From e97b451cc186e47a4621b85cf2bd814a8529c0b6 Mon Sep 17 00:00:00 2001
From: Angela Chuang <6295984+angorayc@users.noreply.github.com>
Date: Wed, 26 Feb 2020 16:42:15 +0000
Subject: [PATCH] [SIEM] add custom reputation link (#57814)

* add custom reputation link

* fix unit test

* add number of limitation to reputation links

* fix dependency

* apply defaultFieldRendererOverflow to reputation link

* fix unit test

* fix url template

* fix display links

* fix types

* fix for review

* update test case

* update snapshot

* add icons and tooltips

* fix style

* update test

* add external link component

* update test

* fix types

* fix style

* update snapshot

* remove useMemo

* update description

* code review

* review II

* code review

* update description

* fix unit test

* fix unit test

* fix unit test

* fix unit test

* fix types

* fix styles

* fix style

* fix style

* fix review

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../legacy/plugins/siem/common/constants.ts   |    9 +
 x-pack/legacy/plugins/siem/index.ts           |   15 +
 .../field_renderers.test.tsx.snap             |   20 +-
 .../field_renderers/field_renderers.tsx       |  111 +-
 .../public/components/links/index.test.tsx    |  365 +-
 .../siem/public/components/links/index.tsx    |  203 +-
 .../__snapshots__/zeek_details.test.tsx.snap  | 3261 +++++++++++++++++
 .../body/renderers/zeek/zeek_details.test.tsx |    5 +-
 .../renderers/zeek/zeek_signature.test.tsx    |   11 +-
 .../body/renderers/zeek/zeek_signature.tsx    |   10 +-
 .../step_about_rule/helpers.test.ts           |   18 +
 11 files changed, 3876 insertions(+), 152 deletions(-)
 create mode 100644 x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/helpers.test.ts

diff --git a/x-pack/legacy/plugins/siem/common/constants.ts b/x-pack/legacy/plugins/siem/common/constants.ts
index 0d9e092e21d82..2a30293c244af 100644
--- a/x-pack/legacy/plugins/siem/common/constants.ts
+++ b/x-pack/legacy/plugins/siem/common/constants.ts
@@ -38,6 +38,15 @@ export const NEWS_FEED_URL_SETTING = 'siem:newsFeedUrl';
 /** The default value for News feed widget */
 export const NEWS_FEED_URL_SETTING_DEFAULT = 'https://feeds.elastic.co/security-solution';
 
+/** This Kibana Advanced Setting specifies the URLs of `IP Reputation Links`*/
+export const IP_REPUTATION_LINKS_SETTING = 'siem:ipReputationLinks';
+
+/** The default value for `IP Reputation Links` */
+export const IP_REPUTATION_LINKS_SETTING_DEFAULT = `[
+  { "name": "virustotal.com", "url_template": "https://www.virustotal.com/gui/search/{{ip}}" },
+  { "name": "talosIntelligence.com", "url_template": "https://talosintelligence.com/reputation_center/lookup?search={{ip}}" }
+]`;
+
 /**
  * Id for the signals alerting type
  */
diff --git a/x-pack/legacy/plugins/siem/index.ts b/x-pack/legacy/plugins/siem/index.ts
index 731ef10aa225e..db398821aecfd 100644
--- a/x-pack/legacy/plugins/siem/index.ts
+++ b/x-pack/legacy/plugins/siem/index.ts
@@ -28,6 +28,8 @@ import {
   NEWS_FEED_URL_SETTING,
   NEWS_FEED_URL_SETTING_DEFAULT,
   SIGNALS_INDEX_KEY,
+  IP_REPUTATION_LINKS_SETTING,
+  IP_REPUTATION_LINKS_SETTING_DEFAULT,
 } from './common/constants';
 import { defaultIndexPattern } from './default_index_pattern';
 import { DEFAULT_APP_CATEGORIES } from '../../../../src/core/utils';
@@ -144,6 +146,19 @@ export const siem = (kibana: any) => {
           category: ['siem'],
           requiresPageReload: true,
         },
+        [IP_REPUTATION_LINKS_SETTING]: {
+          name: i18n.translate('xpack.siem.uiSettings.ipReputationLinks', {
+            defaultMessage: 'IP Reputation Links',
+          }),
+          value: IP_REPUTATION_LINKS_SETTING_DEFAULT,
+          type: 'json',
+          description: i18n.translate('xpack.siem.uiSettings.ipReputationLinksDescription', {
+            defaultMessage:
+              'Array of URL templates to build the list of reputation URLs to be displayed on the IP Details page.',
+          }),
+          category: ['siem'],
+          requiresPageReload: true,
+        },
       },
       mappings: savedObjectMappings,
     },
diff --git a/x-pack/legacy/plugins/siem/public/components/field_renderers/__snapshots__/field_renderers.test.tsx.snap b/x-pack/legacy/plugins/siem/public/components/field_renderers/__snapshots__/field_renderers.test.tsx.snap
index 2ff93b2ecada4..59010ab80af63 100644
--- a/x-pack/legacy/plugins/siem/public/components/field_renderers/__snapshots__/field_renderers.test.tsx.snap
+++ b/x-pack/legacy/plugins/siem/public/components/field_renderers/__snapshots__/field_renderers.test.tsx.snap
@@ -122,25 +122,17 @@ exports[`Field Renderers #reputationRenderer it renders correctly against snapsh
 <DragDropContext
   onDragEnd={[MockFunction]}
 >
-  <VirusTotalLink
-    link="10.10.10.10"
-  >
-    virustotal.com
-  </VirusTotalLink>
-  , 
-  <ReputationLink
+  <Memo(ReputationLinkComponent)
+    direction="column"
     domain="10.10.10.10"
-  >
-    talosIntelligence.com
-  </ReputationLink>
+  />
 </DragDropContext>
 `;
 
 exports[`Field Renderers #whoisRenderer it renders correctly against snapshot 1`] = `
-<EuiLink
-  href="https://www.iana.org/whois?q=10.10.10.10"
-  target="_blank"
+<ExternalLink
+  url="https://www.iana.org/whois?q=10.10.10.10"
 >
   iana.org
-</EuiLink>
+</ExternalLink>
 `;
diff --git a/x-pack/legacy/plugins/siem/public/components/field_renderers/field_renderers.tsx b/x-pack/legacy/plugins/siem/public/components/field_renderers/field_renderers.tsx
index 80d68dfe1b731..222eef515958c 100644
--- a/x-pack/legacy/plugins/siem/public/components/field_renderers/field_renderers.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/field_renderers/field_renderers.tsx
@@ -15,7 +15,7 @@ import { escapeDataProviderId } from '../drag_and_drop/helpers';
 import { DefaultDraggable } from '../draggables';
 import { getEmptyTagValue } from '../empty_value';
 import { FormattedRelativePreferenceDate } from '../formatted_date';
-import { HostDetailsLink, ReputationLink, VirusTotalLink, WhoIsLink } from '../links';
+import { HostDetailsLink, ReputationLink, WhoIsLink, ReputationLinkSetting } from '../links';
 import { Spacer } from '../page';
 import * as i18n from '../page/network/ip_overview/translations';
 
@@ -132,11 +132,7 @@ export const hostNameRenderer = (host: HostEcsFields, ipFilter?: string): React.
 export const whoisRenderer = (ip: string) => <WhoIsLink domain={ip}>{i18n.VIEW_WHOIS}</WhoIsLink>;
 
 export const reputationRenderer = (ip: string): React.ReactElement => (
-  <>
-    <VirusTotalLink link={ip}>{i18n.VIEW_VIRUS_TOTAL}</VirusTotalLink>
-    {', '}
-    <ReputationLink domain={ip}>{i18n.VIEW_TALOS_INTELLIGENCE}</ReputationLink>
-  </>
+  <ReputationLink domain={ip} direction="column" />
 );
 
 interface DefaultFieldRendererProps {
@@ -148,73 +144,78 @@ interface DefaultFieldRendererProps {
   moreMaxHeight?: string;
 }
 
+type OverflowRenderer = (item: string | ReputationLinkSetting) => JSX.Element;
+
 // TODO: This causes breaks between elements until the ticket below is fixed
 // https://github.com/elastic/ingest-dev/issues/474
-export const DefaultFieldRenderer = React.memo<DefaultFieldRendererProps>(
-  ({
-    attrName,
-    displayCount = 1,
-    idPrefix,
-    moreMaxHeight = DEFAULT_MORE_MAX_HEIGHT,
-    render,
-    rowItems,
-  }) => {
-    if (rowItems != null && rowItems.length > 0) {
-      const draggables = rowItems.slice(0, displayCount).map((rowItem, index) => {
-        const id = escapeDataProviderId(
-          `default-field-renderer-default-draggable-${idPrefix}-${attrName}-${rowItem}`
-        );
-        return (
-          <EuiFlexItem key={id} grow={false}>
-            {index !== 0 && (
-              <>
-                {','}
-                <Spacer />
-              </>
-            )}
+export const DefaultFieldRendererComponent: React.FC<DefaultFieldRendererProps> = ({
+  attrName,
+  displayCount = 1,
+  idPrefix,
+  moreMaxHeight = DEFAULT_MORE_MAX_HEIGHT,
+  render,
+  rowItems,
+}) => {
+  if (rowItems != null && rowItems.length > 0) {
+    const draggables = rowItems.slice(0, displayCount).map((rowItem, index) => {
+      const id = escapeDataProviderId(
+        `default-field-renderer-default-draggable-${idPrefix}-${attrName}-${rowItem}`
+      );
+      return (
+        <EuiFlexItem key={id} grow={false}>
+          {index !== 0 && (
+            <>
+              {','}
+              <Spacer />
+            </>
+          )}
+          {typeof rowItem === 'string' && (
             <DefaultDraggable id={id} field={attrName} value={rowItem}>
               {render ? render(rowItem) : rowItem}
             </DefaultDraggable>
-          </EuiFlexItem>
-        );
-      });
-
-      return draggables.length > 0 ? (
-        <DraggableContainerFlexGroup alignItems="center" gutterSize="none" component="span">
-          {draggables}{' '}
-          {
-            <DefaultFieldRendererOverflow
-              rowItems={rowItems}
-              idPrefix={idPrefix}
-              render={render}
-              overflowIndexStart={displayCount}
-              moreMaxHeight={moreMaxHeight}
-            />
-          }
-        </DraggableContainerFlexGroup>
-      ) : (
-        getEmptyTagValue()
+          )}
+        </EuiFlexItem>
       );
-    } else {
-      return getEmptyTagValue();
-    }
+    });
+
+    return draggables.length > 0 ? (
+      <DraggableContainerFlexGroup alignItems="center" gutterSize="none" component="span">
+        <EuiFlexItem grow={false}>{draggables} </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <DefaultFieldRendererOverflow
+            rowItems={rowItems}
+            idPrefix={idPrefix}
+            render={render as OverflowRenderer}
+            overflowIndexStart={displayCount}
+            moreMaxHeight={moreMaxHeight}
+          />
+        </EuiFlexItem>
+      </DraggableContainerFlexGroup>
+    ) : (
+      getEmptyTagValue()
+    );
+  } else {
+    return getEmptyTagValue();
   }
-);
+};
+
+export const DefaultFieldRenderer = React.memo(DefaultFieldRendererComponent);
 
 DefaultFieldRenderer.displayName = 'DefaultFieldRenderer';
 
+type RowItemTypes = string | ReputationLinkSetting;
 interface DefaultFieldRendererOverflowProps {
-  rowItems: string[];
+  rowItems: string[] | ReputationLinkSetting[];
   idPrefix: string;
-  render?: (item: string) => React.ReactNode;
+  render?: (item: RowItemTypes) => React.ReactNode;
   overflowIndexStart?: number;
   moreMaxHeight: string;
 }
 
 interface MoreContainerProps {
   idPrefix: string;
-  render?: (item: string) => React.ReactNode;
-  rowItems: string[];
+  render?: (item: RowItemTypes) => React.ReactNode;
+  rowItems: RowItemTypes[];
   moreMaxHeight: string;
   overflowIndexStart: number;
 }
diff --git a/x-pack/legacy/plugins/siem/public/components/links/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/links/index.test.tsx
index ceef7e353b521..d2d1d6569854d 100644
--- a/x-pack/legacy/plugins/siem/public/components/links/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/links/index.test.tsx
@@ -4,24 +4,32 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { mount } from 'enzyme';
+import { mount, shallow, ShallowWrapper } from 'enzyme';
 import React from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 
 import { encodeIpv6 } from '../../lib/helpers';
+import { useUiSetting$ } from '../../lib/kibana';
 
 import {
   GoogleLink,
   HostDetailsLink,
   IPDetailsLink,
   ReputationLink,
-  VirusTotalLink,
   WhoIsLink,
   CertificateFingerprintLink,
   Ja3FingerprintLink,
   PortOrServiceNameLink,
+  DEFAULT_NUMBER_OF_LINK,
+  ExternalLink,
 } from '.';
 
+jest.mock('../../lib/kibana', () => {
+  return {
+    useUiSetting$: jest.fn(),
+  };
+});
+
 describe('Custom Links', () => {
   const hostName = 'Host Name';
   const ipv4 = '192.0.2.255';
@@ -101,53 +109,332 @@ describe('Custom Links', () => {
     });
   });
 
-  describe('ReputationLink', () => {
-    test('it renders link text', () => {
-      const wrapper = mountWithIntl(
-        <ReputationLink domain={'192.0.2.0'}>{'Example Link'}</ReputationLink>
-      );
-      expect(wrapper.text()).toEqual('Example Link');
-    });
+  describe('External Link', () => {
+    const mockLink = 'https://www.virustotal.com/gui/search/';
+    const mockLinkName = 'Link';
+    let wrapper: ShallowWrapper;
 
-    test('it renders correct href', () => {
-      const wrapper = mountWithIntl(
-        <ReputationLink domain={'192.0.2.0'}>{'Example Link'} </ReputationLink>
-      );
-      expect(wrapper.find('a').prop('href')).toEqual(
-        'https://www.talosintelligence.com/reputation_center/lookup?search=192.0.2.0'
-      );
+    describe('render', () => {
+      beforeAll(() => {
+        wrapper = shallow(
+          <ExternalLink url={mockLink} idx={0} allItemsLimit={5} overflowIndexStart={5}>
+            {mockLinkName}
+          </ExternalLink>
+        );
+      });
+
+      test('it renders tooltip', () => {
+        expect(wrapper.find('[data-test-subj="externalLinkTooltip"]').exists()).toBeTruthy();
+      });
+
+      test('it renders ExternalLinkIcon', () => {
+        expect(wrapper.find('[data-test-subj="externalLinkIcon"]').exists()).toBeTruthy();
+      });
+
+      test('it renders correct url', () => {
+        expect(wrapper.find('[data-test-subj="externalLink"]').prop('href')).toEqual(mockLink);
+      });
+
+      test('it renders comma if id is given', () => {
+        expect(wrapper.find('[data-test-subj="externalLinkComma"]').exists()).toBeTruthy();
+      });
     });
 
-    test("it encodes <script>alert('XSS')</script>", () => {
-      const wrapper = mountWithIntl(
-        <ReputationLink domain={"<script>alert('XSS')</script>"}>{'Example Link'}</ReputationLink>
-      );
-      expect(wrapper.find('a').prop('href')).toEqual(
-        "https://www.talosintelligence.com/reputation_center/lookup?search=%3Cscript%3Ealert('XSS')%3C%2Fscript%3E"
-      );
+    describe('not render', () => {
+      test('it should not render if childen prop is not given', () => {
+        wrapper = shallow(
+          <ExternalLink url={mockLink} idx={4} allItemsLimit={5} overflowIndexStart={5} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLinkTooltip"]').exists()).toBeFalsy();
+      });
+
+      test('it should not render if url prop is not given', () => {
+        wrapper = shallow(
+          <ExternalLink url={''} idx={4} allItemsLimit={5} overflowIndexStart={5} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLinkTooltip"]').exists()).toBeFalsy();
+      });
+
+      test('it should not render if url prop is invalid', () => {
+        wrapper = shallow(
+          <ExternalLink url={'xxx'} idx={4} allItemsLimit={5} overflowIndexStart={5} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLinkTooltip"]').exists()).toBeFalsy();
+      });
+
+      test('it should not render comma if id is not given', () => {
+        wrapper = shallow(
+          <ExternalLink url={mockLink} allItemsLimit={5} overflowIndexStart={5}>
+            {mockLinkName}
+          </ExternalLink>
+        );
+        expect(wrapper.find('[data-test-subj="externalLinkComma"]').exists()).toBeFalsy();
+      });
+
+      test('it should not render comma for the last item', () => {
+        wrapper = shallow(
+          <ExternalLink url={mockLink} idx={4} allItemsLimit={5} overflowIndexStart={5}>
+            {mockLinkName}
+          </ExternalLink>
+        );
+        expect(wrapper.find('[data-test-subj="externalLinkComma"]').exists()).toBeFalsy();
+      });
     });
+
+    describe.each<[number, number, number, boolean]>([
+      [0, 2, 5, true],
+      [1, 2, 5, false],
+      [2, 2, 5, false],
+      [3, 2, 5, false],
+      [4, 2, 5, false],
+      [5, 2, 5, false],
+    ])(
+      'renders Comma when overflowIndex is smaller than allItems limit',
+      (idx, overflowIndexStart, allItemsLimit, showComma) => {
+        beforeAll(() => {
+          wrapper = shallow(
+            <ExternalLink
+              url={mockLink}
+              idx={idx}
+              allItemsLimit={allItemsLimit}
+              overflowIndexStart={overflowIndexStart}
+            >
+              {mockLinkName}
+            </ExternalLink>
+          );
+        });
+
+        test(`should render Comma if current id (${idx}) is smaller than the index of last visible item`, () => {
+          expect(wrapper.find('[data-test-subj="externalLinkComma"]').exists()).toEqual(showComma);
+        });
+      }
+    );
+
+    describe.each<[number, number, number, boolean]>([
+      [0, 5, 4, true],
+      [1, 5, 4, true],
+      [2, 5, 4, true],
+      [3, 5, 4, false],
+      [4, 5, 4, false],
+      [5, 5, 4, false],
+    ])(
+      'When overflowIndex is grater than allItems limit',
+      (idx, overflowIndexStart, allItemsLimit, showComma) => {
+        beforeAll(() => {
+          wrapper = shallow(
+            <ExternalLink
+              url={mockLink}
+              idx={idx}
+              allItemsLimit={allItemsLimit}
+              overflowIndexStart={overflowIndexStart}
+            >
+              {mockLinkName}
+            </ExternalLink>
+          );
+        });
+
+        test(`Current item (${idx}) should render Comma execpt the last item`, () => {
+          expect(wrapper.find('[data-test-subj="externalLinkComma"]').exists()).toEqual(showComma);
+        });
+      }
+    );
+
+    describe.each<[number, number, number, boolean]>([
+      [0, 5, 5, true],
+      [1, 5, 5, true],
+      [2, 5, 5, true],
+      [3, 5, 5, true],
+      [4, 5, 5, false],
+      [5, 5, 5, false],
+    ])(
+      'when overflowIndex equals to allItems limit',
+      (idx, overflowIndexStart, allItemsLimit, showComma) => {
+        beforeAll(() => {
+          wrapper = shallow(
+            <ExternalLink
+              url={mockLink}
+              idx={idx}
+              allItemsLimit={allItemsLimit}
+              overflowIndexStart={overflowIndexStart}
+            >
+              {mockLinkName}
+            </ExternalLink>
+          );
+        });
+
+        test(`Current item (${idx}) should render Comma correctly`, () => {
+          expect(wrapper.find('[data-test-subj="externalLinkComma"]').exists()).toEqual(showComma);
+        });
+      }
+    );
   });
 
