From 7a779007bfb579337cd1e91f22c2a9f259fee285 Mon Sep 17 00:00:00 2001
From: Matthias Wilhelm <matthias.wilhelm@elastic.co>
Date: Tue, 1 Dec 2020 15:16:02 +0100
Subject: [PATCH 01/28] [Discover] Unskip doc table tests (#84564)

---
 test/functional/apps/discover/_doc_table.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/test/functional/apps/discover/_doc_table.ts b/test/functional/apps/discover/_doc_table.ts
index 49b160cc70312..20fda144b338e 100644
--- a/test/functional/apps/discover/_doc_table.ts
+++ b/test/functional/apps/discover/_doc_table.ts
@@ -31,8 +31,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     defaultIndex: 'logstash-*',
   };
 
-  // Failing: See https://github.com/elastic/kibana/issues/82445
-  describe.skip('discover doc table', function describeIndexTests() {
+  describe('discover doc table', function describeIndexTests() {
     const defaultRowsLimit = 50;
     const rowsHardLimit = 500;
 

From 99ea48f401ee631822d37ee8cc709470418e14b3 Mon Sep 17 00:00:00 2001
From: Steph Milovic <stephanie.milovic@elastic.co>
Date: Tue, 1 Dec 2020 08:26:01 -0600
Subject: [PATCH 02/28] [Security Solution] [Cases] Cypress for case connector
 selector options (#80745)

---
 .../cypress/integration/cases.spec.ts         |  11 +-
 .../cases_connector_options.spec.ts           |  72 ++++++
 .../security_solution/cypress/objects/case.ts | 220 ++++++++++++++++++
 .../cypress/screens/case_details.ts           |  10 +
 .../cypress/screens/edit_connector.ts         |  29 +++
 .../cypress/tasks/case_details.ts             |  13 +-
 .../cypress/tasks/create_new_case.ts          |  73 ++++--
 7 files changed, 412 insertions(+), 16 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/cypress/integration/cases_connector_options.spec.ts
 create mode 100644 x-pack/plugins/security_solution/cypress/screens/edit_connector.ts

diff --git a/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
index ec3887ad72625..b32402851ac7c 100644
--- a/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
@@ -39,7 +39,12 @@ import { TIMELINE_DESCRIPTION, TIMELINE_QUERY, TIMELINE_TITLE } from '../screens
 
 import { goToCaseDetails, goToCreateNewCase } from '../tasks/all_cases';
 import { openCaseTimeline } from '../tasks/case_details';
-import { backToCases, createNewCaseWithTimeline } from '../tasks/create_new_case';
+import {
+  attachTimeline,
+  backToCases,
+  createCase,
+  fillCasesMandatoryfields,
+} from '../tasks/create_new_case';
 import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
 import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
 
@@ -57,7 +62,9 @@ describe('Cases', () => {
   it('Creates a new case with timeline and opens the timeline', () => {
     loginAndWaitForPageWithoutDateRange(CASES_URL);
     goToCreateNewCase();
-    createNewCaseWithTimeline(case1);
+    fillCasesMandatoryfields(case1);
+    attachTimeline(case1);
+    createCase();
     backToCases();
 
     cy.get(ALL_CASES_PAGE_TITLE).should('have.text', 'Cases');
diff --git a/x-pack/plugins/security_solution/cypress/integration/cases_connector_options.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases_connector_options.spec.ts
new file mode 100644
index 0000000000000..f227042a0f9dc
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/integration/cases_connector_options.spec.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
+import {
+  case1,
+  connectorIds,
+  mockConnectorsResponse,
+  executeResponses,
+  ibmResilientConnectorOptions,
+  jiraConnectorOptions,
+  serviceNowConnectorOpions,
+} from '../objects/case';
+import {
+  createCase,
+  fillCasesMandatoryfields,
+  fillIbmResilientConnectorOptions,
+  fillJiraConnectorOptions,
+  fillServiceNowConnectorOptions,
+} from '../tasks/create_new_case';
+import { goToCreateNewCase } from '../tasks/all_cases';
+import { deleteCase } from '../tasks/case_details';
+import { CASES_URL } from '../urls/navigation';
+import { CONNECTOR_CARD_DETAILS, CONNECTOR_TITLE } from '../screens/case_details';
+
+describe('Cases connector incident fields', () => {
+  before(() => {
+    cy.server();
+    cy.route('GET', '**/api/cases/configure/connectors/_find', mockConnectorsResponse);
+    cy.route2('POST', `**/api/actions/action/${connectorIds.jira}/_execute`, (req) => {
+      const response =
+        JSON.parse(req.body).params.subAction === 'issueTypes'
+          ? executeResponses.jira.issueTypes
+          : executeResponses.jira.fieldsByIssueType;
+      req.reply(JSON.stringify(response));
+    });
+    cy.route2('POST', `**/api/actions/action/${connectorIds.resilient}/_execute`, (req) => {
+      const response =
+        JSON.parse(req.body).params.subAction === 'incidentTypes'
+          ? executeResponses.resilient.incidentTypes
+          : executeResponses.resilient.severity;
+      req.reply(JSON.stringify(response));
+    });
+  });
+
+  after(() => {
+    deleteCase();
+  });
+
+  it('Correct incident fields show when connector is changed', () => {
+    loginAndWaitForPageWithoutDateRange(CASES_URL);
+    goToCreateNewCase();
+    fillCasesMandatoryfields(case1);
+    fillJiraConnectorOptions(jiraConnectorOptions);
+    fillServiceNowConnectorOptions(serviceNowConnectorOpions);
+    fillIbmResilientConnectorOptions(ibmResilientConnectorOptions);
+    createCase();
+
+    cy.get(CONNECTOR_TITLE).should('have.text', ibmResilientConnectorOptions.title);
+    cy.get(CONNECTOR_CARD_DETAILS).should(
+      'have.text',
+      `${
+        ibmResilientConnectorOptions.title
+      }Incident Types: ${ibmResilientConnectorOptions.incidentTypes.join(', ')}Severity: ${
+        ibmResilientConnectorOptions.severity
+      }`
+    );
+  });
+});
diff --git a/x-pack/plugins/security_solution/cypress/objects/case.ts b/x-pack/plugins/security_solution/cypress/objects/case.ts
index 084df31a604a3..01e9a9124ca88 100644
--- a/x-pack/plugins/security_solution/cypress/objects/case.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/case.ts
@@ -21,6 +21,23 @@ export interface Connector {
   password: string;
 }
 
+export interface JiraConnectorOptions {
+  issueType: string;
+  priority: string;
+}
+
+export interface ServiceNowconnectorOptions {
+  urgency: string;
+  severity: string;
+  impact: string;
+}
+
+export interface IbmResilientConnectorOptions {
+  title: string;
+  severity: string;
+  incidentTypes: string[];
+}
+
 export const caseTimeline: TimelineWithId = {
   title: 'SIEM test',
   description: 'description',
@@ -43,4 +60,207 @@ export const serviceNowConnector: Connector = {
   password: 'password',
 };
 
+export const jiraConnectorOptions: JiraConnectorOptions = {
+  issueType: '10006',
+  priority: 'High',
+};
+
+export const serviceNowConnectorOpions: ServiceNowconnectorOptions = {
+  urgency: '2',
+  severity: '1',
+  impact: '3',
+};
+
+export const ibmResilientConnectorOptions: IbmResilientConnectorOptions = {
+  title: 'Resilient',
+  severity: 'Medium',
+  incidentTypes: ['Communication error (fax; email)', 'Denial of Service'],
+};
+
 export const TIMELINE_CASE_ID = '68248e00-f689-11ea-9ab2-59238b522856';
+export const connectorIds = {
+  jira: '000e5f86-08b0-4882-adfd-6df981d45c1b',
+  sn: '93a69ba3-3c31-4b4c-bf86-cc79a090f437',
+  resilient: 'a6a8dd7f-7e88-48fe-9b9f-70b668da8cbc',
+};
+
+export const mockConnectorsResponse = [
+  {
+    id: connectorIds.jira,
+    actionTypeId: '.jira',
+    name: 'Jira',
+    config: {
+      incidentConfiguration: {
+        mapping: [
+          { source: 'title', target: 'summary', actionType: 'overwrite' },
+          { source: 'description', target: 'description', actionType: 'overwrite' },
+          { source: 'comments', target: 'comments', actionType: 'append' },
+        ],
+      },
+      isCaseOwned: true,
+      apiUrl: 'https://siem-kibana.atlassian.net',
+      projectKey: 'RJ',
+    },
+    isPreconfigured: false,
+    referencedByCount: 0,
+  },
+  {
+    id: connectorIds.resilient,
+    actionTypeId: '.resilient',
+    name: 'Resilient',
+    config: {
+      incidentConfiguration: {
+        mapping: [
+          { source: 'title', target: 'name', actionType: 'overwrite' },
+          { source: 'description', target: 'description', actionType: 'overwrite' },
+          { source: 'comments', target: 'comments', actionType: 'append' },
+        ],
+      },
+      isCaseOwned: true,
+      apiUrl: 'https://ibm-resilient.siem.estc.dev',
+      orgId: '201',
+    },
+    isPreconfigured: false,
+    referencedByCount: 0,
+  },
+  {
+    id: connectorIds.sn,
+    actionTypeId: '.servicenow',
+    name: 'ServiceNow',
+    config: {
+      incidentConfiguration: {
+        mapping: [
+          { source: 'title', target: 'short_description', actionType: 'overwrite' },
+          { source: 'description', target: 'description', actionType: 'overwrite' },
+          { source: 'comments', target: 'comments', actionType: 'append' },
+        ],
+      },
+      isCaseOwned: true,
+      apiUrl: 'https://dev65287.service-now.com',
+    },
+    isPreconfigured: false,
+    referencedByCount: 0,
+  },
+];
+export const executeResponses = {
+  jira: {
+    issueTypes: {
+      status: 'ok',
+      data: [
+        { id: '10006', name: 'Task' },
+        { id: '10007', name: 'Sub-task' },
+      ],
+      actionId: connectorIds.jira,
+    },
+    fieldsByIssueType: {
+      status: 'ok',
+      data: {
+        summary: { allowedValues: [], defaultValue: {} },
+        issuetype: {
+          allowedValues: [
+            {
+              self: 'https://siem-kibana.atlassian.net/rest/api/2/issuetype/10006',
+              id: '10006',
+              description: 'A small, distinct piece of work.',
+              iconUrl:
+                'https://siem-kibana.atlassian.net/secure/viewavatar?size=medium&avatarId=10318&avatarType=issuetype',
+              name: 'Task',
+              subtask: false,
+              avatarId: 10318,
+            },
+          ],
+          defaultValue: {},
+        },
+        attachment: { allowedValues: [], defaultValue: {} },
+        duedate: { allowedValues: [], defaultValue: {} },
+        description: { allowedValues: [], defaultValue: {} },
+        project: {
+          allowedValues: [
+            {
+              self: 'https://siem-kibana.atlassian.net/rest/api/2/project/10011',
+              id: '10011',
+              key: 'RJ',
+              name: 'Refactor Jira',
+              projectTypeKey: 'business',
+              simplified: false,
+              avatarUrls: {
+                '48x48':
+                  'https://siem-kibana.atlassian.net/secure/projectavatar?pid=10011&avatarId=10423',
+                '24x24':
+                  'https://siem-kibana.atlassian.net/secure/projectavatar?size=small&s=small&pid=10011&avatarId=10423',
+                '16x16':
+                  'https://siem-kibana.atlassian.net/secure/projectavatar?size=xsmall&s=xsmall&pid=10011&avatarId=10423',
+                '32x32':
+                  'https://siem-kibana.atlassian.net/secure/projectavatar?size=medium&s=medium&pid=10011&avatarId=10423',
+              },
+            },
+          ],
+          defaultValue: {},
+        },
+        assignee: { allowedValues: [], defaultValue: {} },
+        priority: {
+          allowedValues: [
+            {
+              self: 'https://siem-kibana.atlassian.net/rest/api/2/priority/1',
+              iconUrl: 'https://siem-kibana.atlassian.net/images/icons/priorities/highest.svg',
+              name: 'Highest',
+              id: '1',
+            },
+            {
+              self: 'https://siem-kibana.atlassian.net/rest/api/2/priority/2',
+              iconUrl: 'https://siem-kibana.atlassian.net/images/icons/priorities/high.svg',
+              name: 'High',
+              id: '2',
+            },
+            {
+              self: 'https://siem-kibana.atlassian.net/rest/api/2/priority/3',
+              iconUrl: 'https://siem-kibana.atlassian.net/images/icons/priorities/medium.svg',
+              name: 'Medium',
+              id: '3',
+            },
+            {
+              self: 'https://siem-kibana.atlassian.net/rest/api/2/priority/4',
+              iconUrl: 'https://siem-kibana.atlassian.net/images/icons/priorities/low.svg',
+              name: 'Low',
+              id: '4',
+            },
+            {
+              self: 'https://siem-kibana.atlassian.net/rest/api/2/priority/5',
+              iconUrl: 'https://siem-kibana.atlassian.net/images/icons/priorities/lowest.svg',
+              name: 'Lowest',
+              id: '5',
+            },
+          ],
+          defaultValue: {
+            self: 'https://siem-kibana.atlassian.net/rest/api/2/priority/3',
+            iconUrl: 'https://siem-kibana.atlassian.net/images/icons/priorities/medium.svg',
+            name: 'Medium',
+            id: '3',
+          },
+        },
+        timetracking: { allowedValues: [], defaultValue: {} },
+        labels: { allowedValues: [], defaultValue: {} },
+      },
+      actionId: connectorIds.jira,
+    },
+  },
+  resilient: {
+    incidentTypes: {
+      status: 'ok',
+      data: [
+        { id: 17, name: 'Communication error (fax; email)' },
+        { id: 21, name: 'Denial of Service' },
+      ],
+      actionId: connectorIds.resilient,
+    },
+    severity: {
+      status: 'ok',
+      data: [
+        { id: 4, name: 'Low' },
+        { id: 5, name: 'Medium' },
+        { id: 6, name: 'High' },
+      ],
+      actionId: connectorIds.resilient,
+    },
+  },
+};
diff --git a/x-pack/plugins/security_solution/cypress/screens/case_details.ts b/x-pack/plugins/security_solution/cypress/screens/case_details.ts
index 7b995f5395543..02ec74aaed29c 100644
--- a/x-pack/plugins/security_solution/cypress/screens/case_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/case_details.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export const CASE_ACTIONS_BTN = '[data-test-subj="property-actions-ellipses"]';
+
 export const CASE_DETAILS_DESCRIPTION =
   '[data-test-subj="description-action"] [data-test-subj="user-action-markdown"]';
 
@@ -27,6 +29,14 @@ export const CASE_DETAILS_USER_ACTION_DESCRIPTION_USERNAME =
 
 export const CASE_DETAILS_USERNAMES = '[data-test-subj="case-view-username"]';
 
+export const CONNECTOR_CARD_DETAILS = '[data-test-subj="settings-connector-card"]';
+
+export const CONNECTOR_TITLE = '[data-test-subj="settings-connector-card"] span.euiTitle';
+
+export const DELETE_CASE_BTN = '[data-test-subj="property-actions-trash"]';
+
+export const DELETE_CASE_CONFIRMATION_BTN = '[data-test-subj="confirmModalConfirmButton"]';
+
 export const PARTICIPANTS = 1;
 
 export const REPORTER = 0;
diff --git a/x-pack/plugins/security_solution/cypress/screens/edit_connector.ts b/x-pack/plugins/security_solution/cypress/screens/edit_connector.ts
new file mode 100644
index 0000000000000..c0ae4f94c541b
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/screens/edit_connector.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { connectorIds } from '../objects/case';
+
+export const CONNECTOR_RESILIENT = `[data-test-subj="connector-settings-resilient"]`;
+
+export const CONNECTOR_SELECTOR = '[data-test-subj="dropdown-connectors"]';
+
+export const SELECT_IMPACT = `[data-test-subj="impactSelect"]`;
+
+export const SELECT_INCIDENT_TYPE = `[data-test-subj="incidentTypeComboBox"] input[data-test-subj="comboBoxSearchInput"]`;
+
+export const SELECT_ISSUE_TYPE = `[data-test-subj="issueTypeSelect"]`;
+
+export const SELECT_JIRA = `[data-test-subj="dropdown-connector-${connectorIds.jira}"]`;
+
+export const SELECT_PRIORITY = `[data-test-subj="prioritySelect"]`;
+
+export const SELECT_RESILIENT = `[data-test-subj="dropdown-connector-${connectorIds.resilient}"]`;
+
+export const SELECT_SEVERITY = `[data-test-subj="severitySelect"]`;
+
+export const SELECT_SN = `[data-test-subj="dropdown-connector-${connectorIds.sn}"]`;
+
+export const SELECT_URGENCY = `[data-test-subj="urgencySelect"]`;
diff --git a/x-pack/plugins/security_solution/cypress/tasks/case_details.ts b/x-pack/plugins/security_solution/cypress/tasks/case_details.ts
index 976d568ab3a91..51850997c3685 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/case_details.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/case_details.ts
@@ -5,7 +5,18 @@
  */
 
 import { TIMELINE_TITLE } from '../screens/timeline';
-import { CASE_DETAILS_TIMELINE_LINK_MARKDOWN } from '../screens/case_details';
+import {
+  CASE_ACTIONS_BTN,
+  CASE_DETAILS_TIMELINE_LINK_MARKDOWN,
+  DELETE_CASE_BTN,
+  DELETE_CASE_CONFIRMATION_BTN,
+} from '../screens/case_details';
+
+export const deleteCase = () => {
+  cy.get(CASE_ACTIONS_BTN).first().click();
+  cy.get(DELETE_CASE_BTN).click();
+  cy.get(DELETE_CASE_CONFIRMATION_BTN).click();
+};
 
 export const openCaseTimeline = () => {
   cy.get(CASE_DETAILS_TIMELINE_LINK_MARKDOWN).click();
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
index f5013eed07d29..39654fd115a4a 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
@@ -4,7 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { TestCase } from '../objects/case';
+import {
+  IbmResilientConnectorOptions,
+  JiraConnectorOptions,
+  ServiceNowconnectorOptions,
+  TestCase,
+} from '../objects/case';
 
 import {
   BACK_TO_CASES_BTN,
@@ -16,34 +21,76 @@ import {
   TIMELINE_SEARCHBOX,
   TITLE_INPUT,
 } from '../screens/create_new_case';
+import {
+  CONNECTOR_RESILIENT,
+  CONNECTOR_SELECTOR,
+  SELECT_IMPACT,
+  SELECT_INCIDENT_TYPE,
+  SELECT_ISSUE_TYPE,
+  SELECT_JIRA,
+  SELECT_PRIORITY,
+  SELECT_RESILIENT,
+  SELECT_SEVERITY,
+  SELECT_SN,
+  SELECT_URGENCY,
+} from '../screens/edit_connector';
 
 export const backToCases = () => {
   cy.get(BACK_TO_CASES_BTN).click({ force: true });
 };
 
-export const createNewCase = (newCase: TestCase) => {
+export const fillCasesMandatoryfields = (newCase: TestCase) => {
   cy.get(TITLE_INPUT).type(newCase.name, { force: true });
   newCase.tags.forEach((tag) => {
     cy.get(TAGS_INPUT).type(`${tag}{enter}`, { force: true });
   });
   cy.get(DESCRIPTION_INPUT).type(`${newCase.description} `, { force: true });
-
-  cy.get(SUBMIT_BTN).click({ force: true });
-  cy.get(LOADING_SPINNER).should('exist');
-  cy.get(LOADING_SPINNER).should('not.exist');
 };
 
-export const createNewCaseWithTimeline = (newCase: TestCase) => {
-  cy.get(TITLE_INPUT).type(newCase.name, { force: true });
-  newCase.tags.forEach((tag) => {
-    cy.get(TAGS_INPUT).type(`${tag}{enter}`, { force: true });
-  });
-  cy.get(DESCRIPTION_INPUT).type(`${newCase.description} `, { force: true });
-
+export const attachTimeline = (newCase: TestCase) => {
   cy.get(INSERT_TIMELINE_BTN).click({ force: true });
   cy.get(TIMELINE_SEARCHBOX).type(`${newCase.timeline.title}{enter}`);
+};
 
+export const createCase = () => {
   cy.get(SUBMIT_BTN).click({ force: true });
   cy.get(LOADING_SPINNER).should('exist');
   cy.get(LOADING_SPINNER).should('not.exist');
 };
+
+export const fillJiraConnectorOptions = (jiraConnector: JiraConnectorOptions) => {
+  cy.get(CONNECTOR_SELECTOR).click({ force: true });
+  cy.get(SELECT_JIRA).click({ force: true });
+  cy.get(SELECT_ISSUE_TYPE).should('exist');
+
+  cy.get(SELECT_PRIORITY).should('exist');
+  cy.get(SELECT_ISSUE_TYPE).select(jiraConnector.issueType);
+  cy.get(SELECT_PRIORITY).select(jiraConnector.priority);
+};
+
+export const fillServiceNowConnectorOptions = (
+  serviceNowConnectorOpions: ServiceNowconnectorOptions
+) => {
+  cy.get(CONNECTOR_SELECTOR).click({ force: true });
+  cy.get(SELECT_SN).click({ force: true });
+  cy.get(SELECT_SEVERITY).should('exist');
+  cy.get(SELECT_URGENCY).should('exist');
+  cy.get(SELECT_IMPACT).should('exist');
+  cy.get(SELECT_URGENCY).select(serviceNowConnectorOpions.urgency);
+  cy.get(SELECT_SEVERITY).select(serviceNowConnectorOpions.severity);
+  cy.get(SELECT_IMPACT).select(serviceNowConnectorOpions.impact);
+};
+
+export const fillIbmResilientConnectorOptions = (
+  ibmResilientConnector: IbmResilientConnectorOptions
+) => {
+  cy.get(CONNECTOR_SELECTOR).click({ force: true });
+  cy.get(SELECT_RESILIENT).click({ force: true });
+  cy.get(SELECT_INCIDENT_TYPE).should('exist');
+  cy.get(SELECT_SEVERITY).should('exist');
+  ibmResilientConnector.incidentTypes.forEach((incidentType) => {
+    cy.get(SELECT_INCIDENT_TYPE).type(`${incidentType}{enter}`, { force: true });
+  });
+  cy.get(CONNECTOR_RESILIENT).click();
+  cy.get(SELECT_SEVERITY).select(ibmResilientConnector.severity);
+};

