 enabled: true,
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 params: {},
                 createdBy: user.username,
                 schedule: { interval: '1m' },
@@ -201,10 +202,10 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                 statusCode: 400,
                 error: 'Bad Request',
                 message:
-                  'child "name" fails because ["name" is required]. child "alertTypeId" fails because ["alertTypeId" is required]. child "schedule" fails because ["schedule" is required]. child "params" fails because ["params" is required]. child "actions" fails because ["actions" is required]',
+                  'child "name" fails because ["name" is required]. child "alertTypeId" fails because ["alertTypeId" is required]. child "consumer" fails because ["consumer" is required]. child "schedule" fails because ["schedule" is required]. child "params" fails because ["params" is required]. child "actions" fails because ["actions" is required]',
                 validation: {
                   source: 'payload',
-                  keys: ['name', 'alertTypeId', 'schedule', 'params', 'actions'],
+                  keys: ['name', 'alertTypeId', 'consumer', 'schedule', 'params', 'actions'],
                 },
               });
               break;
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
index 4da6c059c5a5e..92d8447e8f7d5 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
@@ -59,6 +59,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 schedule: { interval: '1m' },
                 enabled: true,
                 actions: [],
@@ -138,6 +139,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 schedule: { interval: '1m' },
                 enabled: false,
                 actions: [
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts
index 9c1f7fea93292..eaa361155b61f 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts
@@ -53,6 +53,7 @@ export default function createGetTests({ getService }: FtrProviderContext) {
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 schedule: { interval: '1m' },
                 enabled: true,
                 actions: [],
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
index 0e2ec0f7bc534..89c5b35bc0904 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
@@ -64,6 +64,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
                 ...updatedData,
                 id: createdAlert.id,
                 alertTypeId: 'test.noop',
+                consumer: 'bar',
                 createdBy: 'elastic',
                 enabled: true,
                 updatedBy: user.username,
@@ -274,7 +275,13 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             .put(`${getUrlPrefix(space.id)}/api/alert/1`)
             .set('kbn-xsrf', 'foo')
             .auth(user.username, user.password)
-            .send(getTestAlertData({ schedule: { interval: '10x' }, enabled: undefined }));
+            .send(
+              getTestAlertData({
+                schedule: { interval: '10x' },
+                enabled: undefined,
+                consumer: undefined,
+              })
+            );
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts
index 0e9011729eb3e..35e23a95ca11a 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts
@@ -69,6 +69,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
         ],
         enabled: true,
         alertTypeId: 'test.noop',
+        consumer: 'bar',
         params: {},
         createdBy: null,
         schedule: { interval: '1m' },
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts
index 3fdd9168eb5cb..6864c30134db3 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts
@@ -42,6 +42,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
         name: 'abc',
         tags: ['foo'],
         alertTypeId: 'test.noop',
+        consumer: 'bar',
         schedule: { interval: '1m' },
         enabled: true,
         actions: [],
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts
index a49d3478d336d..8dabc7eeb101d 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts
@@ -36,6 +36,7 @@ export default function createGetTests({ getService }: FtrProviderContext) {
         name: 'abc',
         tags: ['foo'],
         alertTypeId: 'test.noop',
+        consumer: 'bar',
         schedule: { interval: '1m' },
         enabled: true,
         actions: [],
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts
index 46822781c0cd3..fd6d81e296ef0 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts
@@ -44,6 +44,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
           id: createdAlert.id,
           tags: ['bar'],
           alertTypeId: 'test.noop',
+          consumer: 'bar',
           createdBy: null,
           enabled: true,
           updatedBy: null,