-  describe('VirusTotalLink', () => {
-    test('it renders sha passed in as value', () => {
-      const wrapper = mountWithIntl(<VirusTotalLink link={'abc'}>{'Example Link'}</VirusTotalLink>);
-      expect(wrapper.text()).toEqual('Example Link');
+  describe('ReputationLink', () => {
+    const mockCustomizedReputationLinks = [
+      { name: 'Link 1', url_template: 'https://www.virustotal.com/gui/search/{{ip}}' },
+      {
+        name: 'Link 2',
+        url_template: 'https://talosintelligence.com/reputation_center/lookup?search={{ip}}',
+      },
+      { name: 'Link 3', url_template: 'https://www.virustotal.com/gui/search/{{ip}}' },
+      {
+        name: 'Link 4',
+        url_template: 'https://talosintelligence.com/reputation_center/lookup?search={{ip}}',
+      },
+      { name: 'Link 5', url_template: 'https://www.virustotal.com/gui/search/{{ip}}' },
+      {
+        name: 'Link 6',
+        url_template: 'https://talosintelligence.com/reputation_center/lookup?search={{ip}}',
+      },
+    ];
+    const mockDefaultReputationLinks = mockCustomizedReputationLinks.slice(0, 2);
+
+    describe('links property', () => {
+      beforeEach(() => {
+        (useUiSetting$ as jest.Mock).mockReset();
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockDefaultReputationLinks]);
+      });
+
+      test('it renders default link text', () => {
+        const wrapper = shallow(<ReputationLink domain={'192.0.2.0'} />);
+        wrapper.find('[data-test-subj="externalLink"]').forEach((node, idx) => {
+          expect(node.at(idx).text()).toEqual(mockDefaultReputationLinks[idx].name);
+        });
+      });
+
+      test('it renders customized link text', () => {
+        (useUiSetting$ as jest.Mock).mockReset();
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockCustomizedReputationLinks]);
+        const wrapper = shallow(<ReputationLink domain={'192.0.2.0'} />);
+        wrapper.find('[data-test-subj="externalLink"]').forEach((node, idx) => {
+          expect(node.at(idx).text()).toEqual(mockCustomizedReputationLinks[idx].name);
+        });
+      });
+
+      test('it renders correct href', () => {
+        const wrapper = shallow(<ReputationLink domain={'192.0.2.0'} />);
+        wrapper.find('[data-test-subj="externalLink"]').forEach((node, idx) => {
+          expect(node.prop('href')).toEqual(
+            mockDefaultReputationLinks[idx].url_template.replace('{{ip}}', '192.0.2.0')
+          );
+        });
+      });
     });
 
-    test('it renders sha passed in as link', () => {
-      const wrapper = mountWithIntl(
-        <VirusTotalLink link={'abc'}>{'Example Link'} </VirusTotalLink>
-      );
-      expect(wrapper.find('a').prop('href')).toEqual('https://www.virustotal.com/#/search/abc');
+    describe('number of links', () => {
+      beforeAll(() => {
+        (useUiSetting$ as jest.Mock).mockReset();
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockCustomizedReputationLinks]);
+      });
+
+      afterEach(() => {
+        (useUiSetting$ as jest.Mock).mockClear();
+      });
+
+      test('it renders correct number of links by default', () => {
+        const wrapper = mountWithIntl(<ReputationLink domain={'192.0.2.0'} />);
+        expect(wrapper.find('[data-test-subj="externalLinkComponent"]')).toHaveLength(
+          DEFAULT_NUMBER_OF_LINK
+        );
+      });
+
+      test('it renders correct number of tooltips by default', () => {
+        const wrapper = mountWithIntl(<ReputationLink domain={'192.0.2.0'} />);
+        expect(wrapper.find('[data-test-subj="externalLinkTooltip"]')).toHaveLength(
+          DEFAULT_NUMBER_OF_LINK
+        );
+      });
+
+      test('it renders correct number of visible link', () => {
+        (useUiSetting$ as jest.Mock).mockReset();
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockCustomizedReputationLinks]);
+
+        const wrapper = mountWithIntl(
+          <ReputationLink domain={'192.0.2.0'} overflowIndexStart={1} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLinkComponent"]')).toHaveLength(1);
+      });
+
+      test('it renders correct number of tooltips for visible links', () => {
+        (useUiSetting$ as jest.Mock).mockReset();
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockCustomizedReputationLinks]);
+
+        const wrapper = mountWithIntl(
+          <ReputationLink domain={'192.0.2.0'} overflowIndexStart={1} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLinkTooltip"]')).toHaveLength(1);
+      });
     });
 
-    test("it encodes <script>alert('XSS')</script>", () => {
-      const wrapper = mountWithIntl(
-        <VirusTotalLink link={"<script>alert('XSS')</script>"}>{'Example Link'}</VirusTotalLink>
-      );
-      expect(wrapper.find('a').prop('href')).toEqual(
-        "https://www.virustotal.com/#/search/%3Cscript%3Ealert('XSS')%3C%2Fscript%3E"
-      );
+    describe('invalid customized links', () => {
+      const mockInvalidLinksEmptyObj = [{}];
+      const mockInvalidLinksNoName = [
+        { url_template: 'https://talosintelligence.com/reputation_center/lookup?search={{ip}}' },
+      ];
+      const mockInvalidLinksNoUrl = [{ name: 'Link 1' }];
+      const mockInvalidUrl = [{ name: 'Link 1', url_template: "<script>alert('XSS')</script>" }];
+      afterEach(() => {
+        (useUiSetting$ as jest.Mock).mockReset();
+      });
+
+      test('it filters empty object', () => {
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockInvalidLinksEmptyObj]);
+
+        const wrapper = mountWithIntl(
+          <ReputationLink domain={'192.0.2.0'} overflowIndexStart={1} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLink"]')).toHaveLength(0);
+      });
+
+      test('it filters object without name property', () => {
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockInvalidLinksNoName]);
+
+        const wrapper = mountWithIntl(
+          <ReputationLink domain={'192.0.2.0'} overflowIndexStart={1} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLink"]')).toHaveLength(0);
+      });
+
+      test('it filters object without url_template property', () => {
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockInvalidLinksNoUrl]);
+
+        const wrapper = mountWithIntl(
+          <ReputationLink domain={'192.0.2.0'} overflowIndexStart={1} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLink"]')).toHaveLength(0);
+      });
+
+      test('it filters object with invalid url', () => {
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockInvalidUrl]);
+
+        const wrapper = mountWithIntl(
+          <ReputationLink domain={'192.0.2.0'} overflowIndexStart={1} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLink"]')).toHaveLength(0);
+      });
+    });
+
+    describe('external icon', () => {
+      beforeAll(() => {
+        (useUiSetting$ as jest.Mock).mockReset();
+        (useUiSetting$ as jest.Mock).mockReturnValue([mockCustomizedReputationLinks]);
+      });
+
+      afterEach(() => {
+        (useUiSetting$ as jest.Mock).mockClear();
+      });
+
+      test('it renders correct number of external icons by default', () => {
+        const wrapper = mountWithIntl(<ReputationLink domain={'192.0.2.0'} />);
+        expect(wrapper.find('[data-test-subj="externalLinkIcon"]')).toHaveLength(5);
+      });
+
+      test('it renders correct number of external icons', () => {
+        const wrapper = mountWithIntl(
+          <ReputationLink domain={'192.0.2.0'} overflowIndexStart={1} />
+        );
+        expect(wrapper.find('[data-test-subj="externalLinkIcon"]')).toHaveLength(1);
+      });
     });
   });
 
diff --git a/x-pack/legacy/plugins/siem/public/components/links/index.tsx b/x-pack/legacy/plugins/siem/public/components/links/index.tsx
index b6548e3e950ba..04de0b1d5d3bf 100644
--- a/x-pack/legacy/plugins/siem/public/components/links/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/links/index.tsx
@@ -4,9 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiLink } from '@elastic/eui';
-import React from 'react';
+import { EuiLink, EuiToolTip, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import React, { useMemo } from 'react';
 
+import { isNil } from 'lodash/fp';
+import styled from 'styled-components';
+import {
+  DefaultFieldRendererOverflow,
+  DEFAULT_MORE_MAX_HEIGHT,
+} from '../field_renderers/field_renderers';
 import { encodeIpv6 } from '../../lib/helpers';
 import {
   getCaseDetailsUrl,
@@ -15,6 +21,13 @@ import {
   getCreateCaseUrl,
 } from '../link_to';
 import { FlowTarget, FlowTargetSourceDest } from '../../graphql/types';
+import { useUiSetting$ } from '../../lib/kibana';
+import { IP_REPUTATION_LINKS_SETTING } from '../../../common/constants';
+import * as i18n from '../page/network/ip_overview/translations';
+import { isUrlInvalid } from '../../pages/detection_engine/rules/components/step_about_rule/helpers';
+import { ExternalLinkIcon } from '../external_link_icon';
+
+export const DEFAULT_NUMBER_OF_LINK = 5;
 
 // Internal Links
 const HostDetailsLinkComponent: React.FC<{ children?: React.ReactNode; hostName: string }> = ({
@@ -26,6 +39,39 @@ const HostDetailsLinkComponent: React.FC<{ children?: React.ReactNode; hostName:
   </EuiLink>
 );
 
+const whitelistUrlSchemes = ['http://', 'https://'];
+export const ExternalLink = React.memo<{
+  url: string;
+  children?: React.ReactNode;
+  idx?: number;
+  overflowIndexStart?: number;
+  allItemsLimit?: number;
+}>(
+  ({
+    url,
+    children,
+    idx,
+    overflowIndexStart = DEFAULT_NUMBER_OF_LINK,
+    allItemsLimit = DEFAULT_NUMBER_OF_LINK,
+  }) => {
+    const lastVisibleItemIndex = overflowIndexStart - 1;
+    const lastItemIndex = allItemsLimit - 1;
+    const lastIndexToShow = Math.max(0, Math.min(lastVisibleItemIndex, lastItemIndex));
+    const inWhitelist = whitelistUrlSchemes.some(scheme => url.indexOf(scheme) === 0);
+    return url && inWhitelist && !isUrlInvalid(url) && children ? (
+      <EuiToolTip content={url} position="top" data-test-subj="externalLinkTooltip">
+        <EuiLink href={url} target="_blank" rel="noopener" data-test-subj="externalLink">
+          {children}
+          <ExternalLinkIcon data-test-subj="externalLinkIcon" />
+          {!isNil(idx) && idx < lastIndexToShow && <Comma data-test-subj="externalLinkComma" />}
+        </EuiLink>
+      </EuiToolTip>
+    ) : null;
+  }
+);
+
+ExternalLink.displayName = 'ExternalLink';
+
 export const HostDetailsLink = React.memo(HostDetailsLinkComponent);
 
 const IPDetailsLinkComponent: React.FC<{
@@ -63,9 +109,9 @@ CreateCaseLink.displayName = 'CreateCaseLink';
 // External Links
 export const GoogleLink = React.memo<{ children?: React.ReactNode; link: string }>(
   ({ children, link }) => (
-    <EuiLink href={`https://www.google.com/search?q=${encodeURIComponent(link)}`} target="_blank">
+    <ExternalLink url={`https://www.google.com/search?q=${encodeURIComponent(link)}`}>
       {children ? children : link}
-    </EuiLink>
+    </ExternalLink>
   )
 );
 
@@ -120,39 +166,136 @@ export const CertificateFingerprintLink = React.memo<{
 
 CertificateFingerprintLink.displayName = 'CertificateFingerprintLink';
 
-export const ReputationLink = React.memo<{ children?: React.ReactNode; domain: string }>(
-  ({ children, domain }) => (
-    <EuiLink
-      href={`https://www.talosintelligence.com/reputation_center/lookup?search=${encodeURIComponent(
-        domain
-      )}`}
-      target="_blank"
-    >
-      {children ? children : domain}
-    </EuiLink>
-  )
-);
+enum DefaultReputationLink {
+  'virustotal.com' = 'virustotal.com',
+  'talosIntelligence.com' = 'talosIntelligence.com',
+}
 
-ReputationLink.displayName = 'ReputationLink';
+export interface ReputationLinkSetting {
+  name: string;
+  url_template: string;
+}
 
-export const VirusTotalLink = React.memo<{ children?: React.ReactNode; link: string }>(
-  ({ children, link }) => (
-    <EuiLink
-      href={`https://www.virustotal.com/#/search/${encodeURIComponent(link)}`}
-      target="_blank"
-    >
-      {children ? children : link}
-    </EuiLink>
-  )
-);
+function isDefaultReputationLink(name: string): name is DefaultReputationLink {
+  return (
+    name === DefaultReputationLink['virustotal.com'] ||
+    name === DefaultReputationLink['talosIntelligence.com']
+  );
+}
+const isReputationLink = (
+  rowItem: string | ReputationLinkSetting
+): rowItem is ReputationLinkSetting =>
+  (rowItem as ReputationLinkSetting).url_template !== undefined &&
+  (rowItem as ReputationLinkSetting).name !== undefined;
+
+export const Comma = styled('span')`
+  margin-right: 5px;
+  margin-left: 5px;
+  &::after {
+    content: ' ,';
+  }
+`;
+
+Comma.displayName = 'Comma';
+
+const defaultNameMapping: Record<DefaultReputationLink, string> = {
+  [DefaultReputationLink['virustotal.com']]: i18n.VIEW_VIRUS_TOTAL,
+  [DefaultReputationLink['talosIntelligence.com']]: i18n.VIEW_TALOS_INTELLIGENCE,
+};
+
+const ReputationLinkComponent: React.FC<{
+  overflowIndexStart?: number;
+  allItemsLimit?: number;
+  showDomain?: boolean;
+  domain: string;
+  direction?: 'row' | 'column';
+}> = ({
+  overflowIndexStart = DEFAULT_NUMBER_OF_LINK,
+  allItemsLimit = DEFAULT_NUMBER_OF_LINK,
+  showDomain = false,
+  domain,
+  direction = 'row',
+}) => {
+  const [ipReputationLinksSetting] = useUiSetting$<ReputationLinkSetting[]>(
+    IP_REPUTATION_LINKS_SETTING
+  );
+
+  const ipReputationLinks: ReputationLinkSetting[] = useMemo(
+    () =>
+      ipReputationLinksSetting
+        ?.slice(0, allItemsLimit)
+        .filter(
+          ({ url_template, name }) =>
+            !isNil(url_template) && !isNil(name) && !isUrlInvalid(url_template)
+        )
+        .map(({ name, url_template }: { name: string; url_template: string }) => ({
+          name: isDefaultReputationLink(name) ? defaultNameMapping[name] : name,
+          url_template: url_template.replace(`{{ip}}`, encodeURIComponent(domain)),
+        })),
+    [ipReputationLinksSetting, domain, defaultNameMapping, allItemsLimit]
+  );
+
+  return ipReputationLinks?.length > 0 ? (
+    <section>
+      <EuiFlexGroup
+        gutterSize="none"
+        justifyContent="center"
+        direction={direction}
+        alignItems="center"
+        data-test-subj="reputationLinkGroup"
+      >
+        <EuiFlexItem grow={true}>
+          {ipReputationLinks
+            ?.slice(0, overflowIndexStart)
+            .map(({ name, url_template: urlTemplate }: ReputationLinkSetting, id) => (
+              <ExternalLink
+                allItemsLimit={ipReputationLinks.length}
+                idx={id}
+                overflowIndexStart={overflowIndexStart}
+                url={urlTemplate}
+                data-test-subj="externalLinkComponent"
+                key={`reputationLink-${id}`}
+              >
+                <>{showDomain ? domain : name ?? domain}</>
+              </ExternalLink>
+            ))}
+        </EuiFlexItem>
+
+        <EuiFlexItem grow={false}>
+          <DefaultFieldRendererOverflow
+            rowItems={ipReputationLinks}
+            idPrefix="moreReputationLink"
+            render={rowItem => {
+              return (
+                isReputationLink(rowItem) && (
+                  <ExternalLink
+                    url={rowItem.url_template}
+                    overflowIndexStart={overflowIndexStart}
+                    allItemsLimit={allItemsLimit}
+                  >
+                    <>{rowItem.name ?? domain}</>
+                  </ExternalLink>
+                )
+              );
+            }}
+            moreMaxHeight={DEFAULT_MORE_MAX_HEIGHT}
+            overflowIndexStart={overflowIndexStart}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </section>
+  ) : null;
+};
+
+ReputationLinkComponent.displayName = 'ReputationLinkComponent';
 