From 920e4fa280aaed62be7ebb6e3dc47b1a0720240c Mon Sep 17 00:00:00 2001
From: Thomas Watson <w@tson.dk>
Date: Tue, 1 Dec 2020 15:55:54 +0100
Subject: [PATCH 03/28] Update code-comments describing babel plugins (#84622)

---
 packages/kbn-babel-preset/common_preset.js | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/packages/kbn-babel-preset/common_preset.js b/packages/kbn-babel-preset/common_preset.js
index 8e2f1d207f3f4..b14dcd8971c31 100644
--- a/packages/kbn-babel-preset/common_preset.js
+++ b/packages/kbn-babel-preset/common_preset.js
@@ -28,18 +28,19 @@ const plugins = [
   // See https://github.com/babel/proposals/issues/12 for progress
   require.resolve('@babel/plugin-proposal-class-properties'),
 
-  // Optional Chaining proposal is stage 3 (https://github.com/tc39/proposal-optional-chaining)
+  // Optional Chaining proposal is stage 4 (https://github.com/tc39/proposal-optional-chaining)
   // Need this since we are using TypeScript 3.7+
   require.resolve('@babel/plugin-proposal-optional-chaining'),
-  // Nullish coalescing proposal is stage 3 (https://github.com/tc39/proposal-nullish-coalescing)
+
+  // Nullish coalescing proposal is stage 4 (https://github.com/tc39/proposal-nullish-coalescing)
   // Need this since we are using TypeScript 3.7+
   require.resolve('@babel/plugin-proposal-nullish-coalescing-operator'),
 
-  // Proposal is on stage 4 (https://github.com/tc39/proposal-export-ns-from)
+  // Proposal is on stage 4, and included in ECMA-262 (https://github.com/tc39/proposal-export-ns-from)
   // Need this since we are using TypeScript 3.8+
   require.resolve('@babel/plugin-proposal-export-namespace-from'),
 
-  // Proposal is on stage 4 (https://github.com/tc39/proposal-export-ns-from)
+  // Proposal is on stage 4, and included in ECMA-262 (https://github.com/tc39/proposal-export-ns-from)
   // Need this since we are using TypeScript 3.9+
   require.resolve('@babel/plugin-proposal-private-methods'),
 ];

From 0b5c55c59717f977ec39a7657aa6b570e19bf876 Mon Sep 17 00:00:00 2001
From: Tyler Smalley <tyler.smalley@elastic.co>
Date: Tue, 1 Dec 2020 07:10:09 -0800
Subject: [PATCH 04/28] Revert "[Alerting] renames Resolved action group to
 Recovered (#84123)"

This reverts commit 7dcaff5dddb0389bd2e5b35b41d58006710afc91.
---
 .../alerts/common/builtin_action_groups.ts    | 10 +--
 .../alerts/server/alert_type_registry.test.ts | 14 ++---
 .../tests/get_alert_instance_summary.test.ts  |  2 +-
 ...rt_instance_summary_from_event_log.test.ts | 62 +++----------------
 .../alert_instance_summary_from_event_log.ts  |  5 +-
 x-pack/plugins/alerts/server/plugin.ts        |  5 +-
 .../server/task_runner/task_runner.test.ts    | 12 ++--
 .../alerts/server/task_runner/task_runner.ts  | 32 +++++-----
 .../inventory_metric_threshold_executor.ts    |  4 +-
 .../metric_threshold_executor.test.ts         |  6 +-
 .../metric_threshold_executor.ts              |  4 +-
 .../public/application/constants/index.ts     |  6 +-
 .../action_form.test.tsx                      | 27 ++++----
 .../action_type_form.tsx                      | 10 +--
 .../tests/alerting/list_alert_types.ts        |  4 +-
 .../spaces_only/tests/alerting/alerts_base.ts | 16 ++---
 .../spaces_only/tests/alerting/event_log.ts   | 14 ++---
 .../alerting/get_alert_instance_summary.ts    |  2 +-
 .../tests/alerting/list_alert_types.ts        |  2 +-
 19 files changed, 90 insertions(+), 147 deletions(-)

diff --git a/x-pack/plugins/alerts/common/builtin_action_groups.ts b/x-pack/plugins/alerts/common/builtin_action_groups.ts
index d9c5ae613f787..d31f75357d370 100644
--- a/x-pack/plugins/alerts/common/builtin_action_groups.ts
+++ b/x-pack/plugins/alerts/common/builtin_action_groups.ts
@@ -6,13 +6,13 @@
 import { i18n } from '@kbn/i18n';
 import { ActionGroup } from './alert_type';
 
-export const RecoveredActionGroup: ActionGroup = {
-  id: 'recovered',
-  name: i18n.translate('xpack.alerts.builtinActionGroups.recovered', {
-    defaultMessage: 'Recovered',
+export const ResolvedActionGroup: ActionGroup = {
+  id: 'resolved',
+  name: i18n.translate('xpack.alerts.builtinActionGroups.resolved', {
+    defaultMessage: 'Resolved',
   }),
 };
 
 export function getBuiltinActionGroups(): ActionGroup[] {
-  return [RecoveredActionGroup];
+  return [ResolvedActionGroup];
 }
diff --git a/x-pack/plugins/alerts/server/alert_type_registry.test.ts b/x-pack/plugins/alerts/server/alert_type_registry.test.ts
index b04871a047e4b..8dc387f96addb 100644
--- a/x-pack/plugins/alerts/server/alert_type_registry.test.ts
+++ b/x-pack/plugins/alerts/server/alert_type_registry.test.ts
@@ -105,8 +105,8 @@ describe('register()', () => {
           name: 'Default',
         },
         {
-          id: 'recovered',
-          name: 'Recovered',
+          id: 'resolved',
+          name: 'Resolved',
         },
       ],
       defaultActionGroupId: 'default',
@@ -117,7 +117,7 @@ describe('register()', () => {
 
     expect(() => registry.register(alertType)).toThrowError(
       new Error(
-        `Alert type [id="${alertType.id}"] cannot be registered. Action groups [recovered] are reserved by the framework.`
+        `Alert type [id="${alertType.id}"] cannot be registered. Action groups [resolved] are reserved by the framework.`
       )
     );
   });
@@ -229,8 +229,8 @@ describe('get()', () => {
             "name": "Default",
           },
           Object {
-            "id": "recovered",
-            "name": "Recovered",
+            "id": "resolved",
+            "name": "Resolved",
           },
         ],
         "actionVariables": Object {
@@ -287,8 +287,8 @@ describe('list()', () => {
               "name": "Test Action Group",
             },
             Object {
-              "id": "recovered",
-              "name": "Recovered",
+              "id": "resolved",
+              "name": "Resolved",
             },
           ],
           "actionVariables": Object {
diff --git a/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts b/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts
index 0a764ea768591..9bd61c0fe66d2 100644
--- a/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts
+++ b/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts
@@ -122,7 +122,7 @@ describe('getAlertInstanceSummary()', () => {
       .addActiveInstance('instance-previously-active', 'action group B')
       .advanceTime(10000)
       .addExecute()
-      .addRecoveredInstance('instance-previously-active')
+      .addResolvedInstance('instance-previously-active')
       .addActiveInstance('instance-currently-active', 'action group A')
       .getEvents();
     const eventsResult = {
diff --git a/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts b/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts
index 1d5ebe2b5911e..f9e4a2908d6ce 100644
--- a/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts
+++ b/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts
@@ -6,7 +6,7 @@
 
 import { SanitizedAlert, AlertInstanceSummary } from '../types';
 import { IValidatedEvent } from '../../../event_log/server';
-import { EVENT_LOG_ACTIONS, EVENT_LOG_PROVIDER, LEGACY_EVENT_LOG_ACTIONS } from '../plugin';
+import { EVENT_LOG_ACTIONS, EVENT_LOG_PROVIDER } from '../plugin';
 import { alertInstanceSummaryFromEventLog } from './alert_instance_summary_from_event_log';
 
 const ONE_HOUR_IN_MILLIS = 60 * 60 * 1000;
@@ -189,43 +189,7 @@ describe('alertInstanceSummaryFromEventLog', () => {
       .addActiveInstance('instance-1', 'action group A')
       .advanceTime(10000)
       .addExecute()
-      .addRecoveredInstance('instance-1')
-      .getEvents();
-
-    const summary: AlertInstanceSummary = alertInstanceSummaryFromEventLog({
-      alert,
-      events,
-      dateStart,
-      dateEnd,
-    });
-
-    const { lastRun, status, instances } = summary;
-    expect({ lastRun, status, instances }).toMatchInlineSnapshot(`
-      Object {
-        "instances": Object {
-          "instance-1": Object {
-            "actionGroupId": undefined,
-            "activeStartDate": undefined,
-            "muted": false,
-            "status": "OK",
-          },
-        },
-        "lastRun": "2020-06-18T00:00:10.000Z",
-        "status": "OK",
-      }
-    `);
-  });
-
-  test('legacy alert with currently inactive instance', async () => {
-    const alert = createAlert({});
-    const eventsFactory = new EventsFactory();
-    const events = eventsFactory
-      .addExecute()
-      .addNewInstance('instance-1')
-      .addActiveInstance('instance-1', 'action group A')
-      .advanceTime(10000)
-      .addExecute()
-      .addLegacyResolvedInstance('instance-1')
+      .addResolvedInstance('instance-1')
       .getEvents();
 
     const summary: AlertInstanceSummary = alertInstanceSummaryFromEventLog({
@@ -260,7 +224,7 @@ describe('alertInstanceSummaryFromEventLog', () => {
       .addActiveInstance('instance-1', 'action group A')
       .advanceTime(10000)
       .addExecute()
-      .addRecoveredInstance('instance-1')
+      .addResolvedInstance('instance-1')
       .getEvents();
 
     const summary: AlertInstanceSummary = alertInstanceSummaryFromEventLog({
@@ -442,7 +406,7 @@ describe('alertInstanceSummaryFromEventLog', () => {
       .advanceTime(10000)
       .addExecute()
       .addActiveInstance('instance-1', 'action group A')
-      .addRecoveredInstance('instance-2')
+      .addResolvedInstance('instance-2')
       .getEvents();
 
     const summary: AlertInstanceSummary = alertInstanceSummaryFromEventLog({
@@ -487,7 +451,7 @@ describe('alertInstanceSummaryFromEventLog', () => {
       .advanceTime(10000)
       .addExecute()
       .addActiveInstance('instance-1', 'action group A')
-      .addRecoveredInstance('instance-2')
+      .addResolvedInstance('instance-2')
       .advanceTime(10000)
       .addExecute()
       .addActiveInstance('instance-1', 'action group B')
@@ -597,24 +561,12 @@ export class EventsFactory {
     return this;
   }
 
-  addRecoveredInstance(instanceId: string): EventsFactory {
-    this.events.push({
-      '@timestamp': this.date,
-      event: {
-        provider: EVENT_LOG_PROVIDER,
-        action: EVENT_LOG_ACTIONS.recoveredInstance,
-      },
-      kibana: { alerting: { instance_id: instanceId } },
-    });
-    return this;
-  }
-
-  addLegacyResolvedInstance(instanceId: string): EventsFactory {
+  addResolvedInstance(instanceId: string): EventsFactory {
     this.events.push({
       '@timestamp': this.date,
       event: {
         provider: EVENT_LOG_PROVIDER,
-        action: LEGACY_EVENT_LOG_ACTIONS.resolvedInstance,
+        action: EVENT_LOG_ACTIONS.resolvedInstance,
       },
       kibana: { alerting: { instance_id: instanceId } },
     });
diff --git a/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts b/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts
index 6fed8b4aa4ee6..8fed97a74435d 100644
--- a/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts
+++ b/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts
@@ -6,7 +6,7 @@
 
 import { SanitizedAlert, AlertInstanceSummary, AlertInstanceStatus } from '../types';
 import { IEvent } from '../../../event_log/server';
-import { EVENT_LOG_ACTIONS, EVENT_LOG_PROVIDER, LEGACY_EVENT_LOG_ACTIONS } from '../plugin';
+import { EVENT_LOG_ACTIONS, EVENT_LOG_PROVIDER } from '../plugin';
 
 export interface AlertInstanceSummaryFromEventLogParams {
   alert: SanitizedAlert;
@@ -80,8 +80,7 @@ export function alertInstanceSummaryFromEventLog(
         status.status = 'Active';
         status.actionGroupId = event?.kibana?.alerting?.action_group_id;
         break;
-      case LEGACY_EVENT_LOG_ACTIONS.resolvedInstance:
-      case EVENT_LOG_ACTIONS.recoveredInstance:
+      case EVENT_LOG_ACTIONS.resolvedInstance:
         status.status = 'OK';
         status.activeStartDate = undefined;
         status.actionGroupId = undefined;
diff --git a/x-pack/plugins/alerts/server/plugin.ts b/x-pack/plugins/alerts/server/plugin.ts
index bafb89c64076b..4bfb44425544a 100644
--- a/x-pack/plugins/alerts/server/plugin.ts
+++ b/x-pack/plugins/alerts/server/plugin.ts
@@ -82,11 +82,8 @@ export const EVENT_LOG_ACTIONS = {
   execute: 'execute',
   executeAction: 'execute-action',
   newInstance: 'new-instance',
-  recoveredInstance: 'recovered-instance',
-  activeInstance: 'active-instance',
-};
-export const LEGACY_EVENT_LOG_ACTIONS = {
   resolvedInstance: 'resolved-instance',
+  activeInstance: 'active-instance',
 };
 
 export interface PluginSetupContract {
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts b/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
index d4c4f746392c3..07d08f5837d54 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
@@ -26,12 +26,12 @@ import { alertsMock, alertsClientMock } from '../mocks';
 import { eventLoggerMock } from '../../../event_log/server/event_logger.mock';
 import { IEventLogger } from '../../../event_log/server';
 import { SavedObjectsErrorHelpers } from '../../../../../src/core/server';
-import { Alert, RecoveredActionGroup } from '../../common';
+import { Alert, ResolvedActionGroup } from '../../common';
 import { omit } from 'lodash';
 const alertType = {
   id: 'test',
   name: 'My test alert',
-  actionGroups: [{ id: 'default', name: 'Default' }, RecoveredActionGroup],
+  actionGroups: [{ id: 'default', name: 'Default' }, ResolvedActionGroup],
   defaultActionGroupId: 'default',
   executor: jest.fn(),
   producer: 'alerts',
@@ -114,7 +114,7 @@ describe('Task Runner', () => {
         },
       },
       {
-        group: RecoveredActionGroup.id,
+        group: ResolvedActionGroup.id,
         id: '2',
         actionTypeId: 'action',
         params: {
@@ -517,7 +517,7 @@ describe('Task Runner', () => {
     `);
   });
 
-  test('fire recovered actions for execution for the alertInstances which is in the recovered state', async () => {
+  test('fire resolved actions for execution for the alertInstances which is in the resolved state', async () => {
     taskRunnerFactoryInitializerParams.actionsPlugin.isActionTypeEnabled.mockReturnValue(true);
     taskRunnerFactoryInitializerParams.actionsPlugin.isActionExecutable.mockReturnValue(true);
 
@@ -650,7 +650,7 @@ describe('Task Runner', () => {
         Array [
           Object {
             "event": Object {
-              "action": "recovered-instance",
+              "action": "resolved-instance",
             },
             "kibana": Object {
               "alerting": Object {
@@ -666,7 +666,7 @@ describe('Task Runner', () => {
                 },
               ],
             },
-            "message": "test:1: 'alert-name' instance '2' has recovered",
+            "message": "test:1: 'alert-name' resolved instance: '2'",
           },
         ],
         Array [
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner.ts b/x-pack/plugins/alerts/server/task_runner/task_runner.ts
index 5a7247ac50ea0..24d96788c3395 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner.ts
@@ -39,7 +39,7 @@ import { IEvent, IEventLogger, SAVED_OBJECT_REL_PRIMARY } from '../../../event_l
 import { isAlertSavedObjectNotFoundError } from '../lib/is_alert_not_found_error';
 import { AlertsClient } from '../alerts_client';
 import { partiallyUpdateAlert } from '../saved_objects';
-import { RecoveredActionGroup } from '../../common';
+import { ResolvedActionGroup } from '../../common';
 
 const FALLBACK_RETRY_INTERVAL = '5m';
 
@@ -219,7 +219,7 @@ export class TaskRunner {
       alertInstance.hasScheduledActions()
     );
 
-    generateNewAndRecoveredInstanceEvents({
+    generateNewAndResolvedInstanceEvents({
       eventLogger,
       originalAlertInstances,
       currentAlertInstances: instancesWithScheduledActions,
@@ -229,7 +229,7 @@ export class TaskRunner {
     });
 
     if (!muteAll) {
-      scheduleActionsForRecoveredInstances(
+      scheduleActionsForResolvedInstances(
         alertInstances,
         executionHandler,
         originalAlertInstances,
@@ -436,7 +436,7 @@ export class TaskRunner {
   }
 }
 
-interface GenerateNewAndRecoveredInstanceEventsParams {
+interface GenerateNewAndResolvedInstanceEventsParams {
   eventLogger: IEventLogger;
   originalAlertInstances: Dictionary<AlertInstance>;
   currentAlertInstances: Dictionary<AlertInstance>;
@@ -445,20 +445,18 @@ interface GenerateNewAndRecoveredInstanceEventsParams {
   namespace: string | undefined;
 }
 
-function generateNewAndRecoveredInstanceEvents(
-  params: GenerateNewAndRecoveredInstanceEventsParams
-) {
+function generateNewAndResolvedInstanceEvents(params: GenerateNewAndResolvedInstanceEventsParams) {
   const { eventLogger, alertId, namespace, currentAlertInstances, originalAlertInstances } = params;
   const originalAlertInstanceIds = Object.keys(originalAlertInstances);
   const currentAlertInstanceIds = Object.keys(currentAlertInstances);
 
   const newIds = without(currentAlertInstanceIds, ...originalAlertInstanceIds);
-  const recoveredIds = without(originalAlertInstanceIds, ...currentAlertInstanceIds);
+  const resolvedIds = without(originalAlertInstanceIds, ...currentAlertInstanceIds);
 
-  for (const id of recoveredIds) {
+  for (const id of resolvedIds) {
     const actionGroup = originalAlertInstances[id].getLastScheduledActions()?.group;
-    const message = `${params.alertLabel} instance '${id}' has recovered`;
-    logInstanceEvent(id, EVENT_LOG_ACTIONS.recoveredInstance, message, actionGroup);
+    const message = `${params.alertLabel} resolved instance: '${id}'`;
+    logInstanceEvent(id, EVENT_LOG_ACTIONS.resolvedInstance, message, actionGroup);
   }
 
   for (const id of newIds) {
@@ -498,7 +496,7 @@ function generateNewAndRecoveredInstanceEvents(
   }
 }
 