-VirusTotalLink.displayName = 'VirusTotalLink';
+export const ReputationLink = React.memo(ReputationLinkComponent);
 
 export const WhoIsLink = React.memo<{ children?: React.ReactNode; domain: string }>(
   ({ children, domain }) => (
-    <EuiLink href={`https://www.iana.org/whois?q=${encodeURIComponent(domain)}`} target="_blank">
+    <ExternalLink url={`https://www.iana.org/whois?q=${encodeURIComponent(domain)}`}>
       {children ? children : domain}
-    </EuiLink>
+    </ExternalLink>
   )
 );
 
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap b/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
index 0a60c8facff9c..6b866aeecc831 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
@@ -498,3 +498,3264 @@ exports[`ZeekDetails rendering it renders the default ZeekDetails 1`] = `
   timelineId="test"
 />
 `;
+
+exports[`ZeekDetails rendering it returns zeek.files if the data does contain zeek.files data 1`] = `
+.c3,
+.c3::before,
+.c3::after {
+  -webkit-transition: background 150ms ease, color 150ms ease;
+  transition: background 150ms ease, color 150ms ease;
+}
+
+.c3 {
+  border-radius: 2px;
+  padding: 0 4px 0 8px;
+  position: relative;
+  z-index: 0 !important;
+}
+
+.c3::before {
+  background-image: linear-gradient( 135deg, #535966 25%, transparent 25% ), linear-gradient( -135deg, #535966 25%, transparent 25% ), linear-gradient( 135deg, transparent 75%, #535966 75% ), linear-gradient( -135deg, transparent 75%, #535966 75% );
+  background-position: 0 0,1px 0,1px -1px,0px 1px;
+  background-size: 2px 2px;
+  bottom: 2px;
+  content: '';
+  display: block;
+  left: 2px;
+  position: absolute;
+  top: 2px;
+  width: 4px;
+}
+
+.c3:hover,
+.c3:hover .euiBadge,
+.c3:hover .euiBadge__text {
+  cursor: move;
+  cursor: -webkit-grab;
+  cursor: -moz-grab;
+  cursor: grab;
+}
+
+.event-column-view:hover .c3,
+tr:hover .c3 {
+  background-color: #343741;
+}
+
+.event-column-view:hover .c3::before,
+tr:hover .c3::before {
+  background-image: linear-gradient( 135deg, #98a2b3 25%, transparent 25% ), linear-gradient( -135deg, #98a2b3 25%, transparent 25% ), linear-gradient( 135deg, transparent 75%, #98a2b3 75% ), linear-gradient( -135deg, transparent 75%, #98a2b3 75% );
+}
+
+.c3:hover,
+.c3:focus,
+.event-column-view:hover .c3:hover,
+.event-column-view:focus .c3:focus,
+tr:hover .c3:hover,
+tr:hover .c3:focus {
+  background-color: #1ba9f5;
+}
+
+.c3:hover,
+.c3:focus,
+.event-column-view:hover .c3:hover,
+.event-column-view:focus .c3:focus,
+tr:hover .c3:hover,
+tr:hover .c3:focus,
+.c3:hover a,
+.c3:focus a,
+.event-column-view:hover .c3:hover a,
+.event-column-view:focus .c3:focus a,
+tr:hover .c3:hover a,
+tr:hover .c3:focus a,
+.c3:hover a:hover,
+.c3:focus a:hover,
+.event-column-view:hover .c3:hover a:hover,
+.event-column-view:focus .c3:focus a:hover,
+tr:hover .c3:hover a:hover,
+tr:hover .c3:focus a:hover {
+  color: #1d1e24;
+}
+
+.c3:hover::before,
+.c3:focus::before,
+.event-column-view:hover .c3:hover::before,
+.event-column-view:focus .c3:focus::before,
+tr:hover .c3:hover::before,
+tr:hover .c3:focus::before {
+  background-image: linear-gradient( 135deg, #1d1e24 25%, transparent 25% ), linear-gradient( -135deg, #1d1e24 25%, transparent 25% ), linear-gradient( 135deg, transparent 75%, #1d1e24 75% ), linear-gradient( -135deg, transparent 75%, #1d1e24 75% );
+}
+
+.c2 {
+  display: inline-block;
+  max-width: 100%;
+}
+
+.c2 [data-rbd-placeholder-context-id] {
+  display: none !important;
+}
+
+.c4 > span.euiToolTipAnchor {
+  display: block;
+}
+
+.c8 {
+  margin: 0 2px;
+}
+
+.c7 {
+  margin-top: 3px;
+}
+
+.c6 {
+  margin-right: 10px;
+}
+
+.c1 {
+  margin-left: 3px;
+}
+
+.c5 {
+  margin-left: 6px;
+}
+
+.c0 {
+  margin: 5px 0;
+}
+
+<Memo(TestProvidersComponent)>
+  <I18nProvider>
+    <IntlProvider
+      defaultLocale="en"
+      formats={
+        Object {
+          "date": Object {
+            "full": Object {
+              "day": "numeric",
+              "month": "long",
+              "weekday": "long",
+              "year": "numeric",
+            },
+            "long": Object {
+              "day": "numeric",
+              "month": "long",
+              "year": "numeric",
+            },
+            "medium": Object {
+              "day": "numeric",
+              "month": "short",
+              "year": "numeric",
+            },
+            "short": Object {
+              "day": "numeric",
+              "month": "numeric",
+              "year": "2-digit",
+            },
+          },
+          "number": Object {
+            "currency": Object {
+              "style": "currency",
+            },
+            "percent": Object {
+              "style": "percent",
+            },
+          },
+          "relative": Object {
+            "days": Object {
+              "units": "day",
+            },
+            "hours": Object {
+              "units": "hour",
+            },
+            "minutes": Object {
+              "units": "minute",
+            },
+            "months": Object {
+              "units": "month",
+            },
+            "seconds": Object {
+              "units": "second",
+            },
+            "years": Object {
+              "units": "year",
+            },
+          },
+          "time": Object {
+            "full": Object {
+              "hour": "numeric",
+              "minute": "numeric",
+              "second": "numeric",
+              "timeZoneName": "short",
+            },
+            "long": Object {
+              "hour": "numeric",
+              "minute": "numeric",
+              "second": "numeric",
+              "timeZoneName": "short",
+            },
+            "medium": Object {
+              "hour": "numeric",
+              "minute": "numeric",
+              "second": "numeric",
+            },
+            "short": Object {
+              "hour": "numeric",
+              "minute": "numeric",
+            },
+          },
+        }
+      }
+      locale="en"
+      messages={Object {}}
+      textComponent={Symbol(react.fragment)}
+    >
+      <PseudoLocaleWrapper>
+        <Component>
+          <Provider
+            services={
+              Object {
+                "advancedSettings": Object {
+                  "component": Object {
+                    "componentType": Object {
+                      "PAGE_FOOTER_COMPONENT": "advanced_settings_page_footer",
+                      "PAGE_SUBTITLE_COMPONENT": "advanced_settings_page_subtitle",
+                      "PAGE_TITLE_COMPONENT": "advanced_settings_page_title",
+                    },
+                    "get": [MockFunction],
+                  },
+                },
+                "application": Object {
+                  "capabilities": Object {
+                    "catalogue": Object {},
+                    "management": Object {},
+                    "navLinks": Object {},
+                  },
+                  "currentAppId$": Observable {
+                    "_isScalar": false,
+                    "source": Subject {
+                      "_isScalar": false,
+                      "closed": false,
+                      "hasError": false,
+                      "isStopped": false,
+                      "observers": Array [],
+                      "thrownError": null,
+                    },
+                  },
+                  "getUrlForApp": [MockFunction],
+                  "navigateToApp": [MockFunction],
+                  "registerMountContext": [MockFunction],
+                },
+                "charts": Object {
+                  "colors": Object {
+                    "createColorLookupFunction": [MockFunction],
+                  },
+                  "theme": Object {
+                    "chartsDefaultTheme": Object {
+                      "areaSeriesStyle": Object {
+                        "area": Object {
+                          "opacity": 0.3,
+                        },
+                        "line": Object {
+                          "strokeWidth": 2,
+                        },
+                        "point": Object {
+                          "fill": "rgba(255, 255, 255, 1)",
+                          "radius": 3,
+                          "strokeWidth": 2,
+                          "visible": false,
+                        },
+                      },
+                      "axes": Object {
+                        "axisLineStyle": Object {
+                          "stroke": "rgba(239, 241, 244, 1)",
+                        },
+                        "axisTitleStyle": Object {
+                          "fill": "rgba(52, 55, 65, 1)",
+                          "fontFamily": "'Inter UI', -apple-system, BlinkMacSystemFont,
+  'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'",
+                          "fontSize": 12,
+                          "padding": 10,
+                        },
+                        "gridLineStyle": Object {
+                          "horizontal": Object {
+                            "dash": Array [
+                              0,
+                              0,
+                            ],
+                            "opacity": 1,
+                            "stroke": "rgba(239, 241, 244, 1)",
+                            "strokeWidth": 1,
+                            "visible": true,
+                          },
+                          "vertical": Object {
+                            "dash": Array [
+                              4,
+                              4,
+                            ],
+                            "opacity": 1,
+                            "stroke": "rgba(239, 241, 244, 1)",
+                            "strokeWidth": 1,
+                            "visible": true,
+                          },
+                        },
+                        "tickLabelStyle": Object {
+                          "fill": "rgba(105, 112, 125, 1)",
+                          "fontFamily": "'Inter UI', -apple-system, BlinkMacSystemFont,
+  'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'",
+                          "fontSize": 10,
+                          "padding": 8,
+                        },
+                        "tickLineStyle": Object {
+                          "stroke": "rgba(239, 241, 244, 1)",
+                          "strokeWidth": 1,
+                          "visible": false,
+                        },
+                      },
+                      "barSeriesStyle": Object {
+                        "displayValue": Object {
+                          "fill": "rgba(105, 112, 125, 1)",
+                          "fontFamily": "'Inter UI', -apple-system, BlinkMacSystemFont,
+  'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'",
+                          "fontSize": 8,
+                        },
+                      },
+                      "chartMargins": Object {
+                        "bottom": 0,
+                        "left": 0,
+                        "right": 0,
+                        "top": 0,
+                      },
+                      "colors": Object {
+                        "defaultVizColor": "#6092C0",
+                        "vizColors": Array [
+                          "#54B399",
+                          "#6092C0",
+                          "#D36086",
+                          "#9170B8",
+                          "#CA8EAE",
+                          "#D6BF57",
+                          "#B9A888",
+                          "#DA8B45",
+                          "#AA6556",
+                          "#E7664C",
+                        ],
+                      },
+                      "crosshair": Object {
+                        "band": Object {
+                          "fill": "rgba(245, 247, 250, 1)",
+                        },
+                        "line": Object {
+                          "dash": Array [
+                            4,
+                            4,
+                          ],
+                          "stroke": "rgba(105, 112, 125, 1)",
+                          "strokeWidth": 1,
+                        },
+                      },
+                      "lineSeriesStyle": Object {
+                        "line": Object {
+                          "strokeWidth": 2,
+                        },
+                        "point": Object {
+                          "fill": "rgba(255, 255, 255, 1)",
+                          "radius": 3,
+                          "strokeWidth": 2,
+                        },
+                      },
+                      "scales": Object {
+                        "barsPadding": 0.25,
+                        "histogramPadding": 0.05,
+                      },
+                    },
+                    "chartsTheme$": [MockFunction],
+                    "useChartsTheme": [MockFunction],
+                  },
+                },
+                "chrome": Object {
+                  "addApplicationClass": [MockFunction],
+                  "docTitle": Object {
+                    "__legacy": Object {
+                      "setBaseTitle": [MockFunction],
+                    },
+                    "change": [MockFunction],
+                    "reset": [MockFunction],
+                  },
+                  "getApplicationClasses$": [MockFunction],
+                  "getBadge$": [MockFunction],
+                  "getBrand$": [MockFunction],
+                  "getBreadcrumbs$": [MockFunction],
+                  "getHeaderComponent": [MockFunction],
+                  "getHelpExtension$": [MockFunction],
+                  "getIsCollapsed$": [MockFunction],
+                  "getIsVisible$": [MockFunction],
+                  "navControls": Object {
+                    "getLeft$": [MockFunction],
+                    "getRight$": [MockFunction],
+                    "registerLeft": [MockFunction],
+                    "registerRight": [MockFunction],
+                  },
+                  "navLinks": Object {
+                    "enableForcedAppSwitcherNavigation": [MockFunction],
+                    "get": [MockFunction],
+                    "getAll": [MockFunction],
+                    "getForceAppSwitcherNavigation$": [MockFunction],
+                    "getNavLinks$": [MockFunction],
+                    "has": [MockFunction],
+                    "showOnly": [MockFunction],
+                    "update": [MockFunction],
+                  },
+                  "recentlyAccessed": Object {
+                    "add": [MockFunction],
+                    "get": [MockFunction],
+                    "get$": [MockFunction],
+                  },
+                  "removeApplicationClass": [MockFunction],
+                  "setAppTitle": [MockFunction],
+                  "setBadge": [MockFunction],
+                  "setBrand": [MockFunction],
+                  "setBreadcrumbs": [MockFunction],
+                  "setHelpExtension": [MockFunction],
+                  "setHelpSupportUrl": [MockFunction],
+                  "setIsCollapsed": [MockFunction],
+                  "setIsVisible": [MockFunction],
+                },
+                "data": Object {
+                  "__LEGACY": Object {
+                    "esClient": Object {
+                      "msearch": [MockFunction],
+                      "search": [MockFunction],
+                    },
+                  },
+                  "autocomplete": Object {
+                    "getQuerySuggestions": [MockFunction],
+                    "getValueSuggestions": [MockFunction],
+                    "hasQuerySuggestions": [MockFunction],
+                  },
+                  "fieldFormats": Object {
+                    "deserialize": [MockFunction],
+                    "getByFieldType": [MockFunction],
+                    "getDefaultConfig": [MockFunction],
+                    "getDefaultInstance": [MockFunction],
+                    "getDefaultInstanceCacheResolver": [MockFunction],
+                    "getDefaultInstancePlain": [MockFunction],
+                    "getDefaultType": [MockFunction],
+                    "getDefaultTypeName": [MockFunction],
+                    "getInstance": [MockFunction],
+                    "getType": [MockFunction],
+                    "getTypeNameByEsTypes": [MockFunction],
+                    "getTypeWithoutMetaParams": [MockFunction],
+                    "init": [MockFunction],
+                    "parseDefaultTypeMap": [MockFunction],
+                    "register": [MockFunction],
+                  },
+                  "getSuggestions": [MockFunction],
+                  "indexPatterns": Object {
+                    "get": [MockFunction],
+                    "make": [Function],
+                  },
+                  "query": Object {
+                    "filterManager": [MockFunction],
+                    "savedQueries": [MockFunction],
+                    "timefilter": Object {
+                      "history": Object {
+                        "add": [MockFunction],
+                        "get": [MockFunction],
+                      },
+                      "timefilter": Object {
+                        "calculateBounds": [MockFunction],
+                        "createFilter": [MockFunction],
+                        "disableAutoRefreshSelector": [MockFunction],
+                        "disableTimeRangeSelector": [MockFunction],
+                        "enableAutoRefreshSelector": [MockFunction],
+                        "enableTimeRangeSelector": [MockFunction],
+                        "getActiveBounds": [MockFunction],
+                        "getAutoRefreshFetch$": [MockFunction],
+                        "getBounds": [MockFunction],
+                        "getEnabledUpdated$": [MockFunction],
+                        "getFetch$": [MockFunction],
+                        "getRefreshInterval": [MockFunction],
+                        "getRefreshIntervalUpdate$": [MockFunction],
+                        "getTime": [MockFunction],
+                        "getTimeUpdate$": [MockFunction],
+                        "isAutoRefreshSelectorEnabled": [MockFunction],
+                        "isTimeRangeSelectorEnabled": [MockFunction],
+                        "setRefreshInterval": [MockFunction],
+                        "setTime": [MockFunction],
+                      },
+                    },
+                  },
+                  "search": Object {
+                    "__LEGACY": Object {
+                      "esClient": Object {
+                        "msearch": [MockFunction],
+                        "search": [MockFunction],
+                      },
+                    },
+                    "search": [MockFunction],
+                  },
+                  "ui": Object {
+                    "IndexPatternSelect": [MockFunction],
+                    "SearchBar": [MockFunction],
+                  },
+                },
+                "docLinks": Object {
+                  "DOC_LINK_VERSION": "mocked-test-branch",
+                  "ELASTIC_WEBSITE_URL": "https://www.elastic.co/",
+                  "links": Object {
+                    "aggs": Object {
+                      "avg": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-avg-aggregation.html",
+                      "avg_bucket": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-pipeline-avg-bucket-aggregation.html",
+                      "cardinality": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-cardinality-aggregation.html",
+                      "count": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-valuecount-aggregation.html",
+                      "cumulative_sum": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-sum-aggregation.html",
+                      "date_histogram": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-datehistogram-aggregation.html",
+                      "date_range": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-daterange-aggregation.html",
+                      "derivative": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-pipeline-derivative-aggregation.html",
+                      "filter": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-filter-aggregation.html",
+                      "filters": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-filters-aggregation.html",
+                      "geo_bounds": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-geobounds-aggregation.html",
+                      "geo_centroid": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-geocentroid-aggregation.html",
+                      "geohash_grid": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-geohashgrid-aggregation.html",
+                      "histogram": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-histogram-aggregation.html",
+                      "ip_range": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-iprange-aggregation.html",
+                      "max": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-max-aggregation.html",
+                      "max_bucket": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-pipeline-max-bucket-aggregation.html",
+                      "median": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-percentile-aggregation.html",
+                      "min": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-min-aggregation.html",
+                      "min_bucket": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-pipeline-min-bucket-aggregation.html",
+                      "moving_avg": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-pipeline-movavg-aggregation.html",
+                      "percentile_ranks": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-percentile-rank-aggregation.html",
+                      "range": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-range-aggregation.html",
+                      "serial_diff": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-pipeline-serialdiff-aggregation.html",
+                      "significant_terms": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-significantterms-aggregation.html",
+                      "std_dev": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-extendedstats-aggregation.html",
+                      "sum": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-sum-aggregation.html",
+                      "sum_bucket": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-pipeline-sum-bucket-aggregation.html",
+                      "terms": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-bucket-terms-aggregation.html",
+                      "top_hits": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations-metrics-top-hits-aggregation.html",
+                    },
+                    "auditbeat": Object {
+                      "base": "https://www.elastic.co/guide/en/beats/auditbeat/mocked-test-branch",
+                    },
+                    "date": Object {
+                      "dateMath": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/common-options.html#date-math",
+                    },
+                    "filebeat": Object {
+                      "base": "https://www.elastic.co/guide/en/beats/filebeat/mocked-test-branch",
+                      "configuration": "https://www.elastic.co/guide/en/beats/filebeat/mocked-test-branch/filebeat-configuration.html",
+                      "elasticsearchOutput": "https://www.elastic.co/guide/en/beats/filebeat/mocked-test-branch/elasticsearch-output.html",
+                      "exportedFields": "https://www.elastic.co/guide/en/beats/filebeat/mocked-test-branch/exported-fields.html",
+                      "installation": "https://www.elastic.co/guide/en/beats/filebeat/mocked-test-branch/filebeat-installation.html",
+                      "startup": "https://www.elastic.co/guide/en/beats/filebeat/mocked-test-branch/filebeat-starting.html",
+                    },
+                    "functionbeat": Object {
+                      "base": "https://www.elastic.co/guide/en/beats/functionbeat/mocked-test-branch",
+                    },
+                    "heartbeat": Object {
+                      "base": "https://www.elastic.co/guide/en/beats/heartbeat/mocked-test-branch",
+                    },
+                    "indexPatterns": Object {
+                      "introduction": "https://www.elastic.co/guide/en/kibana/mocked-test-branch/index-patterns.html",
+                      "loadingData": "https://www.elastic.co/guide/en/kibana/mocked-test-branch/tutorial-load-dataset.html",
+                    },
+                    "kibana": "https://www.elastic.co/guide/en/kibana/mocked-test-branch/index.html",
+                    "logstash": Object {
+                      "base": "https://www.elastic.co/guide/en/logstash/mocked-test-branch",
+                    },
+                    "management": Object {
+                      "kibanaSearchSettings": "https://www.elastic.co/guide/en/kibana/mocked-test-branch/advanced-options.html#kibana-search-settings",
+                    },
+                    "metricbeat": Object {
+                      "base": "https://www.elastic.co/guide/en/beats/metricbeat/mocked-test-branch",
+                    },
+                    "query": Object {
+                      "kueryQuerySyntax": "https://www.elastic.co/guide/en/kibana/mocked-test-branch/kuery-query.html",
+                      "luceneQuerySyntax": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/query-dsl-query-string-query.html#query-string-syntax",
+                      "queryDsl": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/query-dsl.html",
+                    },
+                    "scriptedFields": Object {
+                      "luceneExpressions": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/modules-scripting-expression.html",
+                      "painless": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/modules-scripting-painless.html",
+                      "painlessApi": "https://www.elastic.co/guide/en/elasticsearch/painless/mocked-test-branch/painless-api-reference.html",
+                      "painlessSyntax": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/modules-scripting-painless-syntax.html",
+                      "scriptAggs": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-aggregations.html#_values_source",
+                      "scriptFields": "https://www.elastic.co/guide/en/elasticsearch/reference/mocked-test-branch/search-request-script-fields.html",
+                    },
+                    "siem": Object {
+                      "gettingStarted": "https://www.elastic.co/guide/en/siem/guide/mocked-test-branch/install-siem.html",
+                      "guide": "https://www.elastic.co/guide/en/siem/guide/mocked-test-branch/index.html",
+                    },
+                    "winlogbeat": Object {
+                      "base": "https://www.elastic.co/guide/en/beats/winlogbeat/mocked-test-branch",
+                    },
+                  },
+                },
+                "embeddable": Object {
+                  "getEmbeddableFactories": [MockFunction],
+                  "getEmbeddableFactory": [MockFunction],
+                  "registerEmbeddableFactory": [MockFunction],
+                },
+                "expressions": Object {
+                  "ExpressionLoader": [MockFunction],
+                  "ExpressionRenderHandler": [MockFunction],
+                  "ReactExpressionRenderer": [MockFunction],
+                  "execute": [MockFunction],
+                  "fork": [MockFunction],
+                  "getFunction": [MockFunction],
+                  "getFunctions": [MockFunction],
+                  "getRenderer": [MockFunction],
+                  "getRenderers": [MockFunction],
+                  "getType": [MockFunction],
+                  "getTypes": [MockFunction],
+                  "loader": [MockFunction],
+                  "render": [MockFunction],
+                  "run": [MockFunction],
+                },
+                "fatalErrors": Object {
+                  "add": [MockFunction],
+                  "get$": [MockFunction],
+                },
+                "http": Object {
+                  "addLoadingCountSource": [MockFunction],
+                  "anonymousPaths": Object {
+                    "isAnonymous": [MockFunction],
+                    "register": [MockFunction],
+                  },
+                  "basePath": BasePath {
+                    "basePath": "",
+                    "get": [Function],
+                    "prepend": [Function],
+                    "remove": [Function],
+                    "serverBasePath": "",
+                  },
+                  "delete": [MockFunction],
+                  "fetch": [MockFunction],
+                  "get": [MockFunction],
+                  "getLoadingCount$": [MockFunction],
+                  "head": [MockFunction],
+                  "intercept": [MockFunction],
+                  "options": [MockFunction],
+                  "patch": [MockFunction],
+                  "post": [MockFunction],
+                  "put": [MockFunction],
+                },
+                "i18n": Object {
+                  "Context": [MockFunction],
+                },
+                "injectedMetadata": Object {
+                  "getInjectedVar": [MockFunction],
+                },
+                "inspector": Object {
+                  "isAvailable": [MockFunction],
+                  "open": [MockFunction],
+                },
+                "kibanaLegacy": Object {
+                  "config": Object {
+                    "defaultAppId": "home",
+                  },
+                  "dashboardConfig": Object {
+                    "getHideWriteControls": [MockFunction],
+                    "turnHideWriteControlsOn": [MockFunction],
+                  },
+                  "getApps": [MockFunction],
+                  "getForwards": [MockFunction],
+                },
+                "management": Object {
+                  "legacy": Object {},
+                  "sections": Object {
+                    "getAllSections": [MockFunction],
+                    "getSection": [MockFunction],
+                    "navigateToApp": [MockFunction],
+                  },
+                },
+                "navigation": Object {
+                  "ui": Object {
+                    "TopNavMenu": [MockFunction],
+                  },
+                },
+                "notifications": Object {
+                  "toasts": Object {
+                    "add": [MockFunction],
+                    "addDanger": [MockFunction],
+                    "addError": [MockFunction],
+                    "addSuccess": [MockFunction],
+                    "addWarning": [MockFunction],
+                    "get$": [MockFunction],
+                    "remove": [MockFunction],
+                  },
+                },
+                "overlays": Object {
+                  "banners": Object {
+                    "add": [MockFunction],
+                    "get$": [MockFunction],
+                    "getComponent": [MockFunction],
+                    "remove": [MockFunction],
+                    "replace": [MockFunction],
+                  },
+                  "openConfirm": [MockFunction],
+                  "openFlyout": [MockFunction],
+                  "openModal": [MockFunction],
+                },
+                "savedObjects": Object {
+                  "client": Object {
+                    "bulkCreate": [MockFunction],
+                    "bulkGet": [MockFunction],
+                    "bulkUpdate": [MockFunction],
+                    "create": [MockFunction],
+                    "delete": [MockFunction],
+                    "find": [MockFunction],
+                    "get": [MockFunction],
+                    "update": [MockFunction],
+                  },
+                },
+                "uiActions": Object {
+                  "attachAction": [MockFunction],
+                  "clear": [MockFunction],
+                  "detachAction": [MockFunction],
+                  "executeTriggerActions": [MockFunction],
+                  "fork": [MockFunction],
+                  "getTrigger": [MockFunction],
+                  "getTriggerActions": [MockFunction],
+                  "getTriggerCompatibleActions": [MockFunction],
+                  "registerAction": [MockFunction],
+                  "registerTrigger": [MockFunction],
+                },
+                "uiSettings": Object {
+                  "get": [Function],
+                  "get$": [MockFunction] {
+                    "calls": Array [
+                      Array [
+                        "siem:ipReputationLinks",
+                        undefined,
+                      ],
+                    ],
+                    "results": Array [
+                      Object {
+                        "type": "return",
+                        "value": Subject {
+                          "_isScalar": false,
+                          "closed": false,
+                          "hasError": false,
+                          "isStopped": false,
+                          "observers": Array [
+                            Subscriber {
+                              "_parentOrParents": null,
+                              "_subscriptions": Array [
+                                SubjectSubscription {
+                                  "_parentOrParents": [Circular],
+                                  "_subscriptions": null,
+                                  "closed": false,
+                                  "subject": [Circular],
+                                  "subscriber": [Circular],
+                                },
+                              ],
+                              "closed": false,
+                              "destination": SafeSubscriber {
+                                "_complete": undefined,
+                                "_context": [Circular],
+                                "_error": undefined,
+                                "_next": [Function],
+                                "_parentOrParents": null,
+                                "_parentSubscriber": [Circular],
+                                "_subscriptions": null,
+                                "closed": false,
+                                "destination": Object {
+                                  "closed": true,
+                                  "complete": [Function],
+                                  "error": [Function],
+                                  "next": [Function],
+                                },
+                                "isStopped": false,
+                                "syncErrorThrowable": false,
+                                "syncErrorThrown": false,
+                                "syncErrorValue": null,
+                              },
+                              "isStopped": false,
+                              "syncErrorThrowable": true,
+                              "syncErrorThrown": false,
+                              "syncErrorValue": null,
+                            },
+                          ],
+                          "thrownError": null,
+                        },
+                      },
+                    ],
+                  },
+                  "getAll": [MockFunction],
+                  "getSaved$": [MockFunction],
+                  "getUpdate$": [MockFunction],
+                  "getUpdateErrors$": [MockFunction],
+                  "isCustom": [MockFunction],
+                  "isDeclared": [MockFunction],
+                  "isDefault": [MockFunction],
+                  "isOverridden": [MockFunction],
+                  "overrideLocalDefault": [MockFunction],
+                  "remove": [MockFunction],
+                  "set": [MockFunction],
+                },
+              }
+            }
+          >
+            <ApolloProvider
+              client={
+                ApolloClient {
+                  "__operations_cache__": Map {},
+                  "cache": InMemoryCache {
+                    "addTypename": true,
+                    "cacheKeyRoot": KeyTrie {
+                      "weakness": true,
+                    },
+                    "config": Object {
+                      "addTypename": true,
+                      "dataIdFromObject": [Function],
+                      "fragmentMatcher": HeuristicFragmentMatcher {},
+                      "freezeResults": false,
+                      "resultCaching": true,
+                    },
+                    "data": DepTrackingCache {
+                      "data": Object {},
+                      "depend": [Function],
+                    },
+                    "maybeBroadcastWatch": [Function],
+                    "optimisticData": DepTrackingCache {
+                      "data": Object {},
+                      "depend": [Function],
+                    },
+                    "silenceBroadcast": false,
+                    "storeReader": StoreReader {
+                      "executeSelectionSet": [Function],
+                      "executeStoreQuery": [Function],
+                      "executeSubSelectedArray": [Function],
+                      "freezeResults": false,
+                    },
+                    "storeWriter": StoreWriter {},
+                    "typenameDocumentCache": Map {},
+                    "watches": Set {},
+                  },
+                  "defaultOptions": Object {},
+                  "disableNetworkFetches": false,
+                  "link": ApolloLink {
+                    "request": [Function],
+                  },
+                  "mutate": [Function],
+                  "query": [Function],
+                  "queryDeduplication": true,
+                  "reFetchObservableQueries": [Function],
+                  "resetStore": [Function],
+                  "resetStoreCallbacks": Array [],
+                  "ssrMode": false,
+                  "store": DataStore {
+                    "cache": InMemoryCache {
+                      "addTypename": true,
+                      "cacheKeyRoot": KeyTrie {
+                        "weakness": true,
+                      },
+                      "config": Object {
+                        "addTypename": true,
+                        "dataIdFromObject": [Function],
+                        "fragmentMatcher": HeuristicFragmentMatcher {},
+                        "freezeResults": false,
+                        "resultCaching": true,
+                      },
+                      "data": DepTrackingCache {
+                        "data": Object {},
+                        "depend": [Function],
+                      },
+                      "maybeBroadcastWatch": [Function],
+                      "optimisticData": DepTrackingCache {
+                        "data": Object {},
+                        "depend": [Function],
+                      },
+                      "silenceBroadcast": false,
+                      "storeReader": StoreReader {
+                        "executeSelectionSet": [Function],
+                        "executeStoreQuery": [Function],
+                        "executeSubSelectedArray": [Function],
+                        "freezeResults": false,
+                      },
+                      "storeWriter": StoreWriter {},
+                      "typenameDocumentCache": Map {},
+                      "watches": Set {},
+                    },
+                  },
+                  "version": "2.3.8",
+                  "watchQuery": [Function],
+                }
+              }
+            >
+              <Provider
+                store={
+                  Object {
+                    "dispatch": [Function],
+                    "getState": [Function],
+                    "replaceReducer": [Function],
+                    "subscribe": [Function],
+                    Symbol(observable): [Function],
+                  }
+                }
+              >
+                <ThemeProvider
+                  theme={[Function]}
+                >
+                  <DragDropContext
+                    onDragEnd={[MockFunction]}
+                  >
+                    <ErrorBoundary>
+                      <App
+                        contextId="6"
+                        liftInstruction="Draggable item. Ensure your screen reader is not in browse mode and then press space bar to lift."
+                        onDragEnd={[MockFunction]}
+                        setCallbacks={[Function]}
+                      >
+                        <Provider
+                          context={
+                            Object {
+                              "$$typeof": Symbol(react.context),
+                              "Consumer": Object {