-function scheduleActionsForRecoveredInstances(
+function scheduleActionsForResolvedInstances(
   alertInstancesMap: Record<string, AlertInstance>,
   executionHandler: ReturnType<typeof createExecutionHandler>,
   originalAlertInstances: Record<string, AlertInstance>,
@@ -507,22 +505,22 @@ function scheduleActionsForRecoveredInstances(
 ) {
   const currentAlertInstanceIds = Object.keys(currentAlertInstances);
   const originalAlertInstanceIds = Object.keys(originalAlertInstances);
-  const recoveredIds = without(
+  const resolvedIds = without(
     originalAlertInstanceIds,
     ...currentAlertInstanceIds,
     ...mutedInstanceIds
   );
-  for (const id of recoveredIds) {
+  for (const id of resolvedIds) {
     const instance = alertInstancesMap[id];
-    instance.updateLastScheduledActions(RecoveredActionGroup.id);
+    instance.updateLastScheduledActions(ResolvedActionGroup.id);
     instance.unscheduleActions();
     executionHandler({
-      actionGroup: RecoveredActionGroup.id,
+      actionGroup: ResolvedActionGroup.id,
       context: {},
       state: {},
       alertInstanceId: id,
     });
-    instance.scheduleActions(RecoveredActionGroup.id);
+    instance.scheduleActions(ResolvedActionGroup.id);
   }
 }
 
diff --git a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
index 1941ec6326ddb..14785f64cffac 100644
--- a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
@@ -9,7 +9,7 @@ import moment from 'moment';
 import { getCustomMetricLabel } from '../../../../common/formatters/get_custom_metric_label';
 import { toMetricOpt } from '../../../../common/snapshot_metric_i18n';
 import { AlertStates, InventoryMetricConditions } from './types';
-import { RecoveredActionGroup } from '../../../../../alerts/common';
+import { ResolvedActionGroup } from '../../../../../alerts/common';
 import { AlertExecutorOptions } from '../../../../../alerts/server';
 import { InventoryItemType, SnapshotMetricType } from '../../../../common/inventory_models/types';
 import { InfraBackendLibs } from '../../infra_types';
@@ -103,7 +103,7 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
     }
     if (reason) {
       const actionGroupId =
-        nextState === AlertStates.OK ? RecoveredActionGroup.id : FIRED_ACTIONS.id;
+        nextState === AlertStates.OK ? ResolvedActionGroup.id : FIRED_ACTIONS.id;
       alertInstance.scheduleActions(actionGroupId, {
         group: item,
         alertState: stateToAlertMessage[nextState],
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index a1d6428f3b52b..b31afba8ac9cc 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -6,7 +6,7 @@
 import { createMetricThresholdExecutor, FIRED_ACTIONS } from './metric_threshold_executor';
 import { Comparator, AlertStates } from './types';
 import * as mocks from './test_mocks';
-import { RecoveredActionGroup } from '../../../../../alerts/common';
+import { ResolvedActionGroup } from '../../../../../alerts/common';
 import { AlertExecutorOptions } from '../../../../../alerts/server';
 import {
   alertsMock,
@@ -367,7 +367,7 @@ describe('The metric threshold alert type', () => {
       expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
       expect(getState(instanceID).alertState).toBe(AlertStates.ALERT);
       await execute([2]);
-      expect(mostRecentAction(instanceID).id).toBe(RecoveredActionGroup.id);
+      expect(mostRecentAction(instanceID).id).toBe(ResolvedActionGroup.id);
       expect(getState(instanceID).alertState).toBe(AlertStates.OK);
     });
     test('does not continue to send a recovery alert if the metric is still OK', async () => {
@@ -383,7 +383,7 @@ describe('The metric threshold alert type', () => {
       expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
       expect(getState(instanceID).alertState).toBe(AlertStates.ALERT);
       await execute([2]);
-      expect(mostRecentAction(instanceID).id).toBe(RecoveredActionGroup.id);
+      expect(mostRecentAction(instanceID).id).toBe(ResolvedActionGroup.id);
       expect(getState(instanceID).alertState).toBe(AlertStates.OK);
     });
   });
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index 60790648d9a9b..7c3918c37ebbf 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -6,7 +6,7 @@
 import { first, last } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import moment from 'moment';
-import { RecoveredActionGroup } from '../../../../../alerts/common';
+import { ResolvedActionGroup } from '../../../../../alerts/common';
 import { AlertExecutorOptions } from '../../../../../alerts/server';
 import { InfraBackendLibs } from '../../infra_types';
 import {
@@ -89,7 +89,7 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
         const firstResult = first(alertResults);
         const timestamp = (firstResult && firstResult[group].timestamp) ?? moment().toISOString();
         const actionGroupId =
-          nextState === AlertStates.OK ? RecoveredActionGroup.id : FIRED_ACTIONS.id;
+          nextState === AlertStates.OK ? ResolvedActionGroup.id : FIRED_ACTIONS.id;
         alertInstance.scheduleActions(actionGroupId, {
           group,
           alertState: stateToAlertMessage[nextState],
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
index 156f65f094342..7af8e5ba88300 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
@@ -16,10 +16,10 @@ export const routeToConnectors = `/connectors`;
 export const routeToAlerts = `/alerts`;
 export const routeToAlertDetails = `/alert/:alertId`;
 
-export const recoveredActionGroupMessage = i18n.translate(
-  'xpack.triggersActionsUI.sections.actionForm.RecoveredMessage',
+export const resolvedActionGroupMessage = i18n.translate(
+  'xpack.triggersActionsUI.sections.actionForm.ResolvedMessage',
   {
-    defaultMessage: 'Recovered',
+    defaultMessage: 'Resolved',
   }
 );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.test.tsx
index ddbf933078043..5b56720737b7e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.test.tsx
@@ -10,9 +10,8 @@ import { act } from 'react-dom/test-utils';
 import { actionTypeRegistryMock } from '../../action_type_registry.mock';
 import { ValidationResult, Alert, AlertAction } from '../../../types';
 import ActionForm from './action_form';
-import { RecoveredActionGroup } from '../../../../../alerts/common';
+import { ResolvedActionGroup } from '../../../../../alerts/common';
 import { useKibana } from '../../../common/lib/kibana';
-import { EuiScreenReaderOnly } from '@elastic/eui';
 jest.mock('../../../common/lib/kibana');
 jest.mock('../../lib/action_connector_api', () => ({
   loadAllActions: jest.fn(),
@@ -229,7 +228,7 @@ describe('action_form', () => {
           }}
           actionGroups={[
             { id: 'default', name: 'Default' },
-            { id: 'recovered', name: 'Recovered' },
+            { id: 'resolved', name: 'Resolved' },
           ]}
           setActionGroupIdByIndex={(group: string, index: number) => {
             initialAlert.actions[index].group = group;
@@ -348,18 +347,18 @@ describe('action_form', () => {
             "value": "default",
           },
           Object {
-            "data-test-subj": "addNewActionConnectorActionGroup-0-option-recovered",
-            "inputDisplay": "Recovered",
-            "value": "recovered",
+            "data-test-subj": "addNewActionConnectorActionGroup-0-option-resolved",
+            "inputDisplay": "Resolved",
+            "value": "resolved",
           },
         ]
       `);
     });
 
-    it('renders selected Recovered action group', async () => {
+    it('renders selected Resolved action group', async () => {
       const wrapper = await setup([
         {
-          group: RecoveredActionGroup.id,
+          group: ResolvedActionGroup.id,
           id: 'test',
           actionTypeId: actionType.id,
           params: {
@@ -382,17 +381,15 @@ describe('action_form', () => {
             "value": "default",
           },
           Object {
-            "data-test-subj": "addNewActionConnectorActionGroup-0-option-recovered",
-            "inputDisplay": "Recovered",
-            "value": "recovered",
+            "data-test-subj": "addNewActionConnectorActionGroup-0-option-resolved",
+            "inputDisplay": "Resolved",
+            "value": "resolved",
           },
         ]
       `);
-
-      expect(actionGroupsSelect.first().find(EuiScreenReaderOnly).text()).toEqual(
-        'Select an option: Recovered, is selected'
+      expect(actionGroupsSelect.first().text()).toEqual(
+        'Select an option: Resolved, is selectedResolved'
       );
-      expect(actionGroupsSelect.first().find('button').first().text()).toEqual('Recovered');
     });
 
     it('renders available connectors for the selected action type', async () => {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
index fffc3bd32125e..7e38805957931 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
@@ -26,7 +26,7 @@ import {
   EuiBadge,
   EuiErrorBoundary,
 } from '@elastic/eui';
-import { AlertActionParam, RecoveredActionGroup } from '../../../../../alerts/common';
+import { AlertActionParam, ResolvedActionGroup } from '../../../../../alerts/common';
 import {
   IErrorObject,
   AlertAction,
@@ -40,7 +40,7 @@ import { checkActionFormActionTypeEnabled } from '../../lib/check_action_type_en
 import { hasSaveActionsCapability } from '../../lib/capabilities';
 import { ActionAccordionFormProps } from './action_form';
 import { transformActionVariables } from '../../lib/action_variables';
-import { recoveredActionGroupMessage } from '../../constants';
+import { resolvedActionGroupMessage } from '../../constants';
 import { useKibana } from '../../../common/lib/kibana';
 import { getDefaultsForActionParams } from '../../lib/get_defaults_for_action_params';
 
@@ -105,8 +105,8 @@ export const ActionTypeForm = ({
   useEffect(() => {
     setAvailableActionVariables(getAvailableActionVariables(messageVariables, actionItem.group));
     const res =
-      actionItem.group === RecoveredActionGroup.id
-        ? recoveredActionGroupMessage
+      actionItem.group === ResolvedActionGroup.id
+        ? resolvedActionGroupMessage
         : defaultActionMessage;
     setAvailableDefaultActionMessage(res);
     const paramsDefaults = getDefaultsForActionParams(actionItem.actionTypeId, actionItem.group);
@@ -374,7 +374,7 @@ function getAvailableActionVariables(
     return [];
   }
   const filteredActionVariables =
-    actionGroup === RecoveredActionGroup.id
+    actionGroup === ResolvedActionGroup.id
       ? { params: actionVariables.params, state: actionVariables.state }
       : actionVariables;
 
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
index bfaf8a2a4788e..b3635b9f40e27 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
@@ -17,7 +17,7 @@ export default function listAlertTypes({ getService }: FtrProviderContext) {
   const expectedNoOpType = {
     actionGroups: [
       { id: 'default', name: 'Default' },
-      { id: 'recovered', name: 'Recovered' },
+      { id: 'resolved', name: 'Resolved' },
     ],
     defaultActionGroupId: 'default',
     id: 'test.noop',
@@ -33,7 +33,7 @@ export default function listAlertTypes({ getService }: FtrProviderContext) {
   const expectedRestrictedNoOpType = {
     actionGroups: [
       { id: 'default', name: 'Default' },
-      { id: 'recovered', name: 'Recovered' },
+      { id: 'resolved', name: 'Resolved' },
     ],
     defaultActionGroupId: 'default',
     id: 'test.restricted-noop',
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_base.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_base.ts
index 8dab199271da8..64e99190e183a 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_base.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_base.ts
@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { Response as SupertestResponse } from 'supertest';
-import { RecoveredActionGroup } from '../../../../../plugins/alerts/common';
+import { ResolvedActionGroup } from '../../../../../plugins/alerts/common';
 import { Space } from '../../../common/types';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 import {
@@ -137,7 +137,7 @@ instanceStateValue: true
       await taskManagerUtils.waitForActionTaskParamsToBeCleanedUp(testStart);
     });
 
-    it('should fire actions when an alert instance is recovered', async () => {
+    it('should fire actions when an alert instance is resolved', async () => {
       const reference = alertUtils.generateReference();
 
       const { body: createdAction } = await supertestWithoutAuth
@@ -174,12 +174,12 @@ instanceStateValue: true
                 params: {},
               },
               {
-                group: RecoveredActionGroup.id,
+                group: ResolvedActionGroup.id,
                 id: indexRecordActionId,
                 params: {
                   index: ES_TEST_INDEX_NAME,
                   reference,
-                  message: 'Recovered message',
+                  message: 'Resolved message',
                 },
               },
             ],
@@ -194,10 +194,10 @@ instanceStateValue: true
         await esTestIndexTool.waitForDocs('action:test.index-record', reference)
       )[0];
 
-      expect(actionTestRecord._source.params.message).to.eql('Recovered message');
+      expect(actionTestRecord._source.params.message).to.eql('Resolved message');
     });
 
-    it('should not fire actions when an alert instance is recovered, but alert is muted', async () => {
+    it('should not fire actions when an alert instance is resolved, but alert is muted', async () => {
       const testStart = new Date();
       const reference = alertUtils.generateReference();
 
@@ -237,12 +237,12 @@ instanceStateValue: true
                 params: {},
               },
               {
-                group: RecoveredActionGroup.id,
+                group: ResolvedActionGroup.id,
                 id: indexRecordActionId,
                 params: {
                   index: ES_TEST_INDEX_NAME,
                   reference,
-                  message: 'Recovered message',
+                  message: 'Resolved message',
                 },
               },
             ],
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
index 3766785680925..d3cd3db124ecd 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
@@ -78,7 +78,7 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
             'execute-action',
             'new-instance',
             'active-instance',
-            'recovered-instance',
+            'resolved-instance',
           ],
         });
       });
@@ -87,25 +87,25 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
       const executeEvents = getEventsByAction(events, 'execute');
       const executeActionEvents = getEventsByAction(events, 'execute-action');
       const newInstanceEvents = getEventsByAction(events, 'new-instance');
-      const recoveredInstanceEvents = getEventsByAction(events, 'recovered-instance');
+      const resolvedInstanceEvents = getEventsByAction(events, 'resolved-instance');
 
       expect(executeEvents.length >= 4).to.be(true);
       expect(executeActionEvents.length).to.be(2);
       expect(newInstanceEvents.length).to.be(1);
-      expect(recoveredInstanceEvents.length).to.be(1);
+      expect(resolvedInstanceEvents.length).to.be(1);
 
       // make sure the events are in the right temporal order
       const executeTimes = getTimestamps(executeEvents);
       const executeActionTimes = getTimestamps(executeActionEvents);
       const newInstanceTimes = getTimestamps(newInstanceEvents);
-      const recoveredInstanceTimes = getTimestamps(recoveredInstanceEvents);
+      const resolvedInstanceTimes = getTimestamps(resolvedInstanceEvents);
 
       expect(executeTimes[0] < newInstanceTimes[0]).to.be(true);
       expect(executeTimes[1] <= newInstanceTimes[0]).to.be(true);
       expect(executeTimes[2] > newInstanceTimes[0]).to.be(true);
       expect(executeTimes[1] <= executeActionTimes[0]).to.be(true);
       expect(executeTimes[2] > executeActionTimes[0]).to.be(true);
-      expect(recoveredInstanceTimes[0] > newInstanceTimes[0]).to.be(true);
+      expect(resolvedInstanceTimes[0] > newInstanceTimes[0]).to.be(true);
 
       // validate each event
       let executeCount = 0;
@@ -136,8 +136,8 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
           case 'new-instance':
             validateInstanceEvent(event, `created new instance: 'instance'`);
             break;
-          case 'recovered-instance':
-            validateInstanceEvent(event, `recovered instance: 'instance'`);
+          case 'resolved-instance':
+            validateInstanceEvent(event, `resolved instance: 'instance'`);
             break;
           case 'active-instance':
             validateInstanceEvent(event, `active instance: 'instance' in actionGroup: 'default'`);
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_instance_summary.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_instance_summary.ts
index 404c6020fa237..22034328e5275 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_instance_summary.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_instance_summary.ts
@@ -216,7 +216,7 @@ export default function createGetAlertInstanceSummaryTests({ getService }: FtrPr
 
       await alertUtils.muteInstance(createdAlert.id, 'instanceC');
       await alertUtils.muteInstance(createdAlert.id, 'instanceD');
-      await waitForEvents(createdAlert.id, ['new-instance', 'recovered-instance']);
+      await waitForEvents(createdAlert.id, ['new-instance', 'resolved-instance']);
       const response = await supertest.get(
         `${getUrlPrefix(Spaces.space1.id)}/api/alerts/alert/${createdAlert.id}/_instance_summary`
       );
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
index 9d38f4abb7f3f..3fb2cc40437d8 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
@@ -25,7 +25,7 @@ export default function listAlertTypes({ getService }: FtrProviderContext) {
       expect(fixtureAlertType).to.eql({
         actionGroups: [
           { id: 'default', name: 'Default' },
-          { id: 'recovered', name: 'Recovered' },
+          { id: 'resolved', name: 'Resolved' },
         ],
         defaultActionGroupId: 'default',
         id: 'test.noop',

From 6e80d9fe09e82c59853a18146dcc96b684bbd22c Mon Sep 17 00:00:00 2001
From: "Devin W. Hurley" <devin.hurley@elastic.co>
Date: Tue, 1 Dec 2020 10:15:51 -0500
Subject: [PATCH 05/28] [Security Solution] [Detections] Create a 'partial
 failure' status for rules (#84293)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../schemas/common/schemas.ts                 |  7 ++++-
 .../components/rules/rule_status/helpers.ts   |  2 +-
 .../detection_engine/rules/types.ts           | 11 +++++++-
 .../detection_engine/rules/details/index.tsx  | 27 ++++++++++++++-----
 .../details/status_failed_callout.test.tsx    |  7 +++++
 .../rules/details/status_failed_callout.tsx   |  8 ++++--
 .../rules/details/translations.ts             |  7 +++++
 .../signals/rule_status_service.mock.ts       |  2 ++
 .../signals/rule_status_service.test.ts       | 15 +++++++++++
 .../signals/rule_status_service.ts            | 20 ++++++++++++++
 10 files changed, 95 insertions(+), 11 deletions(-)

diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
index 82b803c62a940..ff76a0fcb5593 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
@@ -320,7 +320,12 @@ export type SeverityMappingOrUndefined = t.TypeOf<typeof severityMappingOrUndefi
 export const status = t.keyof({ open: null, closed: null, 'in-progress': null });
 export type Status = t.TypeOf<typeof status>;
 
-export const job_status = t.keyof({ succeeded: null, failed: null, 'going to run': null });
+export const job_status = t.keyof({
+  succeeded: null,
+  failed: null,
+  'going to run': null,
+  'partial failure': null,
+});
 export type JobStatus = t.TypeOf<typeof job_status>;
 
 export const conflicts = t.keyof({ abort: null, proceed: null });
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/rule_status/helpers.ts b/x-pack/plugins/security_solution/public/detections/components/rules/rule_status/helpers.ts
index e99894afeb63c..e6482577f89ed 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/rule_status/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/rule_status/helpers.ts
@@ -13,6 +13,6 @@ export const getStatusColor = (status: RuleStatusType | string | null) =>
     ? 'success'
     : status === 'failed'
     ? 'danger'
-    : status === 'executing' || status === 'going to run'
+    : status === 'executing' || status === 'going to run' || status === 'partial failure'
     ? 'warning'
     : 'subdued';
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
index e9c89130736c0..d7908a6780ebb 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
@@ -70,6 +70,13 @@ const MetaRule = t.intersection([
   }),
 ]);
 
+const StatusTypes = t.union([
+  t.literal('succeeded'),
+  t.literal('failed'),
+  t.literal('going to run'),
+  t.literal('partial failure'),
+]);
+
 export const RuleSchema = t.intersection([
   t.type({
     author,
@@ -108,13 +115,15 @@ export const RuleSchema = t.intersection([
     license,
     last_failure_at: t.string,
     last_failure_message: t.string,
+    last_success_message: t.string,
+    last_success_at: t.string,
     meta: MetaRule,
     machine_learning_job_id: t.string,
     output_index: t.string,
     query: t.string,
     rule_name_override,
     saved_id: t.string,
-    status: t.string,
+    status: StatusTypes,
     status_date: t.string,
     threshold,
     threat_query,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index ba676835d60f1..4866824f882cf 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -275,18 +275,33 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
     ),
     [ruleDetailTabs, ruleDetailTab, setRuleDetailTab]
   );
-  const ruleError = useMemo(
-    () =>
+  const ruleError = useMemo(() => {
+    if (
       rule?.status === 'failed' &&
       ruleDetailTab === RuleDetailTabs.alerts &&
-      rule?.last_failure_at != null ? (
+      rule?.last_failure_at != null
+    ) {
+      return (
         <RuleStatusFailedCallOut
           message={rule?.last_failure_message ?? ''}
           date={rule?.last_failure_at}
         />
-      ) : null,
-    [rule, ruleDetailTab]
-  );
+      );
+    } else if (
+      rule?.status === 'partial failure' &&
+      ruleDetailTab === RuleDetailTabs.alerts &&
+      rule?.last_success_at != null
+    ) {
+      return (
+        <RuleStatusFailedCallOut
+          message={rule?.last_success_message ?? ''}
+          date={rule?.last_success_at}
+          color="warning"
+        />
+      );
+    }
+    return null;
+  }, [rule, ruleDetailTab]);
 
   const updateDateRangeCallback = useCallback<UpdateDateRange>(
     ({ x }) => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/status_failed_callout.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/status_failed_callout.test.tsx
index 3394b0fc8c5c0..c743623402063 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/status_failed_callout.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/status_failed_callout.test.tsx
@@ -13,6 +13,13 @@ describe('RuleStatusFailedCallOut', () => {
   it('renders correctly', () => {
     const wrapper = shallow(<RuleStatusFailedCallOut date="date" message="message" />);
 
+    expect(wrapper.find('EuiCallOut')).toHaveLength(1);
+  });
+  it('renders correctly with optional params', () => {
+    const wrapper = shallow(
+      <RuleStatusFailedCallOut date="date" message="message" color="warning" />
+    );
+
     expect(wrapper.find('EuiCallOut')).toHaveLength(1);
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/status_failed_callout.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/status_failed_callout.tsx
index 5b5b96ace8670..121ff6b8686c3 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/status_failed_callout.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/status_failed_callout.tsx
@@ -13,22 +13,26 @@ import * as i18n from './translations';
 interface RuleStatusFailedCallOutComponentProps {
   date: string;
   message: string;
+  color?: 'danger' | 'primary' | 'success' | 'warning';
 }
 
 const RuleStatusFailedCallOutComponent: React.FC<RuleStatusFailedCallOutComponentProps> = ({
   date,
   message,
+  color,
 }) => (
   <EuiCallOut
     title={
       <EuiFlexGroup gutterSize="xs" alignItems="center" justifyContent="flexStart">
-        <EuiFlexItem grow={false}>{i18n.ERROR_CALLOUT_TITLE}</EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          {color === 'warning' ? i18n.PARTIAL_FAILURE_CALLOUT_TITLE : i18n.ERROR_CALLOUT_TITLE}
+        </EuiFlexItem>
         <EuiFlexItem grow={true}>
           <FormattedDate value={date} fieldName="last_failure_at" />
         </EuiFlexItem>
       </EuiFlexGroup>
     }
-    color="danger"
+    color={color ? color : 'danger'}
     iconType="alert"
   >
     <p>{message}</p>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/translations.ts
index 94dfdc3e9daa0..5fbe0a5b78671 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/translations.ts
@@ -48,6 +48,13 @@ export const ERROR_CALLOUT_TITLE = i18n.translate(
   }
 );
 
+export const PARTIAL_FAILURE_CALLOUT_TITLE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.ruleDetails.partialErrorCalloutTitle',
+  {
+    defaultMessage: 'Partial rule failure at',
+  }
+);
+
 export const FAILURE_HISTORY_TAB = i18n.translate(
   'xpack.securitySolution.detectionEngine.ruleDetails.failureHistoryTab',
   {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.mock.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.mock.ts
index 1d6a8227ebc13..f7b1790e127d9 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.mock.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.mock.ts
@@ -22,6 +22,8 @@ export const ruleStatusServiceFactoryMock = async ({
 
     success: jest.fn(),
 
+    partialFailure: jest.fn(),
+
     error: jest.fn(),
   };
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.test.ts
index cde6a506c657d..449ecd11257d7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.test.ts
@@ -53,6 +53,21 @@ describe('buildRuleStatusAttributes', () => {
     expect(result.statusDate).toEqual(result.lastSuccessAt);
   });
 