+                                "$$typeof": Symbol(react.context),
+                                "_calculateChangedBits": null,
+                                "_context": [Circular],
+                              },
+                              "Provider": Object {
+                                "$$typeof": Symbol(react.provider),
+                                "_context": [Circular],
+                              },
+                              "_calculateChangedBits": null,
+                              "_currentRenderer": Object {},
+                              "_currentRenderer2": null,
+                              "_currentValue": null,
+                              "_currentValue2": null,
+                              "_threadCount": 0,
+                            }
+                          }
+                          store={
+                            Object {
+                              "dispatch": [Function],
+                              "getState": [Function],
+                              "replaceReducer": [Function],
+                              "subscribe": [Function],
+                              Symbol(observable): [Function],
+                            }
+                          }
+                        >
+                          <ZeekDetails
+                            browserFields={
+                              Object {
+                                "agent": Object {
+                                  "fields": Object {
+                                    "agent.ephemeral_id": Object {
+                                      "aggregatable": true,
+                                      "category": "agent",
+                                      "description": "Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but \`agent.id\` does not.",
+                                      "example": "8a4f500f",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "agent.ephemeral_id",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "agent.hostname": Object {
+                                      "aggregatable": true,
+                                      "category": "agent",
+                                      "description": null,
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "agent.hostname",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "agent.id": Object {
+                                      "aggregatable": true,
+                                      "category": "agent",
+                                      "description": "Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.",
+                                      "example": "8a4f500d",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "agent.id",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "agent.name": Object {
+                                      "aggregatable": true,
+                                      "category": "agent",
+                                      "description": "Name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.",
+                                      "example": "foo",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "agent.name",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                  },
+                                },
+                                "auditd": Object {
+                                  "fields": Object {
+                                    "auditd.data.a0": Object {
+                                      "aggregatable": true,
+                                      "category": "auditd",
+                                      "description": null,
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                      ],
+                                      "name": "auditd.data.a0",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "auditd.data.a1": Object {
+                                      "aggregatable": true,
+                                      "category": "auditd",
+                                      "description": null,
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                      ],
+                                      "name": "auditd.data.a1",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "auditd.data.a2": Object {
+                                      "aggregatable": true,
+                                      "category": "auditd",
+                                      "description": null,
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                      ],
+                                      "name": "auditd.data.a2",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                  },
+                                },
+                                "base": Object {
+                                  "fields": Object {
+                                    "@timestamp": Object {
+                                      "aggregatable": true,
+                                      "category": "base",
+                                      "description": "Date/time when the event originated. For log events this is the date/time when the event was generated, and not when it was read. Required field for all events.",
+                                      "example": "2016-05-23T08:05:34.853Z",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "@timestamp",
+                                      "searchable": true,
+                                      "type": "date",
+                                    },
+                                  },
+                                },
+                                "client": Object {
+                                  "fields": Object {
+                                    "client.address": Object {
+                                      "aggregatable": true,
+                                      "category": "client",
+                                      "description": "Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "client.address",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "client.bytes": Object {
+                                      "aggregatable": true,
+                                      "category": "client",
+                                      "description": "Bytes sent from the client to the server.",
+                                      "example": "184",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "client.bytes",
+                                      "searchable": true,
+                                      "type": "number",
+                                    },
+                                    "client.domain": Object {
+                                      "aggregatable": true,
+                                      "category": "client",
+                                      "description": "Client domain.",
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "client.domain",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "client.geo.country_iso_code": Object {
+                                      "aggregatable": true,
+                                      "category": "client",
+                                      "description": "Country ISO code.",
+                                      "example": "CA",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "client.geo.country_iso_code",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                  },
+                                },
+                                "cloud": Object {
+                                  "fields": Object {
+                                    "cloud.account.id": Object {
+                                      "aggregatable": true,
+                                      "category": "cloud",
+                                      "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
+                                      "example": "666777888999",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "cloud.account.id",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "cloud.availability_zone": Object {
+                                      "aggregatable": true,
+                                      "category": "cloud",
+                                      "description": "Availability zone in which this host is running.",
+                                      "example": "us-east-1c",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "cloud.availability_zone",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                  },
+                                },
+                                "container": Object {
+                                  "fields": Object {
+                                    "container.id": Object {
+                                      "aggregatable": true,
+                                      "category": "container",
+                                      "description": "Unique container id.",
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "container.id",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "container.image.name": Object {
+                                      "aggregatable": true,
+                                      "category": "container",
+                                      "description": "Name of the image the container was built on.",
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "container.image.name",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "container.image.tag": Object {
+                                      "aggregatable": true,
+                                      "category": "container",
+                                      "description": "Container image tag.",
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "container.image.tag",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                  },
+                                },
+                                "destination": Object {
+                                  "fields": Object {
+                                    "destination.address": Object {
+                                      "aggregatable": true,
+                                      "category": "destination",
+                                      "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "destination.address",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "destination.bytes": Object {
+                                      "aggregatable": true,
+                                      "category": "destination",
+                                      "description": "Bytes sent from the destination to the source.",
+                                      "example": "184",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "destination.bytes",
+                                      "searchable": true,
+                                      "type": "number",
+                                    },
+                                    "destination.domain": Object {
+                                      "aggregatable": true,
+                                      "category": "destination",
+                                      "description": "Destination domain.",
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "destination.domain",
+                                      "searchable": true,
+                                      "type": "string",
+                                    },
+                                    "destination.ip": Object {
+                                      "aggregatable": true,
+                                      "category": "destination",
+                                      "description": "IP address of the destination. Can be one or multiple IPv4 or IPv6 addresses.",
+                                      "example": "",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "destination.ip",
+                                      "searchable": true,
+                                      "type": "ip",
+                                    },
+                                    "destination.port": Object {
+                                      "aggregatable": true,
+                                      "category": "destination",
+                                      "description": "Port of the destination.",
+                                      "example": "",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "destination.port",
+                                      "searchable": true,
+                                      "type": "long",
+                                    },
+                                  },
+                                },
+                                "event": Object {
+                                  "fields": Object {
+                                    "event.end": Object {
+                                      "aggregatable": true,
+                                      "category": "event",
+                                      "description": "event.end contains the date when the event ended or when the activity was last observed.",
+                                      "example": null,
+                                      "format": "",
+                                      "indexes": Array [
+                                        "apm-*-transaction*",
+                                        "auditbeat-*",
+                                        "endgame-*",
+                                        "filebeat-*",
+                                        "packetbeat-*",
+                                        "winlogbeat-*",
+                                      ],
+                                      "name": "event.end",
+                                      "searchable": true,
+                                      "type": "date",
+                                    },
+                                  },
+                                },
+                                "source": Object {
+                                  "fields": Object {
+                                    "source.ip": Object {
+                                      "aggregatable": true,
+                                      "category": "source",
+                                      "description": "IP address of the source. Can be one or multiple IPv4 or IPv6 addresses.",
+                                      "example": "",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "source.ip",
+                                      "searchable": true,
+                                      "type": "ip",
+                                    },
+                                    "source.port": Object {
+                                      "aggregatable": true,
+                                      "category": "source",
+                                      "description": "Port of the source.",
+                                      "example": "",
+                                      "format": "",
+                                      "indexes": Array [
+                                        "auditbeat",
+                                        "filebeat",
+                                        "packetbeat",
+                                      ],
+                                      "name": "source.port",
+                                      "searchable": true,
+                                      "type": "long",
+                                    },
+                                  },
+                                },
+                              }
+                            }
+                            data={
+                              Object {
+                                "_id": "19",
+                                "destination": null,
+                                "event": Object {
+                                  "action": null,
+                                  "category": null,
+                                  "dataset": Array [
+                                    "zeek.files",
+                                  ],
+                                  "id": null,
+                                  "module": Array [
+                                    "zeek",
+                                  ],
+                                  "severity": null,
+                                },
+                                "geo": null,
+                                "host": Object {
+                                  "id": Array [
+                                    "af3fddf15f1d47979ce817ba0df10c6e",
+                                  ],
+                                  "ip": Array [
+                                    "206.189.35.240",
+                                    "10.15.0.5",
+                                    "fe80::98c7:eff:fe29:4455",
+                                  ],
+                                  "name": Array [
+                                    "suricata-zeek-singapore",
+                                  ],
+                                },
+                                "http": null,
+                                "network": null,
+                                "source": null,
+                                "suricata": null,
+                                "timestamp": "2019-03-03T04:26:38.000Z",
+                                "url": null,
+                                "zeek": Object {
+                                  "connection": null,
+                                  "dns": null,
+                                  "files": Object {
+                                    "analyzers": Array [
+                                      "MD5",
+                                      "SHA1",
+                                    ],
+                                    "depth": Array [
+                                      0,
+                                    ],
+                                    "duration": Array [
+                                      0,
+                                    ],
+                                    "fuid": Array [
+                                      "FePz1uVEVCZ3I0FQi",
+                                    ],
+                                    "is_orig": Array [
+                                      false,
+                                    ],
+                                    "local_orig": Array [
+                                      false,
+                                    ],
+                                    "md5": Array [
+                                      "f7653f1951693021daa9e6be61226e32",
+                                    ],
+                                    "mime_type": Array [
+                                      "text/plain",
+                                    ],
+                                    "missing_bytes": Array [
+                                      0,
+                                    ],
+                                    "overflow_bytes": Array [
+                                      0,
+                                    ],
+                                    "rx_host": Array [
+                                      "206.189.35.240",
+                                    ],
+                                    "seen_bytes": Array [
+                                      1198,
+                                    ],
+                                    "session_ids": Array [
+                                      "Cu0n232QMyvNtzb75j",
+                                    ],
+                                    "sha1": Array [
+                                      "fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                    ],
+                                    "source": Array [
+                                      "HTTP",
+                                    ],
+                                    "timedout": Array [
+                                      false,
+                                    ],
+                                    "total_bytes": Array [
+                                      88722,
+                                    ],
+                                    "tx_host": Array [
+                                      "5.101.111.50",
+                                    ],
+                                  },
+                                  "http": null,
+                                  "notice": null,
+                                  "session_id": Array [
+                                    "Cu0n232QMyvNtzb75j",
+                                  ],
+                                  "ssl": null,
+                                },
+                              }
+                            }
+                            timelineId="test"
+                          >
+                            <Details>
+                              <div
+                                className="c0"
+                              >
+                                <ZeekSignature
+                                  data={
+                                    Object {
+                                      "_id": "19",
+                                      "destination": null,
+                                      "event": Object {
+                                        "action": null,
+                                        "category": null,
+                                        "dataset": Array [
+                                          "zeek.files",
+                                        ],
+                                        "id": null,
+                                        "module": Array [
+                                          "zeek",
+                                        ],
+                                        "severity": null,
+                                      },
+                                      "geo": null,
+                                      "host": Object {
+                                        "id": Array [
+                                          "af3fddf15f1d47979ce817ba0df10c6e",
+                                        ],
+                                        "ip": Array [
+                                          "206.189.35.240",
+                                          "10.15.0.5",
+                                          "fe80::98c7:eff:fe29:4455",
+                                        ],
+                                        "name": Array [
+                                          "suricata-zeek-singapore",
+                                        ],
+                                      },
+                                      "http": null,
+                                      "network": null,
+                                      "source": null,
+                                      "suricata": null,
+                                      "timestamp": "2019-03-03T04:26:38.000Z",
+                                      "url": null,
+                                      "zeek": Object {
+                                        "connection": null,
+                                        "dns": null,
+                                        "files": Object {
+                                          "analyzers": Array [
+                                            "MD5",
+                                            "SHA1",
+                                          ],
+                                          "depth": Array [
+                                            0,
+                                          ],
+                                          "duration": Array [
+                                            0,
+                                          ],
+                                          "fuid": Array [
+                                            "FePz1uVEVCZ3I0FQi",
+                                          ],
+                                          "is_orig": Array [
+                                            false,
+                                          ],
+                                          "local_orig": Array [
+                                            false,
+                                          ],
+                                          "md5": Array [
+                                            "f7653f1951693021daa9e6be61226e32",
+                                          ],
+                                          "mime_type": Array [
+                                            "text/plain",
+                                          ],
+                                          "missing_bytes": Array [
+                                            0,
+                                          ],
+                                          "overflow_bytes": Array [
+                                            0,
+                                          ],
+                                          "rx_host": Array [
+                                            "206.189.35.240",
+                                          ],
+                                          "seen_bytes": Array [
+                                            1198,
+                                          ],
+                                          "session_ids": Array [
+                                            "Cu0n232QMyvNtzb75j",
+                                          ],
+                                          "sha1": Array [
+                                            "fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                          ],
+                                          "source": Array [
+                                            "HTTP",
+                                          ],
+                                          "timedout": Array [
+                                            false,
+                                          ],
+                                          "total_bytes": Array [
+                                            88722,
+                                          ],
+                                          "tx_host": Array [
+                                            "5.101.111.50",
+                                          ],
+                                        },
+                                        "http": null,
+                                        "notice": null,
+                                        "session_id": Array [
+                                          "Cu0n232QMyvNtzb75j",
+                                        ],
+                                        "ssl": null,
+                                      },
+                                    }
+                                  }
+                                  timelineId="test"
+                                >
+                                  <EuiFlexGroup
+                                    gutterSize="none"
+                                    justifyContent="center"
+                                    wrap={true}
+                                  >
+                                    <div
+                                      className="euiFlexGroup euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive euiFlexGroup--wrap"
+                                    >
+                                      <DraggableZeekElement
+                                        field="zeek.session_id"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                        value="Cu0n232QMyvNtzb75j"
+                                      >
+                                        <TokensFlexItem
+                                          grow={false}
+                                        >
+                                          <EuiFlexItem
+                                            className="c1"
+                                            grow={false}
+                                          >
+                                            <div
+                                              className="euiFlexItem euiFlexItem--flexGrowZero c1"
+                                            >
+                                              <DraggableWrapper
+                                                dataProvider={
+                                                  Object {
+                                                    "and": Array [],
+                                                    "enabled": true,
+                                                    "excluded": false,
+                                                    "id": "draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j",
+                                                    "kqlQuery": "",
+                                                    "name": "Cu0n232QMyvNtzb75j",
+                                                    "queryMatch": Object {
+                                                      "field": "zeek.session_id",
+                                                      "operator": ":",
+                                                      "value": "Cu0n232QMyvNtzb75j",
+                                                    },
+                                                  }
+                                                }
+                                                render={[Function]}
+                                              >
+                                                <Component
+                                                  dataProvider={
+                                                    Object {
+                                                      "and": Array [],
+                                                      "enabled": true,
+                                                      "excluded": false,
+                                                      "id": "draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j",
+                                                      "kqlQuery": "",
+                                                      "name": "Cu0n232QMyvNtzb75j",
+                                                      "queryMatch": Object {
+                                                        "field": "zeek.session_id",
+                                                        "operator": ":",
+                                                        "value": "Cu0n232QMyvNtzb75j",
+                                                      },
+                                                    }
+                                                  }
+                                                  registerProvider={[Function]}
+                                                  render={[Function]}
+                                                  unRegisterProvider={[Function]}
+                                                >
+                                                  <Wrapper
+                                                    data-test-subj="draggableWrapperDiv"
+                                                  >
+                                                    <div
+                                                      className="c2"
+                                                      data-test-subj="draggableWrapperDiv"
+                                                    >
+                                                      <ConnectFunction
+                                                        direction="vertical"
+                                                        droppableId="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                        getContainerForClone={[Function]}
+                                                        ignoreContainerClipping={false}
+                                                        isCombineEnabled={false}
+                                                        isDropDisabled={true}
+                                                        mode="standard"
+                                                        renderClone={null}
+                                                        type="DEFAULT"
+                                                      >
+                                                        <Droppable
+                                                          direction="vertical"
+                                                          droppableId="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                          getContainerForClone={[Function]}
+                                                          ignoreContainerClipping={false}
+                                                          isCombineEnabled={false}
+                                                          isDropDisabled={true}
+                                                          mode="standard"
+                                                          placeholder={null}
+                                                          renderClone={null}
+                                                          shouldAnimatePlaceholder={false}
+                                                          snapshot={
+                                                            Object {
+                                                              "draggingFromThisWith": null,
+                                                              "draggingOverWith": null,
+                                                              "isDraggingOver": false,
+                                                              "isUsingPlaceholder": false,
+                                                            }
+                                                          }
+                                                          type="DEFAULT"
+                                                          updateViewportMaxScroll={[Function]}
+                                                          useClone={null}
+                                                        >
+                                                          <div
+                                                            data-rbd-droppable-context-id="6"
+                                                            data-rbd-droppable-id="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                          >
+                                                            <PublicDraggable
+                                                              draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                              index={0}
+                                                              key="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                            >
+                                                              <PrivateDraggable
+                                                                canDragInteractiveElements={false}
+                                                                draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                                index={0}
+                                                                isClone={false}
+                                                                isEnabled={true}
+                                                                shouldRespectForcePress={false}
+                                                              >
+                                                                <Connect(Draggable)
+                                                                  canDragInteractiveElements={false}
+                                                                  draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                                  index={0}
+                                                                  isClone={false}
+                                                                  isEnabled={true}
+                                                                  shouldRespectForcePress={false}
+                                                                >
+                                                                  <Draggable
+                                                                    canDragInteractiveElements={false}
+                                                                    draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                                    dropAnimationFinished={[Function]}
+                                                                    index={0}
+                                                                    isClone={false}
+                                                                    isEnabled={true}
+                                                                    mapped={
+                                                                      Object {
+                                                                        "combineTargetFor": null,
+                                                                        "offset": Object {
+                                                                          "x": 0,
+                                                                          "y": 0,
+                                                                        },
+                                                                        "shouldAnimateDisplacement": true,
+                                                                        "snapshot": Object {
+                                                                          "combineTargetFor": null,
+                                                                          "combineWith": null,
+                                                                          "draggingOver": null,
+                                                                          "dropAnimation": null,
+                                                                          "isClone": false,
+                                                                          "isDragging": false,
+                                                                          "isDropAnimating": false,
+                                                                          "mode": null,
+                                                                        },
+                                                                        "type": "SECONDARY",
+                                                                      }
+                                                                    }
+                                                                    shouldRespectForcePress={false}
+                                                                  >
+                                                                    <ConditionalPortal
+                                                                      usePortal={false}
+                                                                    >
+                                                                      <ProviderContainerComponent
+                                                                        aria-labelledby="rbd-lift-instruction-6"
+                                                                        data-rbd-drag-handle-context-id="6"
+                                                                        data-rbd-drag-handle-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                                        data-rbd-draggable-context-id="6"
+                                                                        data-rbd-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                                        data-test-subj="providerContainer"
+                                                                        draggable={false}
+                                                                        isDragging={false}
+                                                                        onDragStart={[Function]}
+                                                                        onTransitionEnd={null}
+                                                                        style={
+                                                                          Object {
+                                                                            "transform": null,
+                                                                            "transition": null,
+                                                                          }
+                                                                        }
+                                                                        tabIndex={0}
+                                                                      >
+                                                                        <div
+                                                                          aria-labelledby="rbd-lift-instruction-6"
+                                                                          className="c3"