+  it('returns partial failure fields if "partial failure"', () => {
+    const result = buildRuleStatusAttributes(
+      'partial failure',
+      'some indices missing timestamp override field'
+    );
+    expect(result).toEqual({
+      status: 'partial failure',
+      statusDate: expectIsoDateString,
+      lastSuccessAt: expectIsoDateString,
+      lastSuccessMessage: 'some indices missing timestamp override field',
+    });
+
+    expect(result.statusDate).toEqual(result.lastSuccessAt);
+  });
+
   it('returns failure fields if "failed"', () => {
     const result = buildRuleStatusAttributes('failed', 'failure message');
     expect(result).toEqual({
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.ts
index 433ad4e2affea..debc329bf40d7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.ts
@@ -23,6 +23,7 @@ interface Attributes {
 export interface RuleStatusService {
   goingToRun: () => Promise<void>;
   success: (message: string, attributes?: Attributes) => Promise<void>;
+  partialFailure: (message: string, attributes?: Attributes) => Promise<void>;
   error: (message: string, attributes?: Attributes) => Promise<void>;
 }
 
@@ -46,6 +47,13 @@ export const buildRuleStatusAttributes: (
         lastSuccessMessage: message,
       };
     }
+    case 'partial failure': {
+      return {
+        ...baseAttributes,
+        lastSuccessAt: now,
+        lastSuccessMessage: message,
+      };
+    }
     case 'failed': {
       return {
         ...baseAttributes,
@@ -93,6 +101,18 @@ export const ruleStatusServiceFactory = async ({
       });
     },
 
+    partialFailure: async (message, attributes) => {
+      const [currentStatus] = await getOrCreateRuleStatuses({
+        alertId,
+        ruleStatusClient,
+      });
+
+      await ruleStatusClient.update(currentStatus.id, {
+        ...currentStatus.attributes,
+        ...buildRuleStatusAttributes('partial failure', message, attributes),
+      });
+    },
+
     error: async (message, attributes) => {
       const ruleStatuses = await getOrCreateRuleStatuses({
         alertId,

From a65c12ffa2604ea625c0cc9944314b80ca63d48c Mon Sep 17 00:00:00 2001
From: Joe Portner <5295965+jportner@users.noreply.github.com>
Date: Tue, 1 Dec 2020 11:01:06 -0500
Subject: [PATCH 06/28] Fix flaky test suite (#84602)

---
 test/api_integration/apis/saved_objects/migrations.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/test/api_integration/apis/saved_objects/migrations.ts b/test/api_integration/apis/saved_objects/migrations.ts
index b5fa16558514a..fa9c2fd1a2d7f 100644
--- a/test/api_integration/apis/saved_objects/migrations.ts
+++ b/test/api_integration/apis/saved_objects/migrations.ts
@@ -54,8 +54,7 @@ function getLogMock() {
 export default ({ getService }: FtrProviderContext) => {
   const esClient = getService('es');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/84445
-  describe.skip('Kibana index migration', () => {
+  describe('Kibana index migration', () => {
     before(() => esClient.indices.delete({ index: '.migrate-*' }));
 
     it('Migrates an existing index that has never been migrated before', async () => {
@@ -313,7 +312,10 @@ export default ({ getService }: FtrProviderContext) => {
         result
           // @ts-expect-error destIndex exists only on MigrationResult status: 'migrated';
           .map(({ status, destIndex }) => ({ status, destIndex }))
-          .sort((a) => (a.destIndex ? 0 : 1))
+          .sort(({ destIndex: a }, { destIndex: b }) =>
+            // sort by destIndex in ascending order, keeping falsy values at the end
+            (a && !b) || a < b ? -1 : (!a && b) || a > b ? 1 : 0
+          )
       ).to.eql([
         { status: 'migrated', destIndex: '.migration-c_2' },
         { status: 'skipped', destIndex: undefined },

From 636f91c29a5585ddf17bdb232eb561a554f37c03 Mon Sep 17 00:00:00 2001
From: Christos Nasikas <christos.nasikas@elastic.co>
Date: Tue, 1 Dec 2020 18:01:37 +0200
Subject: [PATCH 07/28] [Security Solution][Detections] Fix labels and issue
 with mandatory fields (#84525)

* Fix labeling and bugs

* Improve naming
---
 x-pack/plugins/translations/translations/ja-JP.json       | 1 -
 x-pack/plugins/translations/translations/zh-CN.json       | 1 -
 .../components/builtin_action_types/jira/jira.test.tsx    | 2 +-
 .../components/builtin_action_types/jira/jira.tsx         | 4 ++--
 .../components/builtin_action_types/jira/translations.ts  | 6 +++---
 .../builtin_action_types/resilient/resilient.test.tsx     | 2 +-
 .../builtin_action_types/resilient/resilient.tsx          | 5 +++--
 .../builtin_action_types/resilient/translations.ts        | 8 ++++----
 .../builtin_action_types/servicenow/servicenow.test.tsx   | 2 +-
 .../builtin_action_types/servicenow/servicenow.tsx        | 2 +-
 .../builtin_action_types/servicenow/translations.ts       | 2 +-
 11 files changed, 17 insertions(+), 18 deletions(-)

diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 490bf56d76062..4991c4d16099c 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -19600,7 +19600,6 @@
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredDescriptionTextField": "説明が必要です。",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredEmailTextField": "電子メールアドレスまたはユーザー名が必要です",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredProjectKeyTextField": "プロジェクトキーが必要です",
-    "xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredTitleTextField": "タイトルが必要です。",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.savedObjectIdFieldHelp": "JIRAは、このアクションを、Kibanaの保存されたオブジェクトのIDに関連付けます。",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.savedObjectIdFieldLabel": "オブジェクトID（任意）",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.searchIssuesComboBoxAriaLabel": "親問題を選択",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 15699c3f47dd5..59ab890cfd9db 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -19619,7 +19619,6 @@
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredDescriptionTextField": "“描述”必填。",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredEmailTextField": "“电子邮件”或“用户名”必填",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredProjectKeyTextField": "“项目键”必填",
-    "xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredTitleTextField": "“标题”必填。",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.savedObjectIdFieldHelp": "JIRA 将此操作与 Kibana 已保存对象的 ID 关联。",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.savedObjectIdFieldLabel": "对象 ID（可选）",
     "xpack.triggersActionsUI.components.builtinActionTypes.jira.searchIssuesComboBoxAriaLabel": "选择父问题",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/jira.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/jira.test.tsx
index f476522c2bf5a..b10341fa00f1b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/jira.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/jira.test.tsx
@@ -93,7 +93,7 @@ describe('jira action params validation', () => {
 
     expect(actionTypeModel.validateParams(actionParams)).toEqual({
       errors: {
-        title: ['Title is required.'],
+        title: ['Summary is required.'],
       },
     });
   });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/jira.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/jira.tsx
index 81f0bbfe8a02f..20374cfbe3a3b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/jira.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/jira.tsx
@@ -64,8 +64,8 @@ export function getActionType(): ActionTypeModel<JiraConfig, JiraSecrets, JiraAc
         title: new Array<string>(),
       };
       validationResult.errors = errors;
-      if (actionParams.subActionParams && !actionParams.subActionParams.title?.length) {
-        errors.title.push(i18n.TITLE_REQUIRED);
+      if (!actionParams.subActionParams?.title?.length) {
+        errors.title.push(i18n.SUMMARY_REQUIRED);
       }
       return validationResult;
     },
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/translations.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/translations.ts
index 6f45316ff4433..c9642da9ba440 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/translations.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/translations.ts
@@ -127,10 +127,10 @@ export const DESCRIPTION_REQUIRED = i18n.translate(
   }
 );
 
-export const TITLE_REQUIRED = i18n.translate(
-  'xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredTitleTextField',
+export const SUMMARY_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.jira.requiredSummaryTextField',
   {
-    defaultMessage: 'Title is required.',
+    defaultMessage: 'Summary is required.',
   }
 );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.test.tsx
index 937fe61e887ea..17e9b42e7878e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.test.tsx
@@ -93,7 +93,7 @@ describe('resilient action params validation', () => {
 
     expect(actionTypeModel.validateParams(actionParams)).toEqual({
       errors: {
-        title: ['Title is required.'],
+        title: ['Name is required.'],
       },
     });
   });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.tsx
index 6d57fc98fe20f..251274a08ba6c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.tsx
@@ -72,8 +72,9 @@ export function getActionType(): ActionTypeModel<
         title: new Array<string>(),
       };
       validationResult.errors = errors;
-      if (actionParams.subActionParams && !actionParams.subActionParams.title?.length) {
-        errors.title.push(i18n.TITLE_REQUIRED);
+
+      if (!actionParams.subActionParams?.title?.length) {
+        errors.title.push(i18n.NAME_REQUIRED);
       }
       return validationResult;
     },
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/translations.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/translations.ts
index 65d08c9f7de68..7483ba2f461df 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/translations.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/translations.ts
@@ -134,16 +134,16 @@ export const MAPPING_FIELD_COMMENTS = i18n.translate(
 );
 
 export const DESCRIPTION_REQUIRED = i18n.translate(
-  'xpack.triggersActionsUI.components.builtinActionTypes.common.requiredDescriptionTextField',
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.requiredDescriptionTextField',
   {
     defaultMessage: 'Description is required.',
   }
 );
 
-export const TITLE_REQUIRED = i18n.translate(
-  'xpack.triggersActionsUI.components.builtinActionTypes.common.requiredTitleTextField',
+export const NAME_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.requiredNameTextField',
   {
-    defaultMessage: 'Title is required.',
+    defaultMessage: 'Name is required.',
   }
 );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.test.tsx
index 5e70bc20f5c51..c29ddbf385de6 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.test.tsx
@@ -90,7 +90,7 @@ describe('servicenow action params validation', () => {
 
     expect(actionTypeModel.validateParams(actionParams)).toEqual({
       errors: {
-        title: ['Title is required.'],
+        title: ['Short description is required.'],
       },
     });
   });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.tsx
index 9cc689d8f48b1..8eca7f3ef3120 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow.tsx
@@ -67,7 +67,7 @@ export function getActionType(): ActionTypeModel<
         title: new Array<string>(),
       };
       validationResult.errors = errors;
-      if (actionParams.subActionParams && !actionParams.subActionParams.title?.length) {
+      if (!actionParams.subActionParams?.title?.length) {
         errors.title.push(i18n.TITLE_REQUIRED);
       }
       return validationResult;
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
index 312cb9844bd75..91a5c0a54397b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/translations.ts
@@ -157,6 +157,6 @@ export const DESCRIPTION_REQUIRED = i18n.translate(
 export const TITLE_REQUIRED = i18n.translate(
   'xpack.triggersActionsUI.components.builtinActionTypes.common.requiredTitleTextField',
   {
-    defaultMessage: 'Title is required.',
+    defaultMessage: 'Short description is required.',
   }
 );

From 5420177485796793d57b6439853caa1c05513433 Mon Sep 17 00:00:00 2001
From: Olivier V <vandamo.be@gmail.com>
Date: Tue, 1 Dec 2020 17:06:19 +0100
Subject: [PATCH 08/28] Update create.asciidoc (#84046)

The url templates provided for call of the API with space information was missing the /api/ section in it.

(cherry picked from commit 35f1cc16eaa29666d7212402f57ab17858ebc96d)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 docs/api/saved-objects/create.asciidoc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/api/saved-objects/create.asciidoc b/docs/api/saved-objects/create.asciidoc
index 50809a1bd5d4e..d7a368034ef07 100644
--- a/docs/api/saved-objects/create.asciidoc
+++ b/docs/api/saved-objects/create.asciidoc
@@ -9,11 +9,13 @@ experimental[] Create {kib} saved objects.
 [[saved-objects-api-create-request]]
 ==== Request
 
-`POST <kibana host>:<port>/api/saved_objects/<type>` +
+`POST <kibana host>:<port>/api/saved_objects/<type>`
 
 `POST <kibana host>:<port>/api/saved_objects/<type>/<id>`
 
-`POST <kibana host>:<port>/s/<space_id>/saved_objects/<type>`
+`POST <kibana host>:<port>/s/<space_id>/api/saved_objects/<type>`
+
+`POST <kibana host>:<port>/s/<space_id>/api/saved_objects/<type>/<id>`
 
 [[saved-objects-api-create-path-params]]
 ==== Path parameters

From 5889e366da02a910e3bb3c5c3878e16ca661947b Mon Sep 17 00:00:00 2001
From: Walter Rafelsberger <walter@elastic.co>
Date: Tue, 1 Dec 2020 18:05:57 +0100
Subject: [PATCH 09/28] [ML] Fix unnecessary trigger of wildcard field type
 search for ML plugin routes. (#84605)

Passing in an empty string '' to useResolver() would trigger a wild card search across all indices and fields, potentially causing a timeout and the page would fail to load. The following pages were affected: Single Metric Viewer, Data frame analytics models list, Data frame analytics jobs list, Data frame analytics exploration page, File Data Visualizer (Data visualizer - Import data from a log file). This PR fixes it by passing undefined instead of '' to useResolver to avoid calling _fields_for_wildcard with an empty pattern. Jest tests were added to cover the two parameter scenarios empty string/undefined.
---
 .../jobs/new_job/utils/new_job_utils.ts       |  2 +-
 .../analytics_job_exploration.tsx             |  2 +-
 .../analytics_jobs_list.tsx                   |  2 +-
 .../data_frame_analytics/analytics_map.tsx    |  2 +-
 .../data_frame_analytics/models_list.tsx      |  2 +-
 .../routes/datavisualizer/file_based.tsx      |  2 +-
 .../routing/routes/timeseriesexplorer.tsx     |  2 +-
 .../application/routing/use_resolver.test.ts  | 89 +++++++++++++++++++
 .../application/routing/use_resolver.ts       | 76 ++++++++++------
 .../ml/public/application/util/index_utils.ts |  7 +-
 10 files changed, 150 insertions(+), 36 deletions(-)
 create mode 100644 x-pack/plugins/ml/public/application/routing/use_resolver.test.ts

diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
index b7b6aa15ffe44..543e6898193a4 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
@@ -30,7 +30,7 @@ export function getDefaultDatafeedQuery() {
 
 export function createSearchItems(
   kibanaConfig: IUiSettingsClient,
-  indexPattern: IIndexPattern,
+  indexPattern: IIndexPattern | undefined,
   savedSearch: SavedSearchSavedObject | null
 ) {
   // query is only used by the data visualizer as it needs
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
index e436ff468ccf0..771123532dcbf 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_job_exploration.tsx
@@ -38,7 +38,7 @@ export const analyticsJobExplorationRouteFactory = (
 });
 
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
-  const { context } = useResolver('', undefined, deps.config, basicResolvers(deps));
+  const { context } = useResolver(undefined, undefined, deps.config, basicResolvers(deps));
 
   const [globalState] = useUrlState('_g');
 
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
index 80706a82121d5..3b68c5078e99e 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_jobs_list.tsx
@@ -34,7 +34,7 @@ export const analyticsJobsListRouteFactory = (
 });
 
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
-  const { context } = useResolver('', undefined, deps.config, basicResolvers(deps));
+  const { context } = useResolver(undefined, undefined, deps.config, basicResolvers(deps));
   return (
     <PageLoader context={context}>
       <Page />
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_map.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_map.tsx
index 18002648cfaa6..3acd12402932f 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_map.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/analytics_map.tsx
@@ -34,7 +34,7 @@ export const analyticsMapRouteFactory = (
 });
 
 const PageWrapper: FC<PageProps> = ({ deps }) => {
-  const { context } = useResolver('', undefined, deps.config, basicResolvers(deps));
+  const { context } = useResolver(undefined, undefined, deps.config, basicResolvers(deps));
 
   return (
     <PageLoader context={context}>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/models_list.tsx b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/models_list.tsx
index b1fd6e93a744c..2f58ef756e51c 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/models_list.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/data_frame_analytics/models_list.tsx
@@ -34,7 +34,7 @@ export const modelsListRouteFactory = (
 });
 
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
-  const { context } = useResolver('', undefined, deps.config, basicResolvers(deps));
+  const { context } = useResolver(undefined, undefined, deps.config, basicResolvers(deps));
   return (
     <PageLoader context={context}>
       <Page />
diff --git a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
index 837616a8a76d2..f651d17e02de4 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/datavisualizer/file_based.tsx
@@ -45,7 +45,7 @@ export const fileBasedRouteFactory = (
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
   const { redirectToMlAccessDeniedPage } = deps;
 
-  const { context } = useResolver('', undefined, deps.config, {
+  const { context } = useResolver(undefined, undefined, deps.config, {
     checkBasicLicense,
     loadIndexPatterns: () => loadIndexPatterns(deps.indexPatterns),
     checkFindFileStructurePrivilege: () =>
diff --git a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
index df92c77252565..7de59cba495af 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/timeseriesexplorer.tsx
@@ -63,7 +63,7 @@ export const timeSeriesExplorerRouteFactory = (
 });
 
 const PageWrapper: FC<PageProps> = ({ deps }) => {
-  const { context, results } = useResolver('', undefined, deps.config, {
+  const { context, results } = useResolver(undefined, undefined, deps.config, {
     ...basicResolvers(deps),
     jobs: mlJobService.loadJobsWrapper,
     jobsWithTimeRange: () => ml.jobs.jobsWithTimerange(getDateFormatTz()),
diff --git a/x-pack/plugins/ml/public/application/routing/use_resolver.test.ts b/x-pack/plugins/ml/public/application/routing/use_resolver.test.ts
new file mode 100644
index 0000000000000..07cc038538745
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/routing/use_resolver.test.ts
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { renderHook, act } from '@testing-library/react-hooks';
+
+import { IUiSettingsClient } from 'kibana/public';
+
+import { useCreateAndNavigateToMlLink } from '../contexts/kibana/use_create_url';
+import { useNotifications } from '../contexts/kibana';
+
+import { useResolver } from './use_resolver';
+
+jest.mock('../contexts/kibana/use_create_url', () => {
+  return {
+    useCreateAndNavigateToMlLink: jest.fn(),
+  };
+});
+
+jest.mock('../contexts/kibana', () => {
+  return {
+    useMlUrlGenerator: () => ({
+      createUrl: jest.fn(),
+    }),
+    useNavigateToPath: () => jest.fn(),
+    useNotifications: jest.fn(),
+  };
+});
+
+const addError = jest.fn();
+(useNotifications as jest.Mock).mockImplementation(() => ({
+  toasts: { addSuccess: jest.fn(), addDanger: jest.fn(), addError },
+}));
+
+const redirectToJobsManagementPage = jest.fn(() => Promise.resolve());
+(useCreateAndNavigateToMlLink as jest.Mock).mockImplementation(() => redirectToJobsManagementPage);
+
+describe('useResolver', () => {
+  afterEach(() => {
+    jest.useFakeTimers();
+  });
+  afterEach(() => {
+    jest.advanceTimersByTime(0);
+    jest.useRealTimers();
+  });
+
+  it('should accept undefined as indexPatternId and savedSearchId.', async () => {
+    const { result, waitForNextUpdate } = renderHook(() =>
+      useResolver(undefined, undefined, {} as IUiSettingsClient, {})
+    );
+
+    await act(async () => {
+      await waitForNextUpdate();
+    });
+
+    expect(result.current).toStrictEqual({
+      context: {
+        combinedQuery: {
+          bool: {
+            must: [
+              {
+                match_all: {},
+              },
+            ],
+          },
+        },
+        currentIndexPattern: null,
+        currentSavedSearch: null,
+        indexPatterns: null,
+        kibanaConfig: {},
+      },
+      results: {},
+    });
+    expect(addError).toHaveBeenCalledTimes(0);
+    expect(redirectToJobsManagementPage).toHaveBeenCalledTimes(0);
+  });
+
+  it('should add an error toast and redirect if indexPatternId is an empty string.', async () => {
+    const { result } = renderHook(() => useResolver('', undefined, {} as IUiSettingsClient, {}));
+
+    await act(async () => {});
+
+    expect(result.current).toStrictEqual({ context: null, results: {} });
+    expect(addError).toHaveBeenCalledTimes(1);
+    expect(redirectToJobsManagementPage).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/x-pack/plugins/ml/public/application/routing/use_resolver.ts b/x-pack/plugins/ml/public/application/routing/use_resolver.ts
index e4cd90145bee4..3ce23f8b8a19c 100644
--- a/x-pack/plugins/ml/public/application/routing/use_resolver.ts
+++ b/x-pack/plugins/ml/public/application/routing/use_resolver.ts
@@ -11,6 +11,7 @@ import {
   getIndexPatternById,
   getIndexPatternsContract,
   getIndexPatternAndSavedSearch,
+  IndexPatternAndSavedSearch,
 } from '../util/index_utils';
 import { createSearchItems } from '../jobs/new_job/utils/new_job_utils';
 import { ResolverResults, Resolvers } from './resolvers';
@@ -19,6 +20,14 @@ import { useNotifications } from '../contexts/kibana';
 import { useCreateAndNavigateToMlLink } from '../contexts/kibana/use_create_url';
 import { ML_PAGES } from '../../../common/constants/ml_url_generator';
 
+/**
+ * Hook to resolve route specific requirements
+ * @param indexPatternId optional Kibana index pattern id, used for wizards
+ * @param savedSearchId optional Kibana saved search id, used for wizards
+ * @param config Kibana UI Settings
+ * @param resolvers an array of resolvers to be executed for the route
+ * @return { context, results } returns the ML context and resolver results
+ */
 export const useResolver = (
   indexPatternId: string | undefined,
   savedSearchId: string | undefined,
@@ -52,36 +61,49 @@ export const useResolver = (
         return;
       }
 
-      if (indexPatternId !== undefined || savedSearchId !== undefined) {
-        try {
-          // note, currently we're using our own kibana context that requires a current index pattern to be set
-          // this means, if the page uses this context, useResolver must be passed a string for the index pattern id
-          // and loadIndexPatterns must be part of the resolvers.
-          const { indexPattern, savedSearch } =
-            savedSearchId !== undefined
-              ? await getIndexPatternAndSavedSearch(savedSearchId)
-              : { savedSearch: null, indexPattern: await getIndexPatternById(indexPatternId!) };
+      try {
+        if (indexPatternId === '') {
+          throw new Error(
+            i18n.translate('xpack.ml.useResolver.errorIndexPatternIdEmptyString', {
+              defaultMessage: 'indexPatternId must not be empty string.',
+            })
+          );
+        }
 
-          const { combinedQuery } = createSearchItems(config, indexPattern!, savedSearch);
+        let indexPatternAndSavedSearch: IndexPatternAndSavedSearch = {
+          savedSearch: null,
+          indexPattern: null,
+        };
 
-          setContext({
-            combinedQuery,
-            currentIndexPattern: indexPattern,
-            currentSavedSearch: savedSearch,
-            indexPatterns: getIndexPatternsContract()!,
-            kibanaConfig: config,
-          });
-        } catch (error) {
-          // an unexpected error has occurred. This could be caused by an incorrect index pattern or saved search ID
-          notifications.toasts.addError(new Error(error), {
-            title: i18n.translate('xpack.ml.useResolver.errorTitle', {
-              defaultMessage: 'An error has occurred',
-            }),
-          });
-          await redirectToJobsManagementPage();
+        if (savedSearchId !== undefined) {
+          indexPatternAndSavedSearch = await getIndexPatternAndSavedSearch(savedSearchId);
+        } else if (indexPatternId !== undefined) {
+          indexPatternAndSavedSearch.indexPattern = await getIndexPatternById(indexPatternId);
         }
-      } else {
-        setContext({});
+
+        const { savedSearch, indexPattern } = indexPatternAndSavedSearch;
+
+        const { combinedQuery } = createSearchItems(
+          config,
+          indexPattern !== null ? indexPattern : undefined,
+          savedSearch
+        );
+
+        setContext({
+          combinedQuery,
+          currentIndexPattern: indexPattern,
+          currentSavedSearch: savedSearch,
+          indexPatterns: getIndexPatternsContract(),
+          kibanaConfig: config,
+        });
+      } catch (error) {
+        // an unexpected error has occurred. This could be caused by an incorrect index pattern or saved search ID
+        notifications.toasts.addError(new Error(error), {
+          title: i18n.translate('xpack.ml.useResolver.errorTitle', {
+            defaultMessage: 'An error has occurred',
+          }),
+        });
+        await redirectToJobsManagementPage();
       }
     })();
   }, []);
diff --git a/x-pack/plugins/ml/public/application/util/index_utils.ts b/x-pack/plugins/ml/public/application/util/index_utils.ts
index 42be3dd8252f9..de08553af9906 100644
--- a/x-pack/plugins/ml/public/application/util/index_utils.ts
+++ b/x-pack/plugins/ml/public/application/util/index_utils.ts
@@ -73,9 +73,12 @@ export function getIndexPatternIdFromName(name: string) {
   }
   return null;
 }
-
+export interface IndexPatternAndSavedSearch {
+  savedSearch: SavedSearchSavedObject | null;
+  indexPattern: IIndexPattern | null;
+}
 export async function getIndexPatternAndSavedSearch(savedSearchId: string) {
-  const resp: { savedSearch: SavedSearchSavedObject | null; indexPattern: IIndexPattern | null } = {
+  const resp: IndexPatternAndSavedSearch = {
     savedSearch: null,
     indexPattern: null,
   };

From 3958cddca3b76f351da552639a9448bb9874a5cc Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Tue, 1 Dec 2020 10:09:20 -0700
Subject: [PATCH 10/28] Remove unscripted fields from sample data index-pattern
 saved objects (#84659)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../services/sample_data/data_sets/ecommerce/saved_objects.ts  | 3 +--
 .../services/sample_data/data_sets/flights/saved_objects.ts    | 2 +-
 .../services/sample_data/data_sets/logs/saved_objects.ts       | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/plugins/home/server/services/sample_data/data_sets/ecommerce/saved_objects.ts b/src/plugins/home/server/services/sample_data/data_sets/ecommerce/saved_objects.ts
index 37657912deb95..60d05890028d1 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/ecommerce/saved_objects.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/ecommerce/saved_objects.ts
@@ -294,8 +294,7 @@ export const getSavedObjects = (): SavedObject[] => [
     attributes: {
       title: 'kibana_sample_data_ecommerce',
       timeFieldName: 'order_date',
-      fields:
-        '[{"name":"_id","type":"string","esTypes":["_id"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"_index","type":"string","esTypes":["_index"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"_score","type":"number","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false},{"name":"_source","type":"_source","esTypes":["_source"],"count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false},{"name":"_type","type":"string","esTypes":["_type"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"category","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"category.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"category"}}},{"name":"currency","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"customer_birth_date","type":"date","esTypes":["date"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"customer_first_name","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"customer_first_name.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"customer_first_name"}}},{"name":"customer_full_name","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"customer_full_name.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"customer_full_name"}}},{"name":"customer_gender","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"customer_id","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"customer_last_name","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"customer_last_name.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"customer_last_name"}}},{"name":"customer_phone","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"day_of_week","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"day_of_week_i","type":"number","esTypes":["integer"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"email","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"event.dataset","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"geoip.city_name","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"geoip.continent_name","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"geoip.country_iso_code","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"geoip.location","type":"geo_point","esTypes":["geo_point"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"geoip.region_name","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"manufacturer","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"manufacturer.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"manufacturer"}}},{"name":"order_date","type":"date","esTypes":["date"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"order_id","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products._id","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"products._id.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"products._id"}}},{"name":"products.base_price","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.base_unit_price","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.category","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"products.category.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"products.category"}}},{"name":"products.created_on","type":"date","esTypes":["date"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.discount_amount","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.discount_percentage","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.manufacturer","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"products.manufacturer.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"products.manufacturer"}}},{"name":"products.min_price","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.price","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.product_id","type":"number","esTypes":["long"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.product_name","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"products.product_name.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent":"products.product_name"}}},{"name":"products.quantity","type":"number","esTypes":["integer"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.sku","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.tax_amount","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.taxful_price","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.taxless_price","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"products.unit_discount_amount","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"sku","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"taxful_total_price","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"taxless_total_price","type":"number","esTypes":["half_float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"total_quantity","type":"number","esTypes":["integer"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"total_unique_products","type":"number","esTypes":["integer"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"type","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"user","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true}]',
+      fields: '[]',
       fieldFormatMap: '{"taxful_total_price":{"id":"number","params":{"pattern":"$0,0.[00]"}}}',
     },
     references: [],
diff --git a/src/plugins/home/server/services/sample_data/data_sets/flights/saved_objects.ts b/src/plugins/home/server/services/sample_data/data_sets/flights/saved_objects.ts
index 6f701d75e7d52..e65b6ad40651b 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/flights/saved_objects.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/flights/saved_objects.ts
@@ -439,7 +439,7 @@ export const getSavedObjects = (): SavedObject[] => [
       title: 'kibana_sample_data_flights',
       timeFieldName: 'timestamp',
       fields:
-        '[{"name":"AvgTicketPrice","type":"number","esTypes":["float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"Cancelled","type":"boolean","esTypes":["boolean"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"Carrier","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"Dest","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"DestAirportID","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"DestCityName","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"DestCountry","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"DestLocation","type":"geo_point","esTypes":["geo_point"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"DestRegion","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"DestWeather","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"DistanceKilometers","type":"number","esTypes":["float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"DistanceMiles","type":"number","esTypes":["float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"FlightDelay","type":"boolean","esTypes":["boolean"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"FlightDelayMin","type":"number","esTypes":["integer"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"FlightDelayType","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"FlightNum","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"FlightTimeHour","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"FlightTimeMin","type":"number","esTypes":["float"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"Origin","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"OriginAirportID","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"OriginCityName","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"OriginCountry","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"OriginLocation","type":"geo_point","esTypes":["geo_point"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"OriginRegion","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"OriginWeather","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"_id","type":"string","esTypes":["_id"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"_index","type":"string","esTypes":["_index"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"_score","type":"number","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false},{"name":"_source","type":"_source","esTypes":["_source"],"count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false},{"name":"_type","type":"string","esTypes":["_type"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"dayOfWeek","type":"number","esTypes":["integer"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"timestamp","type":"date","esTypes":["date"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"hour_of_day","type":"number","count":0,"scripted":true,"script":"doc[\'timestamp\'].value.hourOfDay","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false}]',
+        '[{"name":"hour_of_day","type":"number","count":0,"scripted":true,"script":"doc[\'timestamp\'].value.hourOfDay","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false}]',
       fieldFormatMap:
         '{"hour_of_day":{"id":"number","params":{"pattern":"00"}},"AvgTicketPrice":{"id":"number","params":{"pattern":"$0,0.[00]"}}}',
     },
diff --git a/src/plugins/home/server/services/sample_data/data_sets/logs/saved_objects.ts b/src/plugins/home/server/services/sample_data/data_sets/logs/saved_objects.ts
index f8d39e6689fa8..068ba66c4b0de 100644
--- a/src/plugins/home/server/services/sample_data/data_sets/logs/saved_objects.ts
+++ b/src/plugins/home/server/services/sample_data/data_sets/logs/saved_objects.ts
@@ -270,7 +270,7 @@ export const getSavedObjects = (): SavedObject[] => [
       title: 'kibana_sample_data_logs',
       timeFieldName: 'timestamp',
       fields:
-        '[{"name":"@timestamp","type":"date","esTypes":["date"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"_id","type":"string","esTypes":["_id"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"_index","type":"string","esTypes":["_index"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"_score","type":"number","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false},{"name":"_source","type":"_source","esTypes":["_source"],"count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false},{"name":"_type","type":"string","esTypes":["_type"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"agent","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"agent.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "agent"}}},{"name":"bytes","type":"number","esTypes":["long"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"clientip","type":"ip","esTypes":["ip"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"event.dataset","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"extension","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"extension.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "extension"}}},{"name":"geo.coordinates","type":"geo_point","esTypes":["geo_point"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"geo.dest","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"geo.src","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"geo.srcdest","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"host","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"host.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "host"}}},{"name":"index","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"index.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "index"}}},{"name":"ip","type":"ip","esTypes":["ip"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"machine.os","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"machine.os.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "machine.os"}}},{"name":"machine.ram","type":"number","esTypes":["long"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"memory","type":"number","esTypes":["double"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"message","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"message.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "message"}}},{"name":"phpmemory","type":"number","esTypes":["long"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"referer","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"request","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"request.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "request"}}},{"name":"response","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"response.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "response"}}},{"name":"tags","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"tags.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "tags"}}},{"name":"timestamp","type":"date","esTypes":["date"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"url","type":"string","esTypes":["text"],"count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"url.keyword","type":"string","esTypes":["keyword"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true,"subType":{"multi":{"parent": "url"}}},{"name":"utc_time","type":"date","esTypes":["date"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"hour_of_day","type":"number","count":0,"scripted":true,"script":"doc[\'timestamp\'].value.getHour()","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false}]',
+        '[{"name":"hour_of_day","type":"number","count":0,"scripted":true,"script":"doc[\'timestamp\'].value.getHour()","lang":"painless","searchable":true,"aggregatable":true,"readFromDocValues":false}]',
       fieldFormatMap: '{"hour_of_day":{}}',
     },
     references: [],

From 68decb8352ce7fd2223dba140d7470d88867600b Mon Sep 17 00:00:00 2001
From: Mikhail Shustov <restrry@gmail.com>
Date: Tue, 1 Dec 2020 20:24:54 +0300
Subject: [PATCH 11/28] declare kbn/monaco dependency on kbn/i18n explicitly
 (#84660)

---
 packages/kbn-monaco/package.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/kbn-monaco/package.json b/packages/kbn-monaco/package.json
index e2406a73f5342..eef68d3a35e0c 100644
--- a/packages/kbn-monaco/package.json
+++ b/packages/kbn-monaco/package.json
@@ -11,5 +11,8 @@
   "devDependencies": {
     "@kbn/babel-preset": "link:../kbn-babel-preset",
     "@kbn/dev-utils": "link:../kbn-dev-utils"
+  },
+  "dependencies": {
+    "@kbn/i18n": "link:../kbn-i18n"
   }
 }
\ No newline at end of file

From 6da6db28ac9738aab65581ca1faadc08642e511b Mon Sep 17 00:00:00 2001
From: Gidi Meir Morris <github@gidi.io>
Date: Tue, 1 Dec 2020 17:30:05 +0000
Subject: [PATCH 12/28] Revert the Revert of "[Alerting] renames Resolved
 action group to Recovered (#84123)"  (#84662)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reapplies the #84123 PR:
This PR changes the default term from “Resolved” to “Recovered”, as it fits most use cases and we feel users are most likely to understand its meaning across domains.
---
 .../alerts/common/builtin_action_groups.ts    | 10 +--
 .../alerts/server/alert_type_registry.test.ts | 14 ++---
 .../tests/get_alert_instance_summary.test.ts  |  2 +-
 ...rt_instance_summary_from_event_log.test.ts | 62 ++++++++++++++++---
 .../alert_instance_summary_from_event_log.ts  |  5 +-
 x-pack/plugins/alerts/server/plugin.ts        |  5 +-
 .../server/task_runner/task_runner.test.ts    | 12 ++--
 .../alerts/server/task_runner/task_runner.ts  | 32 +++++-----
 .../inventory_metric_threshold_executor.ts    |  4 +-
 .../metric_threshold_executor.test.ts         |  6 +-
 .../metric_threshold_executor.ts              |  4 +-
 .../public/application/constants/index.ts     |  6 +-
 .../get_defaults_for_action_params.test.ts    |  6 +-
 .../lib/get_defaults_for_action_params.ts     |  4 +-
 .../action_form.test.tsx                      | 27 ++++----
 .../action_type_form.tsx                      | 10 +--
 .../tests/alerting/list_alert_types.ts        |  4 +-
 .../spaces_only/tests/alerting/alerts_base.ts | 16 ++---
 .../spaces_only/tests/alerting/event_log.ts   | 14 ++---
 .../alerting/get_alert_instance_summary.ts    |  2 +-
 .../tests/alerting/list_alert_types.ts        |  2 +-
 21 files changed, 152 insertions(+), 95 deletions(-)

diff --git a/x-pack/plugins/alerts/common/builtin_action_groups.ts b/x-pack/plugins/alerts/common/builtin_action_groups.ts
index d31f75357d370..d9c5ae613f787 100644
--- a/x-pack/plugins/alerts/common/builtin_action_groups.ts
+++ b/x-pack/plugins/alerts/common/builtin_action_groups.ts
@@ -6,13 +6,13 @@
 import { i18n } from '@kbn/i18n';
 import { ActionGroup } from './alert_type';
 
-export const ResolvedActionGroup: ActionGroup = {
-  id: 'resolved',
-  name: i18n.translate('xpack.alerts.builtinActionGroups.resolved', {
-    defaultMessage: 'Resolved',
+export const RecoveredActionGroup: ActionGroup = {
+  id: 'recovered',
+  name: i18n.translate('xpack.alerts.builtinActionGroups.recovered', {
+    defaultMessage: 'Recovered',
   }),
 };
 
 export function getBuiltinActionGroups(): ActionGroup[] {
-  return [ResolvedActionGroup];
+  return [RecoveredActionGroup];
 }
diff --git a/x-pack/plugins/alerts/server/alert_type_registry.test.ts b/x-pack/plugins/alerts/server/alert_type_registry.test.ts
index 8dc387f96addb..b04871a047e4b 100644
--- a/x-pack/plugins/alerts/server/alert_type_registry.test.ts
+++ b/x-pack/plugins/alerts/server/alert_type_registry.test.ts
@@ -105,8 +105,8 @@ describe('register()', () => {
           name: 'Default',
         },
         {
-          id: 'resolved',
-          name: 'Resolved',
+          id: 'recovered',
+          name: 'Recovered',
         },
       ],
       defaultActionGroupId: 'default',
@@ -117,7 +117,7 @@ describe('register()', () => {
 
     expect(() => registry.register(alertType)).toThrowError(
       new Error(
-        `Alert type [id="${alertType.id}"] cannot be registered. Action groups [resolved] are reserved by the framework.`
+        `Alert type [id="${alertType.id}"] cannot be registered. Action groups [recovered] are reserved by the framework.`
       )
     );
   });
@@ -229,8 +229,8 @@ describe('get()', () => {
             "name": "Default",
           },
           Object {
-            "id": "resolved",
-            "name": "Resolved",
+            "id": "recovered",
+            "name": "Recovered",
           },
         ],
         "actionVariables": Object {
@@ -287,8 +287,8 @@ describe('list()', () => {
               "name": "Test Action Group",
             },
             Object {
-              "id": "resolved",
-              "name": "Resolved",
+              "id": "recovered",
+              "name": "Recovered",
             },
           ],
           "actionVariables": Object {
diff --git a/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts b/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts
index 9bd61c0fe66d2..0a764ea768591 100644
--- a/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts
+++ b/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts
@@ -122,7 +122,7 @@ describe('getAlertInstanceSummary()', () => {
       .addActiveInstance('instance-previously-active', 'action group B')
       .advanceTime(10000)
       .addExecute()
-      .addResolvedInstance('instance-previously-active')
+      .addRecoveredInstance('instance-previously-active')
       .addActiveInstance('instance-currently-active', 'action group A')
       .getEvents();
     const eventsResult = {
diff --git a/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts b/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts
index f9e4a2908d6ce..1d5ebe2b5911e 100644
--- a/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts
+++ b/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts
@@ -6,7 +6,7 @@
 
 import { SanitizedAlert, AlertInstanceSummary } from '../types';
 import { IValidatedEvent } from '../../../event_log/server';
-import { EVENT_LOG_ACTIONS, EVENT_LOG_PROVIDER } from '../plugin';
+import { EVENT_LOG_ACTIONS, EVENT_LOG_PROVIDER, LEGACY_EVENT_LOG_ACTIONS } from '../plugin';
 import { alertInstanceSummaryFromEventLog } from './alert_instance_summary_from_event_log';
 
 const ONE_HOUR_IN_MILLIS = 60 * 60 * 1000;
@@ -189,7 +189,43 @@ describe('alertInstanceSummaryFromEventLog', () => {
       .addActiveInstance('instance-1', 'action group A')
       .advanceTime(10000)
       .addExecute()
-      .addResolvedInstance('instance-1')
+      .addRecoveredInstance('instance-1')
+      .getEvents();
+
+    const summary: AlertInstanceSummary = alertInstanceSummaryFromEventLog({
+      alert,
+      events,
+      dateStart,
+      dateEnd,
+    });
+
+    const { lastRun, status, instances } = summary;
+    expect({ lastRun, status, instances }).toMatchInlineSnapshot(`
+      Object {
+        "instances": Object {
+          "instance-1": Object {
+            "actionGroupId": undefined,
+            "activeStartDate": undefined,
+            "muted": false,
+            "status": "OK",
+          },
+        },
+        "lastRun": "2020-06-18T00:00:10.000Z",
+        "status": "OK",
+      }
+    `);
+  });
+
+  test('legacy alert with currently inactive instance', async () => {
+    const alert = createAlert({});
+    const eventsFactory = new EventsFactory();
+    const events = eventsFactory
+      .addExecute()
+      .addNewInstance('instance-1')
+      .addActiveInstance('instance-1', 'action group A')
+      .advanceTime(10000)
+      .addExecute()
+      .addLegacyResolvedInstance('instance-1')
       .getEvents();
 
     const summary: AlertInstanceSummary = alertInstanceSummaryFromEventLog({
@@ -224,7 +260,7 @@ describe('alertInstanceSummaryFromEventLog', () => {
       .addActiveInstance('instance-1', 'action group A')
       .advanceTime(10000)
       .addExecute()
-      .addResolvedInstance('instance-1')
+      .addRecoveredInstance('instance-1')
       .getEvents();
 
     const summary: AlertInstanceSummary = alertInstanceSummaryFromEventLog({
@@ -406,7 +442,7 @@ describe('alertInstanceSummaryFromEventLog', () => {
       .advanceTime(10000)
       .addExecute()
       .addActiveInstance('instance-1', 'action group A')
-      .addResolvedInstance('instance-2')
+      .addRecoveredInstance('instance-2')
       .getEvents();
 
     const summary: AlertInstanceSummary = alertInstanceSummaryFromEventLog({
@@ -451,7 +487,7 @@ describe('alertInstanceSummaryFromEventLog', () => {
       .advanceTime(10000)
       .addExecute()
       .addActiveInstance('instance-1', 'action group A')
-      .addResolvedInstance('instance-2')
+      .addRecoveredInstance('instance-2')
       .advanceTime(10000)
       .addExecute()
       .addActiveInstance('instance-1', 'action group B')
@@ -561,12 +597,24 @@ export class EventsFactory {
     return this;
   }
 