+                                                                          data-rbd-drag-handle-context-id="6"
+                                                                          data-rbd-drag-handle-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                                          data-rbd-draggable-context-id="6"
+                                                                          data-rbd-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_session_id-Cu0n232QMyvNtzb75j"
+                                                                          data-test-subj="providerContainer"
+                                                                          draggable={false}
+                                                                          onDragStart={[Function]}
+                                                                          onTransitionEnd={null}
+                                                                          style={
+                                                                            Object {
+                                                                              "transform": null,
+                                                                              "transition": null,
+                                                                            }
+                                                                          }
+                                                                          tabIndex={0}
+                                                                        >
+                                                                          <styled.span
+                                                                            data-test-subj="draggable-content-zeek.session_id"
+                                                                          >
+                                                                            <span
+                                                                              className="c4"
+                                                                              data-test-subj="draggable-content-zeek.session_id"
+                                                                            >
+                                                                              <EuiToolTip
+                                                                                content="zeek.session_id"
+                                                                                data-test-subj="badge-tooltip"
+                                                                                delay="regular"
+                                                                                position="top"
+                                                                              >
+                                                                                <span
+                                                                                  className="euiToolTipAnchor"
+                                                                                  onMouseOut={[Function]}
+                                                                                  onMouseOver={[Function]}
+                                                                                >
+                                                                                  <Badge
+                                                                                    color="hollow"
+                                                                                    iconType="tag"
+                                                                                    onBlur={[Function]}
+                                                                                    onFocus={[Function]}
+                                                                                  >
+                                                                                    <EuiBadge
+                                                                                      color="hollow"
+                                                                                      iconType="tag"
+                                                                                      onBlur={[Function]}
+                                                                                      onFocus={[Function]}
+                                                                                      style={
+                                                                                        Object {
+                                                                                          "verticalAlign": "top",
+                                                                                        }
+                                                                                      }
+                                                                                    >
+                                                                                      <EuiInnerText>
+                                                                                        <span
+                                                                                          className="euiBadge euiBadge--hollow euiBadge--iconLeft"
+                                                                                          onBlur={[Function]}
+                                                                                          onFocus={[Function]}
+                                                                                          style={
+                                                                                            Object {
+                                                                                              "verticalAlign": "top",
+                                                                                            }
+                                                                                          }
+                                                                                          title="Cu0n232QMyvNtzb75j"
+                                                                                        >
+                                                                                          <span
+                                                                                            className="euiBadge__content"
+                                                                                          >
+                                                                                            <span
+                                                                                              className="euiBadge__text"
+                                                                                            >
+                                                                                              Cu0n232QMyvNtzb75j
+                                                                                            </span>
+                                                                                            <EuiIcon
+                                                                                              className="euiBadge__icon"
+                                                                                              size="s"
+                                                                                              type="tag"
+                                                                                            >
+                                                                                              <EuiIconEmpty
+                                                                                                aria-hidden={true}
+                                                                                                className="euiIcon euiIcon--small euiIcon-isLoading euiBadge__icon"
+                                                                                                focusable="false"
+                                                                                                role="img"
+                                                                                                style={null}
+                                                                                              >
+                                                                                                <svg
+                                                                                                  aria-hidden={true}
+                                                                                                  className="euiIcon euiIcon--small euiIcon-isLoading euiBadge__icon"
+                                                                                                  focusable="false"
+                                                                                                  height={16}
+                                                                                                  role="img"
+                                                                                                  style={null}
+                                                                                                  viewBox="0 0 16 16"
+                                                                                                  width={16}
+                                                                                                  xmlns="http://www.w3.org/2000/svg"
+                                                                                                />
+                                                                                              </EuiIconEmpty>
+                                                                                            </EuiIcon>
+                                                                                          </span>
+                                                                                        </span>
+                                                                                      </EuiInnerText>
+                                                                                    </EuiBadge>
+                                                                                  </Badge>
+                                                                                </span>
+                                                                              </EuiToolTip>
+                                                                            </span>
+                                                                          </styled.span>
+                                                                        </div>
+                                                                      </ProviderContainerComponent>
+                                                                    </ConditionalPortal>
+                                                                  </Draggable>
+                                                                </Connect(Draggable)>
+                                                              </PrivateDraggable>
+                                                            </PublicDraggable>
+                                                            <AnimateInOut
+                                                              on={null}
+                                                              shouldAnimate={false}
+                                                            />
+                                                          </div>
+                                                        </Droppable>
+                                                      </ConnectFunction>
+                                                    </div>
+                                                  </Wrapper>
+                                                </Component>
+                                              </DraggableWrapper>
+                                            </div>
+                                          </EuiFlexItem>
+                                        </TokensFlexItem>
+                                      </DraggableZeekElement>
+                                      <DraggableZeekElement
+                                        field="event.dataset"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                        stringRenderer={[Function]}
+                                        value="zeek.files"
+                                      >
+                                        <TokensFlexItem
+                                          grow={false}
+                                        >
+                                          <EuiFlexItem
+                                            className="c1"
+                                            grow={false}
+                                          >
+                                            <div
+                                              className="euiFlexItem euiFlexItem--flexGrowZero c1"
+                                            >
+                                              <DraggableWrapper
+                                                dataProvider={
+                                                  Object {
+                                                    "and": Array [],
+                                                    "enabled": true,
+                                                    "excluded": false,
+                                                    "id": "draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files",
+                                                    "kqlQuery": "",
+                                                    "name": "zeek.files",
+                                                    "queryMatch": Object {
+                                                      "field": "event.dataset",
+                                                      "operator": ":",
+                                                      "value": "zeek.files",
+                                                    },
+                                                  }
+                                                }
+                                                render={[Function]}
+                                              >
+                                                <Component
+                                                  dataProvider={
+                                                    Object {
+                                                      "and": Array [],
+                                                      "enabled": true,
+                                                      "excluded": false,
+                                                      "id": "draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files",
+                                                      "kqlQuery": "",
+                                                      "name": "zeek.files",
+                                                      "queryMatch": Object {
+                                                        "field": "event.dataset",
+                                                        "operator": ":",
+                                                        "value": "zeek.files",
+                                                      },
+                                                    }
+                                                  }
+                                                  registerProvider={[Function]}
+                                                  render={[Function]}
+                                                  unRegisterProvider={[Function]}
+                                                >
+                                                  <Wrapper
+                                                    data-test-subj="draggableWrapperDiv"
+                                                  >
+                                                    <div
+                                                      className="c2"
+                                                      data-test-subj="draggableWrapperDiv"
+                                                    >
+                                                      <ConnectFunction
+                                                        direction="vertical"
+                                                        droppableId="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                        getContainerForClone={[Function]}
+                                                        ignoreContainerClipping={false}
+                                                        isCombineEnabled={false}
+                                                        isDropDisabled={true}
+                                                        mode="standard"
+                                                        renderClone={null}
+                                                        type="DEFAULT"
+                                                      >
+                                                        <Droppable
+                                                          direction="vertical"
+                                                          droppableId="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                          getContainerForClone={[Function]}
+                                                          ignoreContainerClipping={false}
+                                                          isCombineEnabled={false}
+                                                          isDropDisabled={true}
+                                                          mode="standard"
+                                                          placeholder={null}
+                                                          renderClone={null}
+                                                          shouldAnimatePlaceholder={false}
+                                                          snapshot={
+                                                            Object {
+                                                              "draggingFromThisWith": null,
+                                                              "draggingOverWith": null,
+                                                              "isDraggingOver": false,
+                                                              "isUsingPlaceholder": false,
+                                                            }
+                                                          }
+                                                          type="DEFAULT"
+                                                          updateViewportMaxScroll={[Function]}
+                                                          useClone={null}
+                                                        >
+                                                          <div
+                                                            data-rbd-droppable-context-id="6"
+                                                            data-rbd-droppable-id="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                          >
+                                                            <PublicDraggable
+                                                              draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                              index={0}
+                                                              key="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                            >
+                                                              <PrivateDraggable
+                                                                canDragInteractiveElements={false}
+                                                                draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                                index={0}
+                                                                isClone={false}
+                                                                isEnabled={true}
+                                                                shouldRespectForcePress={false}
+                                                              >
+                                                                <Connect(Draggable)
+                                                                  canDragInteractiveElements={false}
+                                                                  draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                                  index={0}
+                                                                  isClone={false}
+                                                                  isEnabled={true}
+                                                                  shouldRespectForcePress={false}
+                                                                >
+                                                                  <Draggable
+                                                                    canDragInteractiveElements={false}
+                                                                    draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                                    dropAnimationFinished={[Function]}
+                                                                    index={0}
+                                                                    isClone={false}
+                                                                    isEnabled={true}
+                                                                    mapped={
+                                                                      Object {
+                                                                        "combineTargetFor": null,
+                                                                        "offset": Object {
+                                                                          "x": 0,
+                                                                          "y": 0,
+                                                                        },
+                                                                        "shouldAnimateDisplacement": true,
+                                                                        "snapshot": Object {
+                                                                          "combineTargetFor": null,
+                                                                          "combineWith": null,
+                                                                          "draggingOver": null,
+                                                                          "dropAnimation": null,
+                                                                          "isClone": false,
+                                                                          "isDragging": false,
+                                                                          "isDropAnimating": false,
+                                                                          "mode": null,
+                                                                        },
+                                                                        "type": "SECONDARY",
+                                                                      }
+                                                                    }
+                                                                    shouldRespectForcePress={false}
+                                                                  >
+                                                                    <ConditionalPortal
+                                                                      usePortal={false}
+                                                                    >
+                                                                      <ProviderContainerComponent
+                                                                        aria-labelledby="rbd-lift-instruction-6"
+                                                                        data-rbd-drag-handle-context-id="6"
+                                                                        data-rbd-drag-handle-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                                        data-rbd-draggable-context-id="6"
+                                                                        data-rbd-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                                        data-test-subj="providerContainer"
+                                                                        draggable={false}
+                                                                        isDragging={false}
+                                                                        onDragStart={[Function]}
+                                                                        onTransitionEnd={null}
+                                                                        style={
+                                                                          Object {
+                                                                            "transform": null,
+                                                                            "transition": null,
+                                                                          }
+                                                                        }
+                                                                        tabIndex={0}
+                                                                      >
+                                                                        <div
+                                                                          aria-labelledby="rbd-lift-instruction-6"
+                                                                          className="c3"
+                                                                          data-rbd-drag-handle-context-id="6"
+                                                                          data-rbd-drag-handle-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                                          data-rbd-draggable-context-id="6"
+                                                                          data-rbd-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-event_dataset-zeek_files"
+                                                                          data-test-subj="providerContainer"
+                                                                          draggable={false}
+                                                                          onDragStart={[Function]}
+                                                                          onTransitionEnd={null}
+                                                                          style={
+                                                                            Object {
+                                                                              "transform": null,
+                                                                              "transition": null,
+                                                                            }
+                                                                          }
+                                                                          tabIndex={0}
+                                                                        >
+                                                                          <styled.span
+                                                                            data-test-subj="draggable-content-event.dataset"
+                                                                          >
+                                                                            <span
+                                                                              className="c4"
+                                                                              data-test-subj="draggable-content-event.dataset"
+                                                                            >
+                                                                              <EuiToolTip
+                                                                                content="event.dataset"
+                                                                                data-test-subj="badge-tooltip"
+                                                                                delay="regular"
+                                                                                position="top"
+                                                                              >
+                                                                                <span
+                                                                                  className="euiToolTipAnchor"
+                                                                                  onMouseOut={[Function]}
+                                                                                  onMouseOver={[Function]}
+                                                                                >
+                                                                                  <Badge
+                                                                                    color="hollow"
+                                                                                    iconType="tag"
+                                                                                    onBlur={[Function]}
+                                                                                    onFocus={[Function]}
+                                                                                  >
+                                                                                    <EuiBadge
+                                                                                      color="hollow"
+                                                                                      iconType="tag"
+                                                                                      onBlur={[Function]}
+                                                                                      onFocus={[Function]}
+                                                                                      style={
+                                                                                        Object {
+                                                                                          "verticalAlign": "top",
+                                                                                        }
+                                                                                      }
+                                                                                    >
+                                                                                      <EuiInnerText>
+                                                                                        <span
+                                                                                          className="euiBadge euiBadge--hollow euiBadge--iconLeft"
+                                                                                          onBlur={[Function]}
+                                                                                          onFocus={[Function]}
+                                                                                          style={
+                                                                                            Object {
+                                                                                              "verticalAlign": "top",
+                                                                                            }
+                                                                                          }
+                                                                                          title="files"
+                                                                                        >
+                                                                                          <span
+                                                                                            className="euiBadge__content"
+                                                                                          >
+                                                                                            <span
+                                                                                              className="euiBadge__text"
+                                                                                            >
+                                                                                              files
+                                                                                            </span>
+                                                                                            <EuiIcon
+                                                                                              className="euiBadge__icon"
+                                                                                              size="s"
+                                                                                              type="tag"
+                                                                                            >
+                                                                                              <EuiIconEmpty
+                                                                                                aria-hidden={true}
+                                                                                                className="euiIcon euiIcon--small euiIcon-isLoading euiBadge__icon"
+                                                                                                focusable="false"
+                                                                                                role="img"
+                                                                                                style={null}
+                                                                                              >
+                                                                                                <svg
+                                                                                                  aria-hidden={true}
+                                                                                                  className="euiIcon euiIcon--small euiIcon-isLoading euiBadge__icon"
+                                                                                                  focusable="false"
+                                                                                                  height={16}
+                                                                                                  role="img"
+                                                                                                  style={null}
+                                                                                                  viewBox="0 0 16 16"
+                                                                                                  width={16}
+                                                                                                  xmlns="http://www.w3.org/2000/svg"
+                                                                                                />
+                                                                                              </EuiIconEmpty>
+                                                                                            </EuiIcon>
+                                                                                          </span>
+                                                                                        </span>
+                                                                                      </EuiInnerText>
+                                                                                    </EuiBadge>
+                                                                                  </Badge>
+                                                                                </span>
+                                                                              </EuiToolTip>
+                                                                            </span>
+                                                                          </styled.span>
+                                                                        </div>
+                                                                      </ProviderContainerComponent>
+                                                                    </ConditionalPortal>
+                                                                  </Draggable>
+                                                                </Connect(Draggable)>
+                                                              </PrivateDraggable>
+                                                            </PublicDraggable>
+                                                            <AnimateInOut
+                                                              on={null}
+                                                              shouldAnimate={false}
+                                                            />
+                                                          </div>
+                                                        </Droppable>
+                                                      </ConnectFunction>
+                                                    </div>
+                                                  </Wrapper>
+                                                </Component>
+                                              </DraggableWrapper>
+                                            </div>
+                                          </EuiFlexItem>
+                                        </TokensFlexItem>
+                                      </DraggableZeekElement>
+                                      <DraggableZeekElement
+                                        field="zeek.files.sha1"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                        stringRenderer={[Function]}
+                                        value="fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                      >
+                                        <TokensFlexItem
+                                          grow={false}
+                                        >
+                                          <EuiFlexItem
+                                            className="c1"
+                                            grow={false}
+                                          >
+                                            <div
+                                              className="euiFlexItem euiFlexItem--flexGrowZero c1"
+                                            >
+                                              <DraggableWrapper
+                                                dataProvider={
+                                                  Object {
+                                                    "and": Array [],
+                                                    "enabled": true,
+                                                    "excluded": false,
+                                                    "id": "draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                                    "kqlQuery": "",
+                                                    "name": "fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                                    "queryMatch": Object {
+                                                      "field": "zeek.files.sha1",
+                                                      "operator": ":",
+                                                      "value": "fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                                    },
+                                                  }
+                                                }
+                                                render={[Function]}
+                                              >
+                                                <Component
+                                                  dataProvider={
+                                                    Object {
+                                                      "and": Array [],