-  addResolvedInstance(instanceId: string): EventsFactory {
+  addRecoveredInstance(instanceId: string): EventsFactory {
+    this.events.push({
+      '@timestamp': this.date,
+      event: {
+        provider: EVENT_LOG_PROVIDER,
+        action: EVENT_LOG_ACTIONS.recoveredInstance,
+      },
+      kibana: { alerting: { instance_id: instanceId } },
+    });
+    return this;
+  }
+
+  addLegacyResolvedInstance(instanceId: string): EventsFactory {
     this.events.push({
       '@timestamp': this.date,
       event: {
         provider: EVENT_LOG_PROVIDER,
-        action: EVENT_LOG_ACTIONS.resolvedInstance,
+        action: LEGACY_EVENT_LOG_ACTIONS.resolvedInstance,
       },
       kibana: { alerting: { instance_id: instanceId } },
     });
diff --git a/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts b/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts
index 8fed97a74435d..6fed8b4aa4ee6 100644
--- a/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts
+++ b/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts
@@ -6,7 +6,7 @@
 
 import { SanitizedAlert, AlertInstanceSummary, AlertInstanceStatus } from '../types';
 import { IEvent } from '../../../event_log/server';
-import { EVENT_LOG_ACTIONS, EVENT_LOG_PROVIDER } from '../plugin';
+import { EVENT_LOG_ACTIONS, EVENT_LOG_PROVIDER, LEGACY_EVENT_LOG_ACTIONS } from '../plugin';
 
 export interface AlertInstanceSummaryFromEventLogParams {
   alert: SanitizedAlert;
@@ -80,7 +80,8 @@ export function alertInstanceSummaryFromEventLog(
         status.status = 'Active';
         status.actionGroupId = event?.kibana?.alerting?.action_group_id;
         break;
-      case EVENT_LOG_ACTIONS.resolvedInstance:
+      case LEGACY_EVENT_LOG_ACTIONS.resolvedInstance:
+      case EVENT_LOG_ACTIONS.recoveredInstance:
         status.status = 'OK';
         status.activeStartDate = undefined;
         status.actionGroupId = undefined;
diff --git a/x-pack/plugins/alerts/server/plugin.ts b/x-pack/plugins/alerts/server/plugin.ts
index 4bfb44425544a..bafb89c64076b 100644
--- a/x-pack/plugins/alerts/server/plugin.ts
+++ b/x-pack/plugins/alerts/server/plugin.ts
@@ -82,9 +82,12 @@ export const EVENT_LOG_ACTIONS = {
   execute: 'execute',
   executeAction: 'execute-action',
   newInstance: 'new-instance',
-  resolvedInstance: 'resolved-instance',
+  recoveredInstance: 'recovered-instance',
   activeInstance: 'active-instance',
 };
+export const LEGACY_EVENT_LOG_ACTIONS = {
+  resolvedInstance: 'resolved-instance',
+};
 
 export interface PluginSetupContract {
   registerType: AlertTypeRegistry['register'];
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts b/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
index 07d08f5837d54..d4c4f746392c3 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
@@ -26,12 +26,12 @@ import { alertsMock, alertsClientMock } from '../mocks';
 import { eventLoggerMock } from '../../../event_log/server/event_logger.mock';
 import { IEventLogger } from '../../../event_log/server';
 import { SavedObjectsErrorHelpers } from '../../../../../src/core/server';
-import { Alert, ResolvedActionGroup } from '../../common';
+import { Alert, RecoveredActionGroup } from '../../common';
 import { omit } from 'lodash';
 const alertType = {
   id: 'test',
   name: 'My test alert',
-  actionGroups: [{ id: 'default', name: 'Default' }, ResolvedActionGroup],
+  actionGroups: [{ id: 'default', name: 'Default' }, RecoveredActionGroup],
   defaultActionGroupId: 'default',
   executor: jest.fn(),
   producer: 'alerts',
@@ -114,7 +114,7 @@ describe('Task Runner', () => {
         },
       },
       {
-        group: ResolvedActionGroup.id,
+        group: RecoveredActionGroup.id,
         id: '2',
         actionTypeId: 'action',
         params: {
@@ -517,7 +517,7 @@ describe('Task Runner', () => {
     `);
   });
 
-  test('fire resolved actions for execution for the alertInstances which is in the resolved state', async () => {
+  test('fire recovered actions for execution for the alertInstances which is in the recovered state', async () => {
     taskRunnerFactoryInitializerParams.actionsPlugin.isActionTypeEnabled.mockReturnValue(true);
     taskRunnerFactoryInitializerParams.actionsPlugin.isActionExecutable.mockReturnValue(true);
 
@@ -650,7 +650,7 @@ describe('Task Runner', () => {
         Array [
           Object {
             "event": Object {
-              "action": "resolved-instance",
+              "action": "recovered-instance",
             },
             "kibana": Object {
               "alerting": Object {
@@ -666,7 +666,7 @@ describe('Task Runner', () => {
                 },
               ],
             },
-            "message": "test:1: 'alert-name' resolved instance: '2'",
+            "message": "test:1: 'alert-name' instance '2' has recovered",
           },
         ],
         Array [
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner.ts b/x-pack/plugins/alerts/server/task_runner/task_runner.ts
index 24d96788c3395..5a7247ac50ea0 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner.ts
@@ -39,7 +39,7 @@ import { IEvent, IEventLogger, SAVED_OBJECT_REL_PRIMARY } from '../../../event_l
 import { isAlertSavedObjectNotFoundError } from '../lib/is_alert_not_found_error';
 import { AlertsClient } from '../alerts_client';
 import { partiallyUpdateAlert } from '../saved_objects';
-import { ResolvedActionGroup } from '../../common';
+import { RecoveredActionGroup } from '../../common';
 
 const FALLBACK_RETRY_INTERVAL = '5m';
 
@@ -219,7 +219,7 @@ export class TaskRunner {
       alertInstance.hasScheduledActions()
     );
 
-    generateNewAndResolvedInstanceEvents({
+    generateNewAndRecoveredInstanceEvents({
       eventLogger,
       originalAlertInstances,
       currentAlertInstances: instancesWithScheduledActions,
@@ -229,7 +229,7 @@ export class TaskRunner {
     });
 
     if (!muteAll) {
-      scheduleActionsForResolvedInstances(
+      scheduleActionsForRecoveredInstances(
         alertInstances,
         executionHandler,
         originalAlertInstances,
@@ -436,7 +436,7 @@ export class TaskRunner {
   }
 }
 
-interface GenerateNewAndResolvedInstanceEventsParams {
+interface GenerateNewAndRecoveredInstanceEventsParams {
   eventLogger: IEventLogger;
   originalAlertInstances: Dictionary<AlertInstance>;
   currentAlertInstances: Dictionary<AlertInstance>;
@@ -445,18 +445,20 @@ interface GenerateNewAndResolvedInstanceEventsParams {
   namespace: string | undefined;
 }
 
-function generateNewAndResolvedInstanceEvents(params: GenerateNewAndResolvedInstanceEventsParams) {
+function generateNewAndRecoveredInstanceEvents(
+  params: GenerateNewAndRecoveredInstanceEventsParams
+) {
   const { eventLogger, alertId, namespace, currentAlertInstances, originalAlertInstances } = params;
   const originalAlertInstanceIds = Object.keys(originalAlertInstances);
   const currentAlertInstanceIds = Object.keys(currentAlertInstances);
 
   const newIds = without(currentAlertInstanceIds, ...originalAlertInstanceIds);
-  const resolvedIds = without(originalAlertInstanceIds, ...currentAlertInstanceIds);
+  const recoveredIds = without(originalAlertInstanceIds, ...currentAlertInstanceIds);
 
-  for (const id of resolvedIds) {
+  for (const id of recoveredIds) {
     const actionGroup = originalAlertInstances[id].getLastScheduledActions()?.group;
-    const message = `${params.alertLabel} resolved instance: '${id}'`;
-    logInstanceEvent(id, EVENT_LOG_ACTIONS.resolvedInstance, message, actionGroup);
+    const message = `${params.alertLabel} instance '${id}' has recovered`;
+    logInstanceEvent(id, EVENT_LOG_ACTIONS.recoveredInstance, message, actionGroup);
   }
 
   for (const id of newIds) {
@@ -496,7 +498,7 @@ function generateNewAndResolvedInstanceEvents(params: GenerateNewAndResolvedInst
   }
 }
 
-function scheduleActionsForResolvedInstances(
+function scheduleActionsForRecoveredInstances(
   alertInstancesMap: Record<string, AlertInstance>,
   executionHandler: ReturnType<typeof createExecutionHandler>,
   originalAlertInstances: Record<string, AlertInstance>,
@@ -505,22 +507,22 @@ function scheduleActionsForResolvedInstances(
 ) {
   const currentAlertInstanceIds = Object.keys(currentAlertInstances);
   const originalAlertInstanceIds = Object.keys(originalAlertInstances);
-  const resolvedIds = without(
+  const recoveredIds = without(
     originalAlertInstanceIds,
     ...currentAlertInstanceIds,
     ...mutedInstanceIds
   );
-  for (const id of resolvedIds) {
+  for (const id of recoveredIds) {
     const instance = alertInstancesMap[id];
-    instance.updateLastScheduledActions(ResolvedActionGroup.id);
+    instance.updateLastScheduledActions(RecoveredActionGroup.id);
     instance.unscheduleActions();
     executionHandler({
-      actionGroup: ResolvedActionGroup.id,
+      actionGroup: RecoveredActionGroup.id,
       context: {},
       state: {},
       alertInstanceId: id,
     });
-    instance.scheduleActions(ResolvedActionGroup.id);
+    instance.scheduleActions(RecoveredActionGroup.id);
   }
 }
 
diff --git a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
index 14785f64cffac..1941ec6326ddb 100644
--- a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/inventory_metric_threshold_executor.ts
@@ -9,7 +9,7 @@ import moment from 'moment';
 import { getCustomMetricLabel } from '../../../../common/formatters/get_custom_metric_label';
 import { toMetricOpt } from '../../../../common/snapshot_metric_i18n';
 import { AlertStates, InventoryMetricConditions } from './types';
-import { ResolvedActionGroup } from '../../../../../alerts/common';
+import { RecoveredActionGroup } from '../../../../../alerts/common';
 import { AlertExecutorOptions } from '../../../../../alerts/server';
 import { InventoryItemType, SnapshotMetricType } from '../../../../common/inventory_models/types';
 import { InfraBackendLibs } from '../../infra_types';
@@ -103,7 +103,7 @@ export const createInventoryMetricThresholdExecutor = (libs: InfraBackendLibs) =
     }
     if (reason) {
       const actionGroupId =
-        nextState === AlertStates.OK ? ResolvedActionGroup.id : FIRED_ACTIONS.id;
+        nextState === AlertStates.OK ? RecoveredActionGroup.id : FIRED_ACTIONS.id;
       alertInstance.scheduleActions(actionGroupId, {
         group: item,
         alertState: stateToAlertMessage[nextState],
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index b31afba8ac9cc..a1d6428f3b52b 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -6,7 +6,7 @@
 import { createMetricThresholdExecutor, FIRED_ACTIONS } from './metric_threshold_executor';
 import { Comparator, AlertStates } from './types';
 import * as mocks from './test_mocks';
-import { ResolvedActionGroup } from '../../../../../alerts/common';
+import { RecoveredActionGroup } from '../../../../../alerts/common';
 import { AlertExecutorOptions } from '../../../../../alerts/server';
 import {
   alertsMock,
@@ -367,7 +367,7 @@ describe('The metric threshold alert type', () => {
       expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
       expect(getState(instanceID).alertState).toBe(AlertStates.ALERT);
       await execute([2]);
-      expect(mostRecentAction(instanceID).id).toBe(ResolvedActionGroup.id);
+      expect(mostRecentAction(instanceID).id).toBe(RecoveredActionGroup.id);
       expect(getState(instanceID).alertState).toBe(AlertStates.OK);
     });
     test('does not continue to send a recovery alert if the metric is still OK', async () => {
@@ -383,7 +383,7 @@ describe('The metric threshold alert type', () => {
       expect(mostRecentAction(instanceID).id).toBe(FIRED_ACTIONS.id);
       expect(getState(instanceID).alertState).toBe(AlertStates.ALERT);
       await execute([2]);
-      expect(mostRecentAction(instanceID).id).toBe(ResolvedActionGroup.id);
+      expect(mostRecentAction(instanceID).id).toBe(RecoveredActionGroup.id);
       expect(getState(instanceID).alertState).toBe(AlertStates.OK);
     });
   });
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index 7c3918c37ebbf..60790648d9a9b 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -6,7 +6,7 @@
 import { first, last } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import moment from 'moment';
-import { ResolvedActionGroup } from '../../../../../alerts/common';
+import { RecoveredActionGroup } from '../../../../../alerts/common';
 import { AlertExecutorOptions } from '../../../../../alerts/server';
 import { InfraBackendLibs } from '../../infra_types';
 import {
@@ -89,7 +89,7 @@ export const createMetricThresholdExecutor = (libs: InfraBackendLibs) =>
         const firstResult = first(alertResults);
         const timestamp = (firstResult && firstResult[group].timestamp) ?? moment().toISOString();
         const actionGroupId =
-          nextState === AlertStates.OK ? ResolvedActionGroup.id : FIRED_ACTIONS.id;
+          nextState === AlertStates.OK ? RecoveredActionGroup.id : FIRED_ACTIONS.id;
         alertInstance.scheduleActions(actionGroupId, {
           group,
           alertState: stateToAlertMessage[nextState],
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
index 7af8e5ba88300..156f65f094342 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
@@ -16,10 +16,10 @@ export const routeToConnectors = `/connectors`;
 export const routeToAlerts = `/alerts`;
 export const routeToAlertDetails = `/alert/:alertId`;
 
-export const resolvedActionGroupMessage = i18n.translate(
-  'xpack.triggersActionsUI.sections.actionForm.ResolvedMessage',
+export const recoveredActionGroupMessage = i18n.translate(
+  'xpack.triggersActionsUI.sections.actionForm.RecoveredMessage',
   {
-    defaultMessage: 'Resolved',
+    defaultMessage: 'Recovered',
   }
 );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/get_defaults_for_action_params.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/get_defaults_for_action_params.test.ts
index c1f7cbb9fafed..57cc45786b2da 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/get_defaults_for_action_params.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/get_defaults_for_action_params.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ResolvedActionGroup } from '../../../../alerts/common';
+import { RecoveredActionGroup } from '../../../../alerts/common';
 import { AlertProvidedActionVariables } from './action_variables';
 import { getDefaultsForActionParams } from './get_defaults_for_action_params';
 
@@ -16,8 +16,8 @@ describe('getDefaultsForActionParams', () => {
     });
   });
 
-  test('pagerduty defaults for resolved action group', async () => {
-    expect(getDefaultsForActionParams('.pagerduty', ResolvedActionGroup.id)).toEqual({
+  test('pagerduty defaults for recovered action group', async () => {
+    expect(getDefaultsForActionParams('.pagerduty', RecoveredActionGroup.id)).toEqual({
       dedupKey: `{{${AlertProvidedActionVariables.alertId}}}:{{${AlertProvidedActionVariables.alertInstanceId}}}`,
       eventAction: 'resolve',
     });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/get_defaults_for_action_params.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/get_defaults_for_action_params.ts
index c2143553e63c6..36c054977ac30 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/get_defaults_for_action_params.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/get_defaults_for_action_params.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AlertActionParam, ResolvedActionGroup } from '../../../../alerts/common';
+import { AlertActionParam, RecoveredActionGroup } from '../../../../alerts/common';
 import { AlertProvidedActionVariables } from './action_variables';
 
 export const getDefaultsForActionParams = (
@@ -17,7 +17,7 @@ export const getDefaultsForActionParams = (
         dedupKey: `{{${AlertProvidedActionVariables.alertId}}}:{{${AlertProvidedActionVariables.alertInstanceId}}}`,
         eventAction: 'trigger',
       };
-      if (actionGroupId === ResolvedActionGroup.id) {
+      if (actionGroupId === RecoveredActionGroup.id) {
         pagerDutyDefaults.eventAction = 'resolve';
       }
       return pagerDutyDefaults;
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.test.tsx
index 5b56720737b7e..ddbf933078043 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.test.tsx
@@ -10,8 +10,9 @@ import { act } from 'react-dom/test-utils';
 import { actionTypeRegistryMock } from '../../action_type_registry.mock';
 import { ValidationResult, Alert, AlertAction } from '../../../types';
 import ActionForm from './action_form';
-import { ResolvedActionGroup } from '../../../../../alerts/common';
+import { RecoveredActionGroup } from '../../../../../alerts/common';
 import { useKibana } from '../../../common/lib/kibana';
+import { EuiScreenReaderOnly } from '@elastic/eui';
 jest.mock('../../../common/lib/kibana');
 jest.mock('../../lib/action_connector_api', () => ({
   loadAllActions: jest.fn(),
@@ -228,7 +229,7 @@ describe('action_form', () => {
           }}
           actionGroups={[
             { id: 'default', name: 'Default' },
-            { id: 'resolved', name: 'Resolved' },
+            { id: 'recovered', name: 'Recovered' },
           ]}
           setActionGroupIdByIndex={(group: string, index: number) => {
             initialAlert.actions[index].group = group;
@@ -347,18 +348,18 @@ describe('action_form', () => {
             "value": "default",
           },
           Object {
-            "data-test-subj": "addNewActionConnectorActionGroup-0-option-resolved",
-            "inputDisplay": "Resolved",
-            "value": "resolved",
+            "data-test-subj": "addNewActionConnectorActionGroup-0-option-recovered",
+            "inputDisplay": "Recovered",
+            "value": "recovered",
           },
         ]
       `);
     });
 
-    it('renders selected Resolved action group', async () => {
+    it('renders selected Recovered action group', async () => {
       const wrapper = await setup([
         {
-          group: ResolvedActionGroup.id,
+          group: RecoveredActionGroup.id,
           id: 'test',
           actionTypeId: actionType.id,
           params: {
@@ -381,15 +382,17 @@ describe('action_form', () => {
             "value": "default",
           },
           Object {
-            "data-test-subj": "addNewActionConnectorActionGroup-0-option-resolved",
-            "inputDisplay": "Resolved",
-            "value": "resolved",
+            "data-test-subj": "addNewActionConnectorActionGroup-0-option-recovered",
+            "inputDisplay": "Recovered",
+            "value": "recovered",
           },
         ]
       `);
-      expect(actionGroupsSelect.first().text()).toEqual(
-        'Select an option: Resolved, is selectedResolved'
+
+      expect(actionGroupsSelect.first().find(EuiScreenReaderOnly).text()).toEqual(
+        'Select an option: Recovered, is selected'
       );
+      expect(actionGroupsSelect.first().find('button').first().text()).toEqual('Recovered');
     });
 
     it('renders available connectors for the selected action type', async () => {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
index 7e38805957931..fffc3bd32125e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_form.tsx
@@ -26,7 +26,7 @@ import {
   EuiBadge,
   EuiErrorBoundary,
 } from '@elastic/eui';
-import { AlertActionParam, ResolvedActionGroup } from '../../../../../alerts/common';
+import { AlertActionParam, RecoveredActionGroup } from '../../../../../alerts/common';
 import {
   IErrorObject,
   AlertAction,
@@ -40,7 +40,7 @@ import { checkActionFormActionTypeEnabled } from '../../lib/check_action_type_en
 import { hasSaveActionsCapability } from '../../lib/capabilities';
 import { ActionAccordionFormProps } from './action_form';
 import { transformActionVariables } from '../../lib/action_variables';
-import { resolvedActionGroupMessage } from '../../constants';
+import { recoveredActionGroupMessage } from '../../constants';
 import { useKibana } from '../../../common/lib/kibana';
 import { getDefaultsForActionParams } from '../../lib/get_defaults_for_action_params';
 
@@ -105,8 +105,8 @@ export const ActionTypeForm = ({
   useEffect(() => {
     setAvailableActionVariables(getAvailableActionVariables(messageVariables, actionItem.group));
     const res =
-      actionItem.group === ResolvedActionGroup.id
-        ? resolvedActionGroupMessage
+      actionItem.group === RecoveredActionGroup.id
+        ? recoveredActionGroupMessage
         : defaultActionMessage;
     setAvailableDefaultActionMessage(res);
     const paramsDefaults = getDefaultsForActionParams(actionItem.actionTypeId, actionItem.group);
@@ -374,7 +374,7 @@ function getAvailableActionVariables(
     return [];
   }
   const filteredActionVariables =
-    actionGroup === ResolvedActionGroup.id
+    actionGroup === RecoveredActionGroup.id
       ? { params: actionVariables.params, state: actionVariables.state }
       : actionVariables;
 
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
index b3635b9f40e27..bfaf8a2a4788e 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
@@ -17,7 +17,7 @@ export default function listAlertTypes({ getService }: FtrProviderContext) {
   const expectedNoOpType = {
     actionGroups: [
       { id: 'default', name: 'Default' },
-      { id: 'resolved', name: 'Resolved' },
+      { id: 'recovered', name: 'Recovered' },
     ],
     defaultActionGroupId: 'default',
     id: 'test.noop',
@@ -33,7 +33,7 @@ export default function listAlertTypes({ getService }: FtrProviderContext) {
   const expectedRestrictedNoOpType = {
     actionGroups: [
       { id: 'default', name: 'Default' },
-      { id: 'resolved', name: 'Resolved' },
+      { id: 'recovered', name: 'Recovered' },
     ],
     defaultActionGroupId: 'default',
     id: 'test.restricted-noop',
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_base.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_base.ts
index 64e99190e183a..8dab199271da8 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_base.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_base.ts
@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { Response as SupertestResponse } from 'supertest';
-import { ResolvedActionGroup } from '../../../../../plugins/alerts/common';
+import { RecoveredActionGroup } from '../../../../../plugins/alerts/common';
 import { Space } from '../../../common/types';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 import {
@@ -137,7 +137,7 @@ instanceStateValue: true
       await taskManagerUtils.waitForActionTaskParamsToBeCleanedUp(testStart);
     });
 
-    it('should fire actions when an alert instance is resolved', async () => {
+    it('should fire actions when an alert instance is recovered', async () => {
       const reference = alertUtils.generateReference();
 
       const { body: createdAction } = await supertestWithoutAuth
@@ -174,12 +174,12 @@ instanceStateValue: true
                 params: {},
               },
               {
-                group: ResolvedActionGroup.id,
+                group: RecoveredActionGroup.id,
                 id: indexRecordActionId,
                 params: {
                   index: ES_TEST_INDEX_NAME,
                   reference,
-                  message: 'Resolved message',
+                  message: 'Recovered message',
                 },
               },
             ],
@@ -194,10 +194,10 @@ instanceStateValue: true
         await esTestIndexTool.waitForDocs('action:test.index-record', reference)
       )[0];
 
-      expect(actionTestRecord._source.params.message).to.eql('Resolved message');
+      expect(actionTestRecord._source.params.message).to.eql('Recovered message');
     });
 
-    it('should not fire actions when an alert instance is resolved, but alert is muted', async () => {
+    it('should not fire actions when an alert instance is recovered, but alert is muted', async () => {
       const testStart = new Date();
       const reference = alertUtils.generateReference();
 