+                                                      "enabled": true,
+                                                      "excluded": false,
+                                                      "id": "draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                                      "kqlQuery": "",
+                                                      "name": "fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                                      "queryMatch": Object {
+                                                        "field": "zeek.files.sha1",
+                                                        "operator": ":",
+                                                        "value": "fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                                      },
+                                                    }
+                                                  }
+                                                  registerProvider={[Function]}
+                                                  render={[Function]}
+                                                  unRegisterProvider={[Function]}
+                                                >
+                                                  <Wrapper
+                                                    data-test-subj="draggableWrapperDiv"
+                                                  >
+                                                    <div
+                                                      className="c2"
+                                                      data-test-subj="draggableWrapperDiv"
+                                                    >
+                                                      <ConnectFunction
+                                                        direction="vertical"
+                                                        droppableId="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                        getContainerForClone={[Function]}
+                                                        ignoreContainerClipping={false}
+                                                        isCombineEnabled={false}
+                                                        isDropDisabled={true}
+                                                        mode="standard"
+                                                        renderClone={null}
+                                                        type="DEFAULT"
+                                                      >
+                                                        <Droppable
+                                                          direction="vertical"
+                                                          droppableId="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                          getContainerForClone={[Function]}
+                                                          ignoreContainerClipping={false}
+                                                          isCombineEnabled={false}
+                                                          isDropDisabled={true}
+                                                          mode="standard"
+                                                          placeholder={null}
+                                                          renderClone={null}
+                                                          shouldAnimatePlaceholder={false}
+                                                          snapshot={
+                                                            Object {
+                                                              "draggingFromThisWith": null,
+                                                              "draggingOverWith": null,
+                                                              "isDraggingOver": false,
+                                                              "isUsingPlaceholder": false,
+                                                            }
+                                                          }
+                                                          type="DEFAULT"
+                                                          updateViewportMaxScroll={[Function]}
+                                                          useClone={null}
+                                                        >
+                                                          <div
+                                                            data-rbd-droppable-context-id="6"
+                                                            data-rbd-droppable-id="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                          >
+                                                            <PublicDraggable
+                                                              draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                              index={0}
+                                                              key="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                            >
+                                                              <PrivateDraggable
+                                                                canDragInteractiveElements={false}
+                                                                draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                                index={0}
+                                                                isClone={false}
+                                                                isEnabled={true}
+                                                                shouldRespectForcePress={false}
+                                                              >
+                                                                <Connect(Draggable)
+                                                                  canDragInteractiveElements={false}
+                                                                  draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                                  index={0}
+                                                                  isClone={false}
+                                                                  isEnabled={true}
+                                                                  shouldRespectForcePress={false}
+                                                                >
+                                                                  <Draggable
+                                                                    canDragInteractiveElements={false}
+                                                                    draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                                    dropAnimationFinished={[Function]}
+                                                                    index={0}
+                                                                    isClone={false}
+                                                                    isEnabled={true}
+                                                                    mapped={
+                                                                      Object {
+                                                                        "combineTargetFor": null,
+                                                                        "offset": Object {
+                                                                          "x": 0,
+                                                                          "y": 0,
+                                                                        },
+                                                                        "shouldAnimateDisplacement": true,
+                                                                        "snapshot": Object {
+                                                                          "combineTargetFor": null,
+                                                                          "combineWith": null,
+                                                                          "draggingOver": null,
+                                                                          "dropAnimation": null,
+                                                                          "isClone": false,
+                                                                          "isDragging": false,
+                                                                          "isDropAnimating": false,
+                                                                          "mode": null,
+                                                                        },
+                                                                        "type": "SECONDARY",
+                                                                      }
+                                                                    }
+                                                                    shouldRespectForcePress={false}
+                                                                  >
+                                                                    <ConditionalPortal
+                                                                      usePortal={false}
+                                                                    >
+                                                                      <ProviderContainerComponent
+                                                                        aria-labelledby="rbd-lift-instruction-6"
+                                                                        data-rbd-drag-handle-context-id="6"
+                                                                        data-rbd-drag-handle-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                                        data-rbd-draggable-context-id="6"
+                                                                        data-rbd-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                                        data-test-subj="providerContainer"
+                                                                        draggable={false}
+                                                                        isDragging={false}
+                                                                        onDragStart={[Function]}
+                                                                        onTransitionEnd={null}
+                                                                        style={
+                                                                          Object {
+                                                                            "transform": null,
+                                                                            "transition": null,
+                                                                          }
+                                                                        }
+                                                                        tabIndex={0}
+                                                                      >
+                                                                        <div
+                                                                          aria-labelledby="rbd-lift-instruction-6"
+                                                                          className="c3"
+                                                                          data-rbd-drag-handle-context-id="6"
+                                                                          data-rbd-drag-handle-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                                          data-rbd-draggable-context-id="6"
+                                                                          data-rbd-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_sha1-fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                                          data-test-subj="providerContainer"
+                                                                          draggable={false}
+                                                                          onDragStart={[Function]}
+                                                                          onTransitionEnd={null}
+                                                                          style={
+                                                                            Object {
+                                                                              "transform": null,
+                                                                              "transition": null,
+                                                                            }
+                                                                          }
+                                                                          tabIndex={0}
+                                                                        >
+                                                                          <styled.span
+                                                                            data-test-subj="draggable-content-zeek.files.sha1"
+                                                                          >
+                                                                            <span
+                                                                              className="c4"
+                                                                              data-test-subj="draggable-content-zeek.files.sha1"
+                                                                            >
+                                                                              <EuiToolTip
+                                                                                content="zeek.files.sha1"
+                                                                                data-test-subj="badge-tooltip"
+                                                                                delay="regular"
+                                                                                position="top"
+                                                                              >
+                                                                                <span
+                                                                                  className="euiToolTipAnchor"
+                                                                                  onMouseOut={[Function]}
+                                                                                  onMouseOver={[Function]}
+                                                                                >
+                                                                                  <Badge
+                                                                                    color="hollow"
+                                                                                    iconType="tag"
+                                                                                    onBlur={[Function]}
+                                                                                    onFocus={[Function]}
+                                                                                  >
+                                                                                    <EuiBadge
+                                                                                      color="hollow"
+                                                                                      iconType="tag"
+                                                                                      onBlur={[Function]}
+                                                                                      onFocus={[Function]}
+                                                                                      style={
+                                                                                        Object {
+                                                                                          "verticalAlign": "top",
+                                                                                        }
+                                                                                      }
+                                                                                    >
+                                                                                      <EuiInnerText>
+                                                                                        <span
+                                                                                          className="euiBadge euiBadge--hollow euiBadge--iconLeft"
+                                                                                          onBlur={[Function]}
+                                                                                          onFocus={[Function]}
+                                                                                          style={
+                                                                                            Object {
+                                                                                              "verticalAlign": "top",
+                                                                                            }
+                                                                                          }
+                                                                                          title="sha1: fa5195a..."
+                                                                                        >
+                                                                                          <span
+                                                                                            className="euiBadge__content"
+                                                                                          >
+                                                                                            <span
+                                                                                              className="euiBadge__text"
+                                                                                            >
+                                                                                              sha1: fa5195a...
+                                                                                            </span>
+                                                                                            <EuiIcon
+                                                                                              className="euiBadge__icon"
+                                                                                              size="s"
+                                                                                              type="tag"
+                                                                                            >
+                                                                                              <EuiIconEmpty
+                                                                                                aria-hidden={true}
+                                                                                                className="euiIcon euiIcon--small euiIcon-isLoading euiBadge__icon"
+                                                                                                focusable="false"
+                                                                                                role="img"
+                                                                                                style={null}
+                                                                                              >
+                                                                                                <svg
+                                                                                                  aria-hidden={true}
+                                                                                                  className="euiIcon euiIcon--small euiIcon-isLoading euiBadge__icon"
+                                                                                                  focusable="false"
+                                                                                                  height={16}
+                                                                                                  role="img"
+                                                                                                  style={null}
+                                                                                                  viewBox="0 0 16 16"
+                                                                                                  width={16}
+                                                                                                  xmlns="http://www.w3.org/2000/svg"
+                                                                                                />
+                                                                                              </EuiIconEmpty>
+                                                                                            </EuiIcon>
+                                                                                          </span>
+                                                                                        </span>
+                                                                                      </EuiInnerText>
+                                                                                    </EuiBadge>
+                                                                                  </Badge>
+                                                                                </span>
+                                                                              </EuiToolTip>
+                                                                            </span>
+                                                                          </styled.span>
+                                                                        </div>
+                                                                      </ProviderContainerComponent>
+                                                                    </ConditionalPortal>
+                                                                  </Draggable>
+                                                                </Connect(Draggable)>
+                                                              </PrivateDraggable>
+                                                            </PublicDraggable>
+                                                            <AnimateInOut
+                                                              on={null}
+                                                              shouldAnimate={false}
+                                                            />
+                                                          </div>
+                                                        </Droppable>
+                                                      </ConnectFunction>
+                                                    </div>
+                                                  </Wrapper>
+                                                </Component>
+                                              </DraggableWrapper>
+                                            </div>
+                                          </EuiFlexItem>
+                                        </TokensFlexItem>
+                                      </DraggableZeekElement>
+                                      <DraggableZeekElement
+                                        field="zeek.files.md5"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                        stringRenderer={[Function]}
+                                        value="f7653f1951693021daa9e6be61226e32"
+                                      >
+                                        <TokensFlexItem
+                                          grow={false}
+                                        >
+                                          <EuiFlexItem
+                                            className="c1"
+                                            grow={false}
+                                          >
+                                            <div
+                                              className="euiFlexItem euiFlexItem--flexGrowZero c1"
+                                            >
+                                              <DraggableWrapper
+                                                dataProvider={
+                                                  Object {
+                                                    "and": Array [],
+                                                    "enabled": true,
+                                                    "excluded": false,
+                                                    "id": "draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32",
+                                                    "kqlQuery": "",
+                                                    "name": "f7653f1951693021daa9e6be61226e32",
+                                                    "queryMatch": Object {
+                                                      "field": "zeek.files.md5",
+                                                      "operator": ":",
+                                                      "value": "f7653f1951693021daa9e6be61226e32",
+                                                    },
+                                                  }
+                                                }
+                                                render={[Function]}
+                                              >
+                                                <Component
+                                                  dataProvider={
+                                                    Object {
+                                                      "and": Array [],
+                                                      "enabled": true,
+                                                      "excluded": false,
+                                                      "id": "draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32",
+                                                      "kqlQuery": "",
+                                                      "name": "f7653f1951693021daa9e6be61226e32",
+                                                      "queryMatch": Object {
+                                                        "field": "zeek.files.md5",
+                                                        "operator": ":",
+                                                        "value": "f7653f1951693021daa9e6be61226e32",
+                                                      },
+                                                    }
+                                                  }
+                                                  registerProvider={[Function]}
+                                                  render={[Function]}
+                                                  unRegisterProvider={[Function]}
+                                                >
+                                                  <Wrapper
+                                                    data-test-subj="draggableWrapperDiv"
+                                                  >
+                                                    <div
+                                                      className="c2"
+                                                      data-test-subj="draggableWrapperDiv"
+                                                    >
+                                                      <ConnectFunction
+                                                        direction="vertical"
+                                                        droppableId="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                        getContainerForClone={[Function]}
+                                                        ignoreContainerClipping={false}
+                                                        isCombineEnabled={false}
+                                                        isDropDisabled={true}
+                                                        mode="standard"
+                                                        renderClone={null}
+                                                        type="DEFAULT"
+                                                      >
+                                                        <Droppable
+                                                          direction="vertical"
+                                                          droppableId="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                          getContainerForClone={[Function]}
+                                                          ignoreContainerClipping={false}
+                                                          isCombineEnabled={false}
+                                                          isDropDisabled={true}
+                                                          mode="standard"
+                                                          placeholder={null}
+                                                          renderClone={null}
+                                                          shouldAnimatePlaceholder={false}
+                                                          snapshot={
+                                                            Object {
+                                                              "draggingFromThisWith": null,
+                                                              "draggingOverWith": null,
+                                                              "isDraggingOver": false,
+                                                              "isUsingPlaceholder": false,
+                                                            }
+                                                          }
+                                                          type="DEFAULT"
+                                                          updateViewportMaxScroll={[Function]}
+                                                          useClone={null}
+                                                        >
+                                                          <div
+                                                            data-rbd-droppable-context-id="6"
+                                                            data-rbd-droppable-id="droppableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                          >
+                                                            <PublicDraggable
+                                                              draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                              index={0}
+                                                              key="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                            >
+                                                              <PrivateDraggable
+                                                                canDragInteractiveElements={false}
+                                                                draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                                index={0}
+                                                                isClone={false}
+                                                                isEnabled={true}
+                                                                shouldRespectForcePress={false}
+                                                              >
+                                                                <Connect(Draggable)
+                                                                  canDragInteractiveElements={false}
+                                                                  draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                                  index={0}
+                                                                  isClone={false}
+                                                                  isEnabled={true}
+                                                                  shouldRespectForcePress={false}
+                                                                >
+                                                                  <Draggable
+                                                                    canDragInteractiveElements={false}
+                                                                    draggableId="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                                    dropAnimationFinished={[Function]}
+                                                                    index={0}
+                                                                    isClone={false}
+                                                                    isEnabled={true}
+                                                                    mapped={
+                                                                      Object {
+                                                                        "combineTargetFor": null,
+                                                                        "offset": Object {
+                                                                          "x": 0,
+                                                                          "y": 0,
+                                                                        },
+                                                                        "shouldAnimateDisplacement": true,
+                                                                        "snapshot": Object {
+                                                                          "combineTargetFor": null,
+                                                                          "combineWith": null,
+                                                                          "draggingOver": null,
+                                                                          "dropAnimation": null,
+                                                                          "isClone": false,
+                                                                          "isDragging": false,
+                                                                          "isDropAnimating": false,
+                                                                          "mode": null,
+                                                                        },
+                                                                        "type": "SECONDARY",
+                                                                      }
+                                                                    }
+                                                                    shouldRespectForcePress={false}
+                                                                  >
+                                                                    <ConditionalPortal
+                                                                      usePortal={false}
+                                                                    >
+                                                                      <ProviderContainerComponent
+                                                                        aria-labelledby="rbd-lift-instruction-6"
+                                                                        data-rbd-drag-handle-context-id="6"
+                                                                        data-rbd-drag-handle-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                                        data-rbd-draggable-context-id="6"
+                                                                        data-rbd-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                                        data-test-subj="providerContainer"
+                                                                        draggable={false}
+                                                                        isDragging={false}
+                                                                        onDragStart={[Function]}
+                                                                        onTransitionEnd={null}
+                                                                        style={
+                                                                          Object {
+                                                                            "transform": null,
+                                                                            "transition": null,
+                                                                          }
+                                                                        }
+                                                                        tabIndex={0}
+                                                                      >
+                                                                        <div
+                                                                          aria-labelledby="rbd-lift-instruction-6"
+                                                                          className="c3"
+                                                                          data-rbd-drag-handle-context-id="6"
+                                                                          data-rbd-drag-handle-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                                          data-rbd-draggable-context-id="6"
+                                                                          data-rbd-draggable-id="draggableId.content.draggable-zeek-element-draggable-wrapper-zeek-signature-draggable-zeek-element-test-19-zeek_files_md5-f7653f1951693021daa9e6be61226e32"
+                                                                          data-test-subj="providerContainer"
+                                                                          draggable={false}
+                                                                          onDragStart={[Function]}
+                                                                          onTransitionEnd={null}
+                                                                          style={
+                                                                            Object {
+                                                                              "transform": null,
+                                                                              "transition": null,
+                                                                            }
+                                                                          }
+                                                                          tabIndex={0}
+                                                                        >
+                                                                          <styled.span
+                                                                            data-test-subj="draggable-content-zeek.files.md5"
+                                                                          >
+                                                                            <span
+                                                                              className="c4"
+                                                                              data-test-subj="draggable-content-zeek.files.md5"
+                                                                            >
+                                                                              <EuiToolTip
+                                                                                content="zeek.files.md5"
+                                                                                data-test-subj="badge-tooltip"
+                                                                                delay="regular"
+                                                                                position="top"
+                                                                              >
+                                                                                <span
+                                                                                  className="euiToolTipAnchor"
+                                                                                  onMouseOut={[Function]}
+                                                                                  onMouseOver={[Function]}
+                                                                                >
+                                                                                  <Badge
+                                                                                    color="hollow"
+                                                                                    iconType="tag"
+                                                                                    onBlur={[Function]}
+                                                                                    onFocus={[Function]}
+                                                                                  >
+                                                                                    <EuiBadge
+                                                                                      color="hollow"
+                                                                                      iconType="tag"
+                                                                                      onBlur={[Function]}
+                                                                                      onFocus={[Function]}
+                                                                                      style={
+                                                                                        Object {
+                                                                                          "verticalAlign": "top",
+                                                                                        }
+                                                                                      }
+                                                                                    >
+                                                                                      <EuiInnerText>
+                                                                                        <span
+                                                                                          className="euiBadge euiBadge--hollow euiBadge--iconLeft"
+                                                                                          onBlur={[Function]}
+                                                                                          onFocus={[Function]}
+                                                                                          style={
+                                                                                            Object {
+                                                                                              "verticalAlign": "top",
+                                                                                            }
+                                                                                          }
+                                                                                          title="md5: f7653f1..."
+                                                                                        >
+                                                                                          <span
+                                                                                            className="euiBadge__content"
+                                                                                          >
+                                                                                            <span
+                                                                                              className="euiBadge__text"
+                                                                                            >
+                                                                                              md5: f7653f1...
+                                                                                            </span>
+                                                                                            <EuiIcon
+                                                                                              className="euiBadge__icon"
+                                                                                              size="s"
+                                                                                              type="tag"
+                                                                                            >
+                                                                                              <EuiIconEmpty
+                                                                                                aria-hidden={true}
+                                                                                                className="euiIcon euiIcon--small euiIcon-isLoading euiBadge__icon"
+                                                                                                focusable="false"
+                                                                                                role="img"
+                                                                                                style={null}
+                                                                                              >
+                                                                                                <svg
+                                                                                                  aria-hidden={true}
+                                                                                                  className="euiIcon euiIcon--small euiIcon-isLoading euiBadge__icon"
+                                                                                                  focusable="false"
+                                                                                                  height={16}
+                                                                                                  role="img"
+                                                                                                  style={null}
+                                                                                                  viewBox="0 0 16 16"
+                                                                                                  width={16}
+                                                                                                  xmlns="http://www.w3.org/2000/svg"
+                                                                                                />
+                                                                                              </EuiIconEmpty>
+                                                                                            </EuiIcon>
+                                                                                          </span>
+                                                                                        </span>
+                                                                                      </EuiInnerText>
+                                                                                    </EuiBadge>
+                                                                                  </Badge>
+                                                                                </span>
+                                                                              </EuiToolTip>
+                                                                            </span>
+                                                                          </styled.span>
+                                                                        </div>
+                                                                      </ProviderContainerComponent>
+                                                                    </ConditionalPortal>
+                                                                  </Draggable>
+                                                                </Connect(Draggable)>
+                                                              </PrivateDraggable>
+                                                            </PublicDraggable>
+                                                            <AnimateInOut
+                                                              on={null}
+                                                              shouldAnimate={false}
+                                                            />
+                                                          </div>
+                                                        </Droppable>
+                                                      </ConnectFunction>
+                                                    </div>
+                                                  </Wrapper>
+                                                </Component>
+                                              </DraggableWrapper>
+                                            </div>
+                                          </EuiFlexItem>
+                                        </TokensFlexItem>
+                                      </DraggableZeekElement>
+                                      <DraggableZeekElement
+                                        field="zeek.notice.dropped"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                        stringRenderer={[Function]}
+                                        value={null}
+                                      />
+                                      <DraggableZeekElement
+                                        field="zeek.ssl.version"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                      <DraggableZeekElement
+                                        field="zeek.ssl.cipher"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                      <DraggableZeekElement
+                                        field="zeek.connection.state"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                      <DraggableZeekElement
+                                        field="http.request.method"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                      <DraggableZeekElement
+                                        field="zeek.connection.history"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                      <DraggableZeekElement
+                                        field="zeek.notice.note"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                      <DraggableZeekElement
+                                        field="zeek.dns.query"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                      <DraggableZeekElement
+                                        field="zeek.dns.qclass_name"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                      <DraggableZeekElement
+                                        field="http.response.status_code"
+                                        id="zeek-signature-draggable-zeek-element-test-19"
+                                      />
+                                    </div>
+                                  </EuiFlexGroup>
+                                  <EuiFlexGroup
+                                    gutterSize="none"
+                                    justifyContent="center"
+                                  >
+                                    <div
+                                      className="euiFlexGroup euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
+                                    >
+                                      <Link
+                                        link={null}
+                                        value={null}
+                                      />
+                                      <Link />
+                                      <Link />
+                                      <Link />
+                                      <Link />
+                                      <TotalVirusLinkSha
+                                        value="fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                      >
+                                        <LinkFlexItem
+                                          grow={false}
+                                        >
+                                          <EuiFlexItem
+                                            className="c5"
+                                            grow={false}
+                                          >
+                                            <div
+                                              className="euiFlexItem euiFlexItem--flexGrowZero c5"
+                                            >
+                                              <div>
+                                                <Memo(ReputationLinkComponent)
+                                                  data-test-subj="reputationLinkSha"
+                                                  domain="fa5195a5dfacc9d1c68d43600f0e0262cad14dde"
+                                                  overflowIndexStart={1}
+                                                  showDomain={true}
+                                                />
+                                              </div>
+                                            </div>
+                                          </EuiFlexItem>
+                                        </LinkFlexItem>
+                                      </TotalVirusLinkSha>
+                                    </div>
+                                  </EuiFlexGroup>
+                                </ZeekSignature>
+                                <EuiSpacer
+                                  size="s"
+                                >
+                                  <div
+                                    className="euiSpacer euiSpacer--s"
+                                  />
+                                </EuiSpacer>
+                                <NetflowRenderer
+                                  data={
+                                    Object {
+                                      "_id": "19",
+                                      "destination": null,
+                                      "event": Object {
+                                        "action": null,
+                                        "category": null,
+                                        "dataset": Array [
+                                          "zeek.files",
+                                        ],
+                                        "id": null,
+                                        "module": Array [
+                                          "zeek",
+                                        ],
+                                        "severity": null,
+                                      },
+                                      "geo": null,
+                                      "host": Object {
+                                        "id": Array [
+                                          "af3fddf15f1d47979ce817ba0df10c6e",
+                                        ],
+                                        "ip": Array [
+                                          "206.189.35.240",
+                                          "10.15.0.5",
+                                          "fe80::98c7:eff:fe29:4455",
+                                        ],
+                                        "name": Array [
+                                          "suricata-zeek-singapore",
+                                        ],
+                                      },
+                                      "http": null,
+                                      "network": null,
+                                      "source": null,
+                                      "suricata": null,
+                                      "timestamp": "2019-03-03T04:26:38.000Z",
+                                      "url": null,
+                                      "zeek": Object {
+                                        "connection": null,
+                                        "dns": null,
+                                        "files": Object {
+                                          "analyzers": Array [
+                                            "MD5",
+                                            "SHA1",
+                                          ],
+                                          "depth": Array [
+                                            0,
+                                          ],
+                                          "duration": Array [
+                                            0,
+                                          ],
+                                          "fuid": Array [
+                                            "FePz1uVEVCZ3I0FQi",
+                                          ],
+                                          "is_orig": Array [
+                                            false,
+                                          ],
+                                          "local_orig": Array [
+                                            false,
+                                          ],
+                                          "md5": Array [
+                                            "f7653f1951693021daa9e6be61226e32",
+                                          ],
+                                          "mime_type": Array [
+                                            "text/plain",
+                                          ],
+                                          "missing_bytes": Array [
+                                            0,
+                                          ],
+                                          "overflow_bytes": Array [
+                                            0,
+                                          ],
+                                          "rx_host": Array [
+                                            "206.189.35.240",
+                                          ],
+                                          "seen_bytes": Array [
+                                            1198,
+                                          ],
+                                          "session_ids": Array [
+                                            "Cu0n232QMyvNtzb75j",
+                                          ],
+                                          "sha1": Array [
+                                            "fa5195a5dfacc9d1c68d43600f0e0262cad14dde",
+                                          ],
+                                          "source": Array [
+                                            "HTTP",
+                                          ],
+                                          "timedout": Array [
+                                            false,
+                                          ],
+                                          "total_bytes": Array [
+                                            88722,
+                                          ],
+                                          "tx_host": Array [
+                                            "5.101.111.50",
+                                          ],
+                                        },
+                                        "http": null,
+                                        "notice": null,
+                                        "session_id": Array [
+                                          "Cu0n232QMyvNtzb75j",
+                                        ],
+                                        "ssl": null,
+                                      },
+                                    }
+                                  }
+                                  timelineId="test"
+                                >
+                                  <Netflow
+                                    contextId="netflow-renderer-test-19"
+                                    eventId="19"
+                                  >
+                                    <EuiFlexGroup
+                                      alignItems="center"
+                                      data-test-subj="netflow-rows"
+                                      direction="column"
+                                      gutterSize="none"
+                                      justifyContent="center"
+                                      wrap={true}
+                                    >
+                                      <div
+                                        className="euiFlexGroup euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive euiFlexGroup--wrap"
+                                        data-test-subj="netflow-rows"
+                                      >
+                                        <EuiFlexItem
+                                          grow={false}
+                                        >
+                                          <div
+                                            className="euiFlexItem euiFlexItem--flexGrowZero"
+                                          >
+                                            <NetflowColumns
+                                              contextId="netflow-renderer-test-19"
+                                              eventId="19"
+                                            >
+                                              <EuiFlexGroup
+                                                data-test-subj="netflow-columns"
+                                                gutterSize="none"
+                                                justifyContent="center"
+                                                wrap={true}
+                                              >
+                                                <div
+                                                  className="euiFlexGroup euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive euiFlexGroup--wrap"
+                                                  data-test-subj="netflow-columns"
+                                                >
+                                                  <EuiFlexItemMarginRight
+                                                    grow={false}
+                                                  >
+                                                    <EuiFlexItem
+                                                      className="c6"
+                                                      grow={false}
+                                                    >
+                                                      <div
+                                                        className="euiFlexItem euiFlexItem--flexGrowZero c6"
+                                                      >
+                                                        <UserProcess
+                                                          contextId="netflow-renderer-test-19"
+                                                          eventId="19"
+                                                        >
+                                                          <EuiFlexGroup
+                                                            alignItems="flexStart"
+                                                            data-test-subj="user-process"
+                                                            direction="column"
+                                                            gutterSize="none"
+                                                            justifyContent="center"
+                                                          >
+                                                            <div
+                                                              className="euiFlexGroup euiFlexGroup--alignItemsFlexStart euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive"
+                                                              data-test-subj="user-process"
+                                                            />
+                                                          </EuiFlexGroup>
+                                                        </UserProcess>
+                                                      </div>
+                                                    </EuiFlexItem>
+                                                  </EuiFlexItemMarginRight>
+                                                  <EuiFlexItemMarginRight
+                                                    grow={false}
+                                                  >
+                                                    <EuiFlexItem
+                                                      className="c6"
+                                                      grow={false}
+                                                    >
+                                                      <div
+                                                        className="euiFlexItem euiFlexItem--flexGrowZero c6"
+                                                      >
+                                                        <DurationEventStartEnd
+                                                          contextId="netflow-renderer-test-19"
+                                                          eventId="19"
+                                                        >
+                                                          <EuiFlexGroup
+                                                            alignItems="flexStart"
+                                                            data-test-subj="duration-and-start-group"
+                                                            direction="column"
+                                                            gutterSize="none"
+                                                            justifyContent="center"
+                                                          >
+                                                            <div
+                                                              className="euiFlexGroup euiFlexGroup--alignItemsFlexStart euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive"
+                                                              data-test-subj="duration-and-start-group"
+                                                            />
+                                                          </EuiFlexGroup>
+                                                        </DurationEventStartEnd>
+                                                      </div>
+                                                    </EuiFlexItem>
+                                                  </EuiFlexItemMarginRight>
+                                                  <EuiFlexItem
+                                                    grow={false}
+                                                  >
+                                                    <div
+                                                      className="euiFlexItem euiFlexItem--flexGrowZero"
+                                                    >
+                                                      <SourceDestination
+                                                        contextId="netflow-renderer-test-19"
+                                                        eventId="19"
+                                                      >
+                                                        <EuiFlexGroup
+                                                          alignItems="center"
+                                                          direction="column"
+                                                          gutterSize="none"
+                                                          justifyContent="center"
+                                                        >
+                                                          <div
+                                                            className="euiFlexGroup euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive"
+                                                          >
+                                                            <EuiFlexItem
+                                                              grow={false}
+                                                            >
+                                                              <div
+                                                                className="euiFlexItem euiFlexItem--flexGrowZero"
+                                                              >
+                                                                <Network
+                                                                  contextId="netflow-renderer-test-19"
+                                                                  eventId="19"
+                                                                >
+                                                                  <EuiFlexGroup
+                                                                    alignItems="center"
+                                                                    gutterSize="none"
+                                                                    justifyContent="center"
+                                                                  >
+                                                                    <div
+                                                                      className="euiFlexGroup euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
+                                                                    />
+                                                                  </EuiFlexGroup>
+                                                                </Network>
+                                                              </div>
+                                                            </EuiFlexItem>
+                                                            <EuiFlexItemMarginTop
+                                                              grow={false}
+                                                            >
+                                                              <EuiFlexItem
+                                                                className="c7"
+                                                                grow={false}
+                                                              >
+                                                                <div
+                                                                  className="euiFlexItem euiFlexItem--flexGrowZero c7"
+                                                                >
+                                                                  <SourceDestinationWithArrows
+                                                                    contextId="netflow-renderer-test-19"
+                                                                    eventId="19"
+                                                                  >
+                                                                    <EuiFlexGroup
+                                                                      gutterSize="none"
+                                                                      justifyContent="center"
+                                                                    >
+                                                                      <div
+                                                                        className="euiFlexGroup euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow euiFlexGroup--responsive"
+                                                                      >
+                                                                        <EuiFlexItem
+                                                                          grow={false}
+                                                                        >
+                                                                          <div
+                                                                            className="euiFlexItem euiFlexItem--flexGrowZero"
+                                                                          >
+                                                                            <SourceDestinationIp
+                                                                              contextId="netflow-renderer-test-19"
+                                                                              eventId="19"
+                                                                              type="source"
+                                                                            />
+                                                                          </div>
+                                                                        </EuiFlexItem>
+                                                                        <SourceDestinationArrows
+                                                                          contextId="netflow-renderer-test-19"
+                                                                          eventId="19"
+                                                                        >
+                                                                          <SourceDestinationArrowsContainer
+                                                                            alignItems="center"
+                                                                            data-test-subj="source-destination-arrows-container"
+                                                                            direction="column"
+                                                                            gutterSize="none"
+                                                                            justifyContent="center"
+                                                                          >
+                                                                            <EuiFlexGroup
+                                                                              alignItems="center"
+                                                                              className="c8"
+                                                                              data-test-subj="source-destination-arrows-container"
+                                                                              direction="column"
+                                                                              gutterSize="none"
+                                                                              justifyContent="center"
+                                                                            >
+                                                                              <div
+                                                                                className="euiFlexGroup euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive c8"
+                                                                                data-test-subj="source-destination-arrows-container"
+                                                                              />
+                                                                            </EuiFlexGroup>
+                                                                          </SourceDestinationArrowsContainer>
+                                                                        </SourceDestinationArrows>
+                                                                        <EuiFlexItem
+                                                                          grow={false}
+                                                                        >
+                                                                          <div
+                                                                            className="euiFlexItem euiFlexItem--flexGrowZero"
+                                                                          >
+                                                                            <SourceDestinationIp
+                                                                              contextId="netflow-renderer-test-19"
+                                                                              eventId="19"
+                                                                              type="destination"
+                                                                            />
+                                                                          </div>
+                                                                        </EuiFlexItem>
+                                                                      </div>
+                                                                    </EuiFlexGroup>
+                                                                  </SourceDestinationWithArrows>
+                                                                </div>
+                                                              </EuiFlexItem>
+                                                            </EuiFlexItemMarginTop>
+                                                          </div>
+                                                        </EuiFlexGroup>
+                                                      </SourceDestination>
+                                                    </div>
+                                                  </EuiFlexItem>
+                                                </div>
+                                              </EuiFlexGroup>
+                                            </NetflowColumns>
+                                          </div>
+                                        </EuiFlexItem>
+                                        <EuiFlexItem
+                                          grow={false}
+                                        >
+                                          <div
+                                            className="euiFlexItem euiFlexItem--flexGrowZero"
+                                          >
+                                            <Fingerprints
+                                              contextId="netflow-renderer-test-19"
+                                              eventId="19"
+                                            >
+                                              <EuiFlexGroup
+                                                alignItems="center"
+                                                data-test-subj="fingerprints-group"
+                                                direction="column"
+                                                gutterSize="none"
+                                                justifyContent="center"
+                                              >
+                                                <div
+                                                  className="euiFlexGroup euiFlexGroup--alignItemsCenter euiFlexGroup--justifyContentCenter euiFlexGroup--directionColumn euiFlexGroup--responsive"
+                                                  data-test-subj="fingerprints-group"
+                                                />
+                                              </EuiFlexGroup>
+                                            </Fingerprints>
+                                          </div>
+                                        </EuiFlexItem>
+                                      </div>
+                                    </EuiFlexGroup>
+                                  </Netflow>
+                                </NetflowRenderer>
+                              </div>
+                            </Details>
+                          </ZeekDetails>
+                        </Provider>
+                      </App>
+                    </ErrorBoundary>
+                  </DragDropContext>
+                </ThemeProvider>
+              </Provider>
+            </ApolloProvider>
+          </Provider>
+        </Component>
+      </PseudoLocaleWrapper>
+    </IntlProvider>
+  </I18nProvider>
+</Memo(TestProvidersComponent)>
+`;
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_details.test.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_details.test.tsx
index 7617a01acf1d9..db51ade6df4c5 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_details.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_details.test.tsx
@@ -113,9 +113,8 @@ describe('ZeekDetails', () => {
           />
         </TestProviders>
       );
-      expect(wrapper.text()).toEqual(
-        'Cu0n232QMyvNtzb75jfilessha1: fa5195a...md5: f7653f1...fa5195a5dfacc9d1c68d43600f0e0262cad14dde'
-      );
+      expect(wrapper).toMatchSnapshot();
+      expect(wrapper.text()).toEqual('Cu0n232QMyvNtzb75jfilessha1: fa5195a...md5: f7653f1...');
     });
 
     test('it returns null for text if the data contains no zeek data', () => {
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_signature.test.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
index c09bd6b7a356d..f199b537f1be0 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
@@ -79,14 +79,9 @@ describe('ZeekSignature', () => {
       ).toBeFalsy();
     });
 
-    test('should render value', () => {
-      const wrapper = mount(<TotalVirusLinkSha value={'abc'} />);
-      expect(wrapper.text()).toEqual('abc');
-    });
-
-    test('should render link with sha', () => {
-      const wrapper = mount(<TotalVirusLinkSha value={'abcdefg'} />);
-      expect(wrapper.find('a').prop('href')).toEqual('https://www.virustotal.com/#/search/abcdefg');
+    test('should render', () => {
+      const wrapper = shallow(<TotalVirusLinkSha value={'abc'} />);
+      expect(wrapper.find('[data-test-subj="reputationLinkSha"]').exists()).toBeTruthy();
     });
   });
 
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_signature.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_signature.tsx
index 72f58df5677e4..57e5ff19eb815 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_signature.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/body/renderers/zeek/zeek_signature.tsx
@@ -13,7 +13,7 @@ import { Ecs } from '../../../../../graphql/types';
 import { DragEffects, DraggableWrapper } from '../../../../drag_and_drop/draggable_wrapper';
 import { escapeDataProviderId } from '../../../../drag_and_drop/helpers';
 import { ExternalLinkIcon } from '../../../../external_link_icon';
-import { GoogleLink, VirusTotalLink } from '../../../../links';
+import { GoogleLink, ReputationLink } from '../../../../links';
 import { Provider } from '../../../../timeline/data_providers/provider';
 import { IS_OPERATOR } from '../../../data_providers/data_provider';
 
@@ -148,8 +148,12 @@ export const TotalVirusLinkSha = React.memo<TotalVirusLinkShaProps>(({ value })
   value != null ? (
     <LinkFlexItem grow={false}>
       <div>
-        <VirusTotalLink link={value}>{value}</VirusTotalLink>
-        <ExternalLinkIcon />
+        <ReputationLink
+          domain={value}
+          overflowIndexStart={1}
+          showDomain={true}
+          data-test-subj="reputationLinkSha"
+        />
       </div>
     </LinkFlexItem>
   ) : null
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/helpers.test.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/helpers.test.ts
new file mode 100644
index 0000000000000..5eb503f8ba074
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/helpers.test.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { isUrlInvalid } from './helpers';
+
+describe('helpers', () => {
+  describe('isUrlInvalid', () => {
+    test('verifies invalid url', () => {
+      expect(isUrlInvalid('this is not a url')).toBeTruthy();
+    });
+
+    test('verifies valid url', () => {
+      expect(isUrlInvalid('https://www.elastic.co/')).toBeFalsy();
+    });
+  });
+});