@@ -237,12 +237,12 @@ instanceStateValue: true
                 params: {},
               },
               {
-                group: ResolvedActionGroup.id,
+                group: RecoveredActionGroup.id,
                 id: indexRecordActionId,
                 params: {
                   index: ES_TEST_INDEX_NAME,
                   reference,
-                  message: 'Resolved message',
+                  message: 'Recovered message',
                 },
               },
             ],
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
index d3cd3db124ecd..3766785680925 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
@@ -78,7 +78,7 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
             'execute-action',
             'new-instance',
             'active-instance',
-            'resolved-instance',
+            'recovered-instance',
           ],
         });
       });
@@ -87,25 +87,25 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
       const executeEvents = getEventsByAction(events, 'execute');
       const executeActionEvents = getEventsByAction(events, 'execute-action');
       const newInstanceEvents = getEventsByAction(events, 'new-instance');
-      const resolvedInstanceEvents = getEventsByAction(events, 'resolved-instance');
+      const recoveredInstanceEvents = getEventsByAction(events, 'recovered-instance');
 
       expect(executeEvents.length >= 4).to.be(true);
       expect(executeActionEvents.length).to.be(2);
       expect(newInstanceEvents.length).to.be(1);
-      expect(resolvedInstanceEvents.length).to.be(1);
+      expect(recoveredInstanceEvents.length).to.be(1);
 
       // make sure the events are in the right temporal order
       const executeTimes = getTimestamps(executeEvents);
       const executeActionTimes = getTimestamps(executeActionEvents);
       const newInstanceTimes = getTimestamps(newInstanceEvents);
-      const resolvedInstanceTimes = getTimestamps(resolvedInstanceEvents);
+      const recoveredInstanceTimes = getTimestamps(recoveredInstanceEvents);
 
       expect(executeTimes[0] < newInstanceTimes[0]).to.be(true);
       expect(executeTimes[1] <= newInstanceTimes[0]).to.be(true);
       expect(executeTimes[2] > newInstanceTimes[0]).to.be(true);
       expect(executeTimes[1] <= executeActionTimes[0]).to.be(true);
       expect(executeTimes[2] > executeActionTimes[0]).to.be(true);
-      expect(resolvedInstanceTimes[0] > newInstanceTimes[0]).to.be(true);
+      expect(recoveredInstanceTimes[0] > newInstanceTimes[0]).to.be(true);
 
       // validate each event
       let executeCount = 0;
@@ -136,8 +136,8 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
           case 'new-instance':
             validateInstanceEvent(event, `created new instance: 'instance'`);
             break;
-          case 'resolved-instance':
-            validateInstanceEvent(event, `resolved instance: 'instance'`);
+          case 'recovered-instance':
+            validateInstanceEvent(event, `recovered instance: 'instance'`);
             break;
           case 'active-instance':
             validateInstanceEvent(event, `active instance: 'instance' in actionGroup: 'default'`);
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_instance_summary.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_instance_summary.ts
index 22034328e5275..404c6020fa237 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_instance_summary.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_instance_summary.ts
@@ -216,7 +216,7 @@ export default function createGetAlertInstanceSummaryTests({ getService }: FtrPr
 
       await alertUtils.muteInstance(createdAlert.id, 'instanceC');
       await alertUtils.muteInstance(createdAlert.id, 'instanceD');
-      await waitForEvents(createdAlert.id, ['new-instance', 'resolved-instance']);
+      await waitForEvents(createdAlert.id, ['new-instance', 'recovered-instance']);
       const response = await supertest.get(
         `${getUrlPrefix(Spaces.space1.id)}/api/alerts/alert/${createdAlert.id}/_instance_summary`
       );
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
index 3fb2cc40437d8..9d38f4abb7f3f 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
@@ -25,7 +25,7 @@ export default function listAlertTypes({ getService }: FtrProviderContext) {
       expect(fixtureAlertType).to.eql({
         actionGroups: [
           { id: 'default', name: 'Default' },
-          { id: 'resolved', name: 'Resolved' },
+          { id: 'recovered', name: 'Recovered' },
         ],
         defaultActionGroupId: 'default',
         id: 'test.noop',

From 9b74fe6d39b2d7126c650120a1c9b7523985f641 Mon Sep 17 00:00:00 2001
From: Nicolas Chaulet <n.chaulet@gmail.com>
Date: Tue, 1 Dec 2020 12:55:15 -0500
Subject: [PATCH 13/28] [Fleet] Handler api key creation errors when Fleet
 Admin is invalid (#84576)

---
 .../components/new_enrollment_key_flyout.tsx  |  3 +
 x-pack/plugins/fleet/server/errors/index.ts   |  7 ++-
 .../server/services/api_keys/security.ts      | 58 +++++++++++++++----
 .../apis/enrollment_api_keys/crud.ts          | 31 +++++++++-
 4 files changed, 84 insertions(+), 15 deletions(-)

diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/enrollment_token_list_page/components/new_enrollment_key_flyout.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/enrollment_token_list_page/components/new_enrollment_key_flyout.tsx
index ed607e361bd6e..d9aeba2372672 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/enrollment_token_list_page/components/new_enrollment_key_flyout.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/enrollment_token_list_page/components/new_enrollment_key_flyout.tsx
@@ -46,6 +46,9 @@ function useCreateApiKeyForm(
           policy_id: policyIdInput.value,
         }),
       });
+      if (res.error) {
+        throw res.error;
+      }
       policyIdInput.clear();
       apiKeyNameInput.clear();
       setIsLoading(false);
diff --git a/x-pack/plugins/fleet/server/errors/index.ts b/x-pack/plugins/fleet/server/errors/index.ts
index e3ca6a9b48dcf..d6fa79a2baeba 100644
--- a/x-pack/plugins/fleet/server/errors/index.ts
+++ b/x-pack/plugins/fleet/server/errors/index.ts
@@ -5,7 +5,11 @@
  */
 
 /* eslint-disable max-classes-per-file */
-export { defaultIngestErrorHandler, ingestErrorToResponseOptions } from './handlers';
+export {
+  defaultIngestErrorHandler,
+  ingestErrorToResponseOptions,
+  isLegacyESClientError,
+} from './handlers';
 
 export class IngestManagerError extends Error {
   constructor(message?: string) {
@@ -24,3 +28,4 @@ export class PackageUnsupportedMediaTypeError extends IngestManagerError {}
 export class PackageInvalidArchiveError extends IngestManagerError {}
 export class PackageCacheError extends IngestManagerError {}
 export class PackageOperationNotSupportedError extends IngestManagerError {}
+export class FleetAdminUserInvalidError extends IngestManagerError {}
diff --git a/x-pack/plugins/fleet/server/services/api_keys/security.ts b/x-pack/plugins/fleet/server/services/api_keys/security.ts
index dfd53d55fbbf5..5fdf8626a9fb2 100644
--- a/x-pack/plugins/fleet/server/services/api_keys/security.ts
+++ b/x-pack/plugins/fleet/server/services/api_keys/security.ts
@@ -4,7 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { KibanaRequest, FakeRequest, SavedObjectsClientContract } from 'src/core/server';
+import type { Request } from '@hapi/hapi';
+import { KibanaRequest, SavedObjectsClientContract } from '../../../../../../src/core/server';
+import { FleetAdminUserInvalidError, isLegacyESClientError } from '../../errors';
 import { CallESAsCurrentUser } from '../../types';
 import { appContextService } from '../app_context';
 import { outputService } from '../output';
@@ -18,22 +20,38 @@ export async function createAPIKey(
   if (!adminUser) {
     throw new Error('No admin user configured');
   }
-  const request: FakeRequest = {
+  const request = KibanaRequest.from(({
+    path: '/',
+    route: { settings: {} },
+    url: { href: '/' },
+    raw: { req: { url: '/' } },
     headers: {
       authorization: `Basic ${Buffer.from(`${adminUser.username}:${adminUser.password}`).toString(
         'base64'
       )}`,
     },
-  };
+  } as unknown) as Request);
   const security = appContextService.getSecurity();
   if (!security) {
     throw new Error('Missing security plugin');
   }
 
-  return security.authc.createAPIKey(request as KibanaRequest, {
-    name,
-    role_descriptors: roleDescriptors,
-  });
+  try {
+    const key = await security.authc.createAPIKey(request, {
+      name,
+      role_descriptors: roleDescriptors,
+    });
+
+    return key;
+  } catch (err) {
+    if (isLegacyESClientError(err) && err.statusCode === 401) {
+      // Clear Fleet admin user cache as the user is probably not valid anymore
+      outputService.invalidateCache();
+      throw new FleetAdminUserInvalidError(`Fleet Admin user is invalid: ${err.message}`);
+    }
+
+    throw err;
+  }
 }
 export async function authenticate(callCluster: CallESAsCurrentUser) {
   try {
@@ -51,20 +69,36 @@ export async function invalidateAPIKey(soClient: SavedObjectsClientContract, id:
   if (!adminUser) {
     throw new Error('No admin user configured');
   }
-  const request: FakeRequest = {
+  const request = KibanaRequest.from(({
+    path: '/',
+    route: { settings: {} },
+    url: { href: '/' },
+    raw: { req: { url: '/' } },
     headers: {
       authorization: `Basic ${Buffer.from(`${adminUser.username}:${adminUser.password}`).toString(
         'base64'
       )}`,
     },
-  };
+  } as unknown) as Request);
 
   const security = appContextService.getSecurity();
   if (!security) {
     throw new Error('Missing security plugin');
   }
 
-  return security.authc.invalidateAPIKey(request as KibanaRequest, {
-    id,
-  });
+  try {
+    const res = await security.authc.invalidateAPIKey(request, {
+      id,
+    });
+
+    return res;
+  } catch (err) {
+    if (isLegacyESClientError(err) && err.statusCode === 401) {
+      // Clear Fleet admin user cache as the user is probably not valid anymore
+      outputService.invalidateCache();
+      throw new FleetAdminUserInvalidError(`Fleet Admin user is invalid: ${err.message}`);
+    }
+
+    throw err;
+  }
 }
diff --git a/x-pack/test/fleet_api_integration/apis/enrollment_api_keys/crud.ts b/x-pack/test/fleet_api_integration/apis/enrollment_api_keys/crud.ts
index 3a526fac2f08a..dd72016476526 100644
--- a/x-pack/test/fleet_api_integration/apis/enrollment_api_keys/crud.ts
+++ b/x-pack/test/fleet_api_integration/apis/enrollment_api_keys/crud.ts
@@ -92,12 +92,12 @@ export default function (providerContext: FtrProviderContext) {
           .expect(400);
       });
 
-      it('should not allow to create an enrollment api key for a non existing agent policy', async () => {
+      it('should return a 400 if the fleet admin user is modifed outside of Fleet', async () => {
         await supertest
           .post(`/api/fleet/enrollment-api-keys`)
           .set('kbn-xsrf', 'xxx')
           .send({
-            policy_id: 'idonotexistspolicy',
+            raoul: 'raoul',
           })
           .expect(400);
       });
@@ -161,6 +161,33 @@ export default function (providerContext: FtrProviderContext) {
           },
         });
       });
+
+      describe('It should handle error when the Fleet user is invalid', () => {
+        before(async () => {});
+        after(async () => {
+          await getService('supertest')
+            .post(`/api/fleet/agents/setup`)
+            .set('kbn-xsrf', 'xxx')
+            .send({ forceRecreate: true });
+        });
+
+        it('should not allow to create an enrollment api key if the Fleet admin user is invalid', async () => {
+          await es.security.changePassword({
+            username: 'fleet_enroll',
+            body: {
+              password: Buffer.from((Math.random() * 10000000).toString()).toString('base64'),
+            },
+          });
+          const res = await supertest
+            .post(`/api/fleet/enrollment-api-keys`)
+            .set('kbn-xsrf', 'xxx')
+            .send({
+              policy_id: 'policy1',
+            })
+            .expect(400);
+          expect(res.body.message).match(/Fleet Admin user is invalid/);
+        });
+      });
     });
   });
 }

From d8643f719ecb449cc75b17f592ae76ae42e4f0d5 Mon Sep 17 00:00:00 2001
From: Jeffrey Chu <56368296+achuguy@users.noreply.github.com>
Date: Tue, 1 Dec 2020 13:03:56 -0500
Subject: [PATCH 14/28] endpoint telemetry cloned endpoint tests (#81498)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../data.json                                 |  530 ++++
 .../mappings.json                             | 2592 +++++++++++++++++
 .../cloned_endpoint_installed/data.json       |  533 ++++
 .../cloned_endpoint_installed/mappings.json   | 2592 +++++++++++++++++
 .../cloned_endpoint_uninstalled/data.json     |  527 ++++
 .../cloned_endpoint_uninstalled/mappings.json | 2592 +++++++++++++++++
 .../apps/endpoint/endpoint_telemetry.ts       |  118 +
 7 files changed, 9484 insertions(+)
 create mode 100644 x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/data.json
 create mode 100644 x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/mappings.json
 create mode 100644 x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/data.json
 create mode 100644 x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/mappings.json
 create mode 100644 x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/data.json
 create mode 100644 x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/mappings.json

diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/data.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/data.json
new file mode 100644
index 0000000000000..9b6804beabfe5
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/data.json
@@ -0,0 +1,530 @@
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:5460518c-10c7-4c25-b2ec-3f63eafb7d47", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:26:37.093Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "MngOEjmt4OWFSCvya8AWgDF9p0nPqiCZLpNrqntWdjcGl+vPcbVs+un3ilKC3GQKtKP6KLtMziLR/60teHpAJ0Ls1f+mbCP1PjjAfFL1ZBnGHsvkR099iRJ9q4rCxzmZtifGZQ/s2+t99DRUe8GkJhIj3VR1uN/EKPXmXDWZo0f+bTUDT7vGZVY=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:58.866Z", 
+    "default_api_key_id": "ieriwHQBXUUrssdI83FW", 
+    "last_checkin": "2020-09-24T16:26:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "E-riwHQBXUUrssdIvHEw", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-116.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "fe80::1/64", 
+       "fe80::4de:9ad6:320f:79f5/64", 
+       "fdbb:cb5c:fb4:68:1ca7:3a67:de43:950c/64", 
+       "10.0.7.116/22", 
+       "fdbb:cb5c:fb4:68:1cfe:7be7:f700:8810/64", 
+       "fdbb:cb5c:fb4:68:257d:7303:389d:f335/64", 
+       "fdbb:cb5c:fb4:68:7470:3bec:14b5:2caf/64", 
+       "fdbb:cb5c:fb4:68:9c5f:eab7:8345:f711/64", 
+       "fdbb:cb5c:fb4:68:dc96:8bac:67e0:99dd/64", 
+       "fdbb:cb5c:fb4:68:60c6:73b6:1540:602/64", 
+       "fdbb:cb5c:fb4:68:144:6a1b:1aae:a57d/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-116.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:7e:49"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4231B1A9-25CB-4157-CF54-6BCD11C742E0"
+     }, 
+     "os": {
+      "kernel": "18.2.0", 
+      "full": "Mac OS X(10.14.1)", 
+      "name": "Mac OS X", 
+      "family": "darwin", 
+      "platform": "darwin", 
+      "version": "10.14.1"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "5460518c-10c7-4c25-b2ec-3f63eafb7d47"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:296c368b-35d3-4241-905f-75a24f52ec13", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:26:36.352Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "PEF8+bfiv21Yn5yj8I2/vIaQWMrUQK4PeBBwXsrvmVTsbuFejXM0IQtYVKXShBJAoY9CUEKPCRR4rIIdXWZc51i1ZneLoFw+yBw8BsSwhHfbQXvAVQowH7UqKHp0CiA5J9uGSgmw3Q55a4dv4IHih+sBKji7Qf2durs5gCWUJExrRCpMiU3OHSg=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:56.620Z", 
+    "default_api_key_id": "xOrjwHQBXUUrssdIDnHH", 
+    "last_checkin": "2020-09-24T16:26:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "S67iwHQBEiA0_Dvks-Cm", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-158.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "10.0.7.158/22", 
+       "fdbb:cb5c:fb4:68:250:56ff:feb1:371f/64", 
+       "fe80::250:56ff:feb1:371f/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-158.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:37:1f"
+      ], 
+      "architecture": "x86_64", 
+      "id": "739e447fc6963034621b714c584eccc1"
+     }, 
+     "os": {
+      "kernel": "4.15.0-38-generic", 
+      "full": "Ubuntu bionic(18.04.1 LTS (Bionic Beaver))", 
+      "name": "Ubuntu", 
+      "family": "debian", 
+      "platform": "ubuntu", 
+      "version": "18.04.1 LTS (Bionic Beaver)"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "296c368b-35d3-4241-905f-75a24f52ec13"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:26:36.352Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "sdv6996k+S1BiZ/12K3Wi6rb8Lsoh/+shwzKNqujwcmhdbeQ92ygLoO+tudJaJOnL129WT+hhanEf6OgH5PpQBezc03hl9v2AI+BlU+hssfce5OfgFRGLYg8S+ryNHwFhK6EJeN1aivoie+YholNpcpt2l/t+lQpevMI4QYGaMfUzofuivs5JM4=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:54.037Z", 
+    "default_api_key_id": "lq7iwHQBEiA0_Dvk8-Fb", 
+    "last_checkin": "2020-09-24T16:26:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "geriwHQBXUUrssdIqXB2", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-195.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "fe80::1/64", 
+       "fe80::107d:2365:5a7c:8da/64", 
+       "fdbb:cb5c:fb4:68:1ca7:3a67:de43:950c/64", 
+       "10.0.7.195/22", 
+       "fdbb:cb5c:fb4:68:d4ef:63a5:8ffc:f933/64", 
+       "fdbb:cb5c:fb4:68:b082:8681:cf85:27d0/64", 
+       "fdbb:cb5c:fb4:68:7c3d:13f3:5339:be7b/64", 
+       "fdbb:cb5c:fb4:68:19a4:2a63:cc88:6e59/64", 
+       "fdbb:cb5c:fb4:68:494a:3867:57b8:4027/64", 
+       "fdbb:cb5c:fb4:68:1c88:41e:6ce1:4be7/64", 
+       "fdbb:cb5c:fb4:68:114:b84:8faf:b12b/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-195.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:e4:06"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4231B1A9-25CB-4157-CF54-6BCD11C742E0"
+     }, 
+     "os": {
+      "kernel": "18.2.0", 
+      "full": "Mac OS X(10.14.1)", 
+      "name": "Mac OS X", 
+      "family": "darwin", 
+      "platform": "darwin", 
+      "version": "10.14.1"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:ac0ab6c1-2317-478c-93d9-c514d845302d", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:26:36.352Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "UnSz8pAKTP/0DENATzn13Yo0jcdbWq70IiBJcDY+DF5M063+El91o+448KVaMHj3rCSrULfJboBf1Ao80UKU5WKz4CYJ3ZVjHm39/f8rXMZSah5lQAkl9Ak2v5wUCFd4KTEwUUEmnUKKSQGC53cBhnvoyPdzfNjt1ml96lZFZbxXt/VyU3u8vhQ=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:30.880Z", 
+    "default_api_key_id": "Va7iwHQBEiA0_DvkcN-4", 
+    "last_checkin": "2020-09-24T16:26:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "Sq7iwHQBEiA0_DvkT98X", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "JCHU-WIN10-1", 
+      "ip": [
+       "fdbb:cb5c:fb4:68:6ca6:5ea3:ae36:af51/64", 
+       "fdbb:cb5c:fb4:68:6c9d:def9:bb8a:6695/128", 
+       "fe80::6ca6:5ea3:ae36:af51/64", 
+       "10.0.7.235/22", 
+       "::1/128", 
+       "127.0.0.1/8"
+      ], 
+      "hostname": "JCHU-WIN10-1", 
+      "mac": [
+       "00:50:56:b1:65:cb"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4143c277-074e-47a9-b37d-37f94b508705"
+     }, 
+     "os": {
+      "kernel": "10.0.18362.1082 (WinBuild.160101.0800)", 
+      "full": "Windows 10 Pro(10.0)", 
+      "name": "Windows 10 Pro", 
+      "family": "windows", 
+      "platform": "windows", 
+      "version": "10.0"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "ac0ab6c1-2317-478c-93d9-c514d845302d"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:2d187287-658a-4cb6-84d8-d66d1b9a6299", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:26:36.352Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "fpQcy/QWSbafzl6avELe9goTtyojPwQX3id1pe+BBqDarSCB3k5QwWLQP2SXEl2rwJdywUrBz3gMySKi80RYWJFUoWHiipfaE/jXJRqJxZZvhBe8fdSP7YPkdIdLQl/3ktIWqAzjjS1CErqMb5K4HTZIp5FswDQB40SbDkQKPECl9o8pBhLjH/A=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:28.949Z", 
+    "default_api_key_id": "aeriwHQBXUUrssdIdXAX", 
+    "last_checkin": "2020-09-24T16:26:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "Sa7iwHQBEiA0_DvkR99k", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "JCHU-WIN10-2", 
+      "ip": [
+       "fdbb:cb5c:fb4:68:dda8:b7a:3e20:9ca0/64", 
+       "fdbb:cb5c:fb4:68:e922:9626:5193:ef68/128", 
+       "fe80::dda8:b7a:3e20:9ca0/64", 
+       "10.0.6.96/22", 
+       "::1/128", 
+       "127.0.0.1/8"
+      ], 
+      "hostname": "JCHU-WIN10-2", 
+      "mac": [
+       "00:50:56:b1:26:07"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4143c277-074e-47a9-b37d-37f94b508705"
+     }, 
+     "os": {
+      "kernel": "10.0.18362.1082 (WinBuild.160101.0800)", 
+      "full": "Windows 10 Pro(10.0)", 
+      "name": "Windows 10 Pro", 
+      "family": "windows", 
+      "platform": "windows", 
+      "version": "10.0"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "2d187287-658a-4cb6-84d8-d66d1b9a6299"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:c216aea0-58ba-40a3-b6fe-afa2f5457835", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:26:36.352Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "tSCsI7HPfRVIcw3Yx3xUAl20Hfe9AdEIs/4IBBH9ZO1gxnMMjRkVb/hxhfcdg6dkW+RIc6Pc9Jz7rUvybq8fY0r/pTKGXTFr46dC2+E9jfb7rs/PmYhG2V0/Ei2p+ZQypAIp8mtknSHkX+l74N7niVXKreneLrt99e4ZWIyeuwNwr0HcGjoMEqM=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:59.088Z", 
+    "default_api_key_id": "SK7jwHQBEiA0_DvkNuIq", 
+    "last_checkin": "2020-09-24T16:26:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "OeriwHQBXUUrssdIvXGr", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-6-176.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "10.0.6.176/22", 
+       "fdbb:cb5c:fb4:68:250:56ff:feb1:3363/64", 
+       "fe80::250:56ff:feb1:3363/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-6-176.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:33:63"
+      ], 
+      "architecture": "x86_64", 
+      "id": "739e447fc6963034621b714c584eccc1"
+     }, 
+     "os": {
+      "kernel": "4.15.0-118-generic", 
+      "full": "Ubuntu bionic(18.04.1 LTS (Bionic Beaver))", 
+      "name": "Ubuntu", 
+      "family": "debian", 
+      "platform": "ubuntu", 
+      "version": "18.04.1 LTS (Bionic Beaver)"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "c216aea0-58ba-40a3-b6fe-afa2f5457835"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:8e652110-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:43.499165-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "5460518c-10c7-4c25-b2ec-3f63eafb7d47", 
+    "message": "Application: endpoint-security--7.9.2[5460518c-10c7-4c25-b2ec-3f63eafb7d47]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:43.495361445Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[44,4,0,2,2,4,1,2,0,0,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":25.33265565,\"mean\":6.21698140807909}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":58376192,\"mean\":46094231}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0.32258064516129},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0.323624595469256},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0.664451827242525},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":9.55882352941176},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsPidMonitorThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsDelayEventThread\"}],\"uptime\":{\"endpoint\":308,\"system\":3807934}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to kernel extension\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"File write event reporting is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Process event reporting is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Network event reporting is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Full Disk Access is enabled\",\"name\":\"full_disk_access\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel extension\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointmacho-v1-blocklist\",\"sha256\":\"da7ca0eaffd840e612acdc064700b3549dc64768d7d127977cc86d9bdaac22ee\"},{\"name\":\"endpointmacho-v1-exceptionlist\",\"sha256\":\"a6d93374c05e88447a3f2aafe0061efc10ff28d324d701436c103194a7594b51\"},{\"name\":\"endpointmacho-v1-model\",\"sha256\":\"213e0b5dcad10504eac23a7056b2e87d1b694da19832366eae8eb85057945c4f\"},{\"name\":\"global-exceptionlist-macos\",\"sha256\":\"4abf799e6b79f0ee66a2e0b3293a92c2a122a083274cbea9d1b2c83bf57ffce7\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-macos-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"b364a499-8e64-4d91-9770-6911c5d6964b\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"ec5403f8-6708-0d58-7aff-b2137b48b816\",\"os\":{\"Ext\":{\"variant\":\"macOS\"},\"full\":\"macOS 10.14.1\",\"name\":\"macOS\",\"version\":\"10.14.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:18:18.145Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:80a6c1f0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:54.930717796-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "c216aea0-58ba-40a3-b6fe-afa2f5457835", 
+    "message": "Application: endpoint-security--7.9.2[c216aea0-58ba-40a3-b6fe-afa2f5457835]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:54.929290223Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[57,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":3,\"mean\":3.49666666666667}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":49778688,\"mean\":31986824}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":2.12765957446809},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0.72992700729927},\"name\":\"EventsLoopThread\"}],\"uptime\":{\"endpoint\":300,\"system\":3863}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"a15f0431-6835-41c4-a7ee-21a70d41cf5b\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"20ccfdfa-323f-e33e-f2ef-3528edb1afea\",\"os\":{\"Ext\":{\"variant\":\"Ubuntu\"},\"full\":\"Ubuntu 18.04.1\",\"name\":\"Linux\",\"version\":\"18.04.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:55.087Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:7bdc8fb0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:45.675453579-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "296c368b-35d3-4241-905f-75a24f52ec13", 
+    "message": "Application: endpoint-security--7.9.2[296c368b-35d3-4241-905f-75a24f52ec13]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:45.674010613Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[57,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":2.8,\"mean\":3.17}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":49278976,\"mean\":31884356}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":2.12765957446809},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0.72992700729927},\"name\":\"EventsLoopThread\"}],\"uptime\":{\"endpoint\":300,\"system\":5000305}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"6f0cb2fc-3e46-4435-8892-d9f7e71b23fd\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"e9909692-0e35-fd30-e3a3-e2e7253bb5c7\",\"os\":{\"Ext\":{\"variant\":\"Ubuntu\"},\"full\":\"Ubuntu 18.04.1\",\"name\":\"Linux\",\"version\":\"18.04.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:47.051Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:81e5aa90-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:40.138333-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5", 
+    "message": "Application: endpoint-security--7.9.2[b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:40.134985503Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[55,0,2,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":10.21008368,\"mean\":1.91476589372881}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":71143424,\"mean\":53719456}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":3.08880308880309},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsPidMonitorThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsDelayEventThread\"}],\"uptime\":{\"endpoint\":302,\"system\":1901758}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to kernel extension\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"File write event reporting is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Process event reporting is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Network event reporting is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Full Disk Access is enabled\",\"name\":\"full_disk_access\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel extension\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointmacho-v1-blocklist\",\"sha256\":\"da7ca0eaffd840e612acdc064700b3549dc64768d7d127977cc86d9bdaac22ee\"},{\"name\":\"endpointmacho-v1-exceptionlist\",\"sha256\":\"a6d93374c05e88447a3f2aafe0061efc10ff28d324d701436c103194a7594b51\"},{\"name\":\"endpointmacho-v1-model\",\"sha256\":\"213e0b5dcad10504eac23a7056b2e87d1b694da19832366eae8eb85057945c4f\"},{\"name\":\"global-exceptionlist-macos\",\"sha256\":\"4abf799e6b79f0ee66a2e0b3293a92c2a122a083274cbea9d1b2c83bf57ffce7\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-macos-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"49f4e779-287a-4fa8-80e6-247b54c554f1\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"7d59b1a5-afa1-6531-07ea-691602558230\",\"os\":{\"Ext\":{\"variant\":\"macOS\"},\"full\":\"macOS 10.14.1\",\"name\":\"macOS\",\"version\":\"10.14.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:57.177Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:82b7eeb0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:13.3157023-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "ac0ab6c1-2317-478c-93d9-c514d845302d", 
+    "message": "Application: endpoint-security--7.9.2[ac0ab6c1-2317-478c-93d9-c514d845302d]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:13.13714300Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[53,1,0,1,0,0,2,1,0,3,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":49.0526570938275,\"mean\":4.53577832211642}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":285802496,\"mean\":95647240}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":1.30293159609121},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":3.18021201413428},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"}],\"uptime\":{\"endpoint\":306,\"system\":3625}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to driver\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"Successfully started process event reporting\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Successfuly started sync image load event reporting\",\"name\":\"detect_sync_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfuly started async image load event reporting\",\"name\":\"detect_async_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfully started file write event reporting\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Successfully stopped file open event reporting\",\"name\":\"detect_file_open_events\",\"status\":\"success\"},{\"message\":\"Successfully started network event reporting\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Successfully started registry event reporting\",\"name\":\"detect_registry_events\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling imageload events; current state is enabled\",\"name\":\"configure_imageload_events\",\"status\":\"success\"},{\"message\":\"Success enabling dns events; current state is enabled\",\"name\":\"configure_dns_events\",\"status\":\"success\"},{\"message\":\"Success enabling registry events; current state is enabled\",\"name\":\"configure_registry_events\",\"status\":\"success\"},{\"message\":\"Success enabling security events; current state is enabled\",\"name\":\"configure_security_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointpe-v4-blocklist\",\"sha256\":\"7fdb1b867fd4d2da37870d493e1c67630f59355eab061f91e705f4cc83dd6b9b\"},{\"name\":\"endpointpe-v4-exceptionlist\",\"sha256\":\"e21f3ba186d1563b66bb58b7ff9a362c07448e8f4dec00b2f861bf935cb15d77\"},{\"name\":\"endpointpe-v4-model\",\"sha256\":\"463709447352d429297355247266f641179331171342b3bc3e9c8f6b4b2faed2\"},{\"name\":\"global-exceptionlist-windows\",\"sha256\":\"824859b0c6749cc31951d92a73bbdddfcfe9f38abfe432087934d4dab9766ce8\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-windows-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"detect_file_open_events\",\"detect_async_image_load_events\",\"detect_registry_events\",\"configure_imageload_events\",\"configure_dns_events\",\"configure_security_events\",\"configure_registry_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"detect_file_open_events\",\"detect_sync_image_load_events\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"6474b1bd-96bc-4bde-a770-0e6a7a5bf8c4\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"c85e6c40-d4a1-db21-7458-2565a6b857f3\",\"os\":{\"Ext\":{\"variant\":\"Windows 10 Pro\"},\"full\":\"Windows 10 Pro 1903 (10.0.18362.1082)\",\"name\":\"Windows\",\"version\":\"1903 (10.0.18362.1082)\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:58.555Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:7cbf9cb1-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:15.400204-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "2d187287-658a-4cb6-84d8-d66d1b9a6299", 
+    "message": "Application: endpoint-security--7.9.2[2d187287-658a-4cb6-84d8-d66d1b9a6299]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:15.96990100Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[46,2,2,2,4,2,0,0,0,2,0,0,0,0,1,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":48.3070275492921,\"mean\":6.43134047264261}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":228757504,\"mean\":94594836}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":1.30293159609121},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":1.9672131147541},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":2.62295081967213},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0.655737704918033},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":2.11267605633803},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"}],\"uptime\":{\"endpoint\":307,\"system\":3654}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to driver\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"Successfully started process event reporting\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Successfuly started sync image load event reporting\",\"name\":\"detect_sync_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfuly started async image load event reporting\",\"name\":\"detect_async_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfully started file write event reporting\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Successfully stopped file open event reporting\",\"name\":\"detect_file_open_events\",\"status\":\"success\"},{\"message\":\"Successfully started network event reporting\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Successfully started registry event reporting\",\"name\":\"detect_registry_events\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling imageload events; current state is enabled\",\"name\":\"configure_imageload_events\",\"status\":\"success\"},{\"message\":\"Success enabling dns events; current state is enabled\",\"name\":\"configure_dns_events\",\"status\":\"success\"},{\"message\":\"Success enabling registry events; current state is enabled\",\"name\":\"configure_registry_events\",\"status\":\"success\"},{\"message\":\"Success enabling security events; current state is enabled\",\"name\":\"configure_security_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointpe-v4-blocklist\",\"sha256\":\"7fdb1b867fd4d2da37870d493e1c67630f59355eab061f91e705f4cc83dd6b9b\"},{\"name\":\"endpointpe-v4-exceptionlist\",\"sha256\":\"e21f3ba186d1563b66bb58b7ff9a362c07448e8f4dec00b2f861bf935cb15d77\"},{\"name\":\"endpointpe-v4-model\",\"sha256\":\"463709447352d429297355247266f641179331171342b3bc3e9c8f6b4b2faed2\"},{\"name\":\"global-exceptionlist-windows\",\"sha256\":\"824859b0c6749cc31951d92a73bbdddfcfe9f38abfe432087934d4dab9766ce8\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-windows-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"detect_file_open_events\",\"detect_async_image_load_events\",\"detect_registry_events\",\"configure_imageload_events\",\"configure_dns_events\",\"configure_security_events\",\"configure_registry_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"detect_file_open_events\",\"detect_sync_image_load_events\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"21d182a2-5a08-41bb-b601-5d2b4aba4ecd\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"327d0e20-483e-95af-f4e4-7b065606e1aa\",\"os\":{\"Ext\":{\"variant\":\"Windows 10 Pro\"},\"full\":\"Windows 10 Pro 1903 (10.0.18362.1082)\",\"name\":\"Windows\",\"version\":\"1903 (10.0.18362.1082)\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:48.539Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/mappings.json
new file mode 100644
index 0000000000000..27aea27bebcd7
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_different_states/mappings.json
@@ -0,0 +1,2592 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "7b44fba6773e37c806ce290ea9b7024e",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "app_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_daily": "43b8830d5d0df85a6823d290885fc9fd",
+          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_transactional": "3d1b76c39bfb2cc8296b024d73854724",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
+          "cases": "32aa96a6d3855ddda53010ae2048ac22",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "cases-configure": "42711cbb311976c0687853f4c1354572",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "config": "c63748b75f39d0c54de12d12c1ccbc20",
+          "dashboard": "d00f614b29a80360e1190193fd333bab",
+          "endpoint:user-artifact": "4a11183eee21e6fbad864f7a30b39ad0",
+          "endpoint:user-artifact-manifest": "4b9c0e7cfaf86d82a7ee9ed68065e50d",
+          "epm-packages": "8f6e0b09ea0374c4ffe98c3755373cff",
+          "exception-list": "497afa2f881a675d72d58e20057f3d8b",
+          "exception-list-agnostic": "497afa2f881a675d72d58e20057f3d8b",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "fleet-agent-actions": "e520c855577170c24481be05c3ae14ec",
+          "fleet-agent-events": "3231653fafe4ef3196fe3b32ab774bf2",
+          "fleet-agents": "034346488514b7058a79140b19ddf631",
+          "fleet-enrollment-api-keys": "28b91e20b105b6f928e2012600085d8f",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "66eccb05066c5a89924f48a9e9736499",
+          "infrastructure-ui-source": "2b2809653635caf490c93f090502d04c",
+          "ingest-agent-policies": "9326f99c977fd2ef5ab24b6336a0675c",
+          "ingest-outputs": "8aa988c376e65443fefc26f1075e93a3",
+          "ingest-package-policies": "8545e51d7bc8286d6dace3d41240d749",
+          "ingest_manager_settings": "012cf278ec84579495110bb827d1ed09",
+          "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "d33c68a69ff1e78c9888dedd2164ac22",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "4a05b35c3a3a58fbc72dd0202dc3487f",
+          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
+          "metrics-explorer-view": "a8df1d270ee48c969d22d23812d08187",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "5c4b9a6effceb17ae8a0ab22d0c49767",
+          "search-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "siem-detection-engine-rule-actions": "6569b288c169539db10cb262bf79de18",
+          "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
+          "siem-ui-timeline": "94bc38c7a421d15fbfe8ea565370a421",
+          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
+          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "215107c281839ea9b3ad5f6419819763",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "uptime-dynamic-settings": "fcdb453a30092f022f2642db29523d80",
+          "url": "c7f66a0df8b1b52f17c28c4adb111105",
+          "visualization": "52d7a13ad68a150c4525b292d23e12cc",
+          "workplace_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "apm-indices": {
+          "properties": {
+            "apm_oss": {
+              "properties": {
+                "errorIndices": {
+                  "type": "keyword"
+                },
+                "metricsIndices": {
+                  "type": "keyword"
+                },
+                "onboardingIndices": {
+                  "type": "keyword"
+                },
+                "sourcemapIndices": {
+                  "type": "keyword"
+                },
+                "spanIndices": {
+                  "type": "keyword"
+                },
+                "transactionIndices": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apm-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "app_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_daily": {
+          "dynamic": "false",
+          "properties": {
+            "timestamp": {
+              "type": "date"
+            }
+          }
+        },
+        "application_usage_totals": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_transactional": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "canvas-element": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "content": {
+              "type": "text"
+            },
+            "help": {
+              "type": "text"
+            },
+            "image": {
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad-template": {
+          "dynamic": "false",
+          "properties": {
+            "help": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "tags": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "template_key": {
+              "type": "keyword"
+            }
+          }
+        },
+        "cases": {
+          "properties": {
+            "closed_at": {
+              "type": "date"
+            },
+            "closed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "external_service": {
+              "properties": {
+                "connector_id": {
+                  "type": "keyword"
+                },
+                "connector_name": {
+                  "type": "keyword"
+                },
+                "external_id": {
+                  "type": "keyword"
+                },
+                "external_title": {
+                  "type": "text"
+                },
+                "external_url": {
+                  "type": "text"
+                },
+                "pushed_at": {
+                  "type": "date"
+                },
+                "pushed_by": {
+                  "properties": {
+                    "email": {
+                      "type": "keyword"
+                    },
+                    "full_name": {
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-comments": {
+          "properties": {
+            "comment": {
+              "type": "text"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "pushed_at": {
+              "type": "date"
+            },
+            "pushed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-configure": {
+          "properties": {
+            "closure_type": {
+              "type": "keyword"
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "connector_name": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-user-actions": {
+          "properties": {
+            "action": {
+              "type": "keyword"
+            },
+            "action_at": {
+              "type": "date"
+            },
+            "action_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "action_field": {
+              "type": "keyword"
+            },
+            "new_value": {
+              "type": "text"
+            },
+            "old_value": {
+              "type": "text"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "false",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "type": "text"
+            },
+            "panelsJSON": {
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "type": "keyword"
+                },
+                "pause": {
+                  "type": "boolean"
+                },
+                "section": {
+                  "type": "integer"
+                },
+                "value": {
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "type": "boolean"
+            },
+            "timeTo": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "endpoint:user-artifact": {
+          "properties": {
+            "body": {
+              "type": "binary"
+            },
+            "compressionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "decodedSha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "decodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encodedSha256": {
+              "type": "keyword"
+            },
+            "encodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encryptionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "identifier": {
+              "type": "keyword"
+            }
+          }
+        },
+        "endpoint:user-artifact-manifest": {
+          "properties": {
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "ids": {
+              "index": false,
+              "type": "keyword"
+            },
+            "schemaVersion": {
+              "type": "keyword"
+            },
+            "semanticVersion": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "epm-packages": {
+          "properties": {
+            "es_index_patterns": {
+              "enabled": false,
+              "type": "object"
+            },
+            "installed_es": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "installed_kibana": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "internal": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "removable": {
+              "type": "boolean"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list-agnostic": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "file-upload-telemetry": {
+          "properties": {
+            "filesUploadedTotalCount": {
+              "type": "long"
+            }
+          }
+        },
+        "fleet-agent-actions": {
+          "properties": {
+            "agent_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "data": {
+              "type": "binary"
+            },
+            "sent_at": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agent-events": {
+          "properties": {
+            "action_id": {
+              "type": "keyword"
+            },
+            "agent_id": {
+              "type": "keyword"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "data": {
+              "type": "text"
+            },
+            "message": {
+              "type": "text"
+            },
+            "payload": {
+              "type": "text"
+            },
+            "stream_id": {
+              "type": "keyword"
+            },
+            "subtype": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agents": {
+          "properties": {
+            "access_api_key_id": {
+              "type": "keyword"
+            },
+            "active": {
+              "type": "boolean"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "config_revision": {
+              "type": "integer"
+            },
+            "current_error_events": {
+              "index": false,
+              "type": "text"
+            },
+            "default_api_key": {
+              "type": "binary"
+            },
+            "default_api_key_id": {
+              "type": "keyword"
+            },
+            "enrolled_at": {
+              "type": "date"
+            },
+            "last_checkin": {
+              "type": "date"
+            },
+            "last_checkin_status": {
+              "type": "keyword"
+            },
+            "last_updated": {
+              "type": "date"
+            },
+            "local_metadata": {
+              "type": "flattened"
+            },
+            "packages": {
+              "type": "keyword"
+            },
+            "shared_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "unenrolled_at": {
+              "type": "date"
+            },
+            "unenrollment_started_at": {
+              "type": "date"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "user_provided_metadata": {
+              "type": "flattened"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-enrollment-api-keys": {
+          "properties": {
+            "active": {
+              "type": "boolean"
+            },
+            "api_key": {
+              "type": "binary"
+            },
+            "api_key_id": {
+              "type": "keyword"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "expire_at": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "index-pattern": {
+          "properties": {
+            "fieldFormatMap": {
+              "type": "text"
+            },
+            "fields": {
+              "type": "text"
+            },
+            "intervalName": {
+              "type": "keyword"
+            },
+            "notExpandable": {
+              "type": "boolean"
+            },
+            "sourceFilters": {
+              "type": "text"
+            },
+            "timeFieldName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "typeMeta": {
+              "type": "keyword"
+            }
+          }
+        },
+        "infrastructure-ui-source": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "fields": {
+              "properties": {
+                "container": {
+                  "type": "keyword"
+                },
+                "host": {
+                  "type": "keyword"
+                },
+                "pod": {
+                  "type": "keyword"
+                },
+                "tiebreaker": {
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "inventoryDefaultView": {
+              "type": "keyword"
+            },
+            "logAlias": {
+              "type": "keyword"
+            },
+            "logColumns": {
+              "properties": {
+                "fieldColumn": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "messageColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestampColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "metricAlias": {
+              "type": "keyword"
+            },
+            "metricsExplorerDefaultView": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "ingest-agent-policies": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "monitoring_enabled": {
+              "index": false,
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "package_configs": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-outputs": {
+          "properties": {
+            "ca_sha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "config": {
+              "type": "flattened"
+            },
+            "fleet_enroll_password": {
+              "type": "binary"
+            },
+            "fleet_enroll_username": {
+              "type": "binary"
+            },
+            "hosts": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-package-policies": {
+          "properties": {
+            "config_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "inputs": {
+              "enabled": false,
+              "properties": {
+                "config": {
+                  "type": "flattened"
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "streams": {
+                  "properties": {
+                    "compiled_stream": {
+                      "type": "flattened"
+                    },
+                    "config": {
+                      "type": "flattened"
+                    },
+                    "data_stream": {
+                      "properties": {
+                        "dataset": {
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "vars": {
+                      "type": "flattened"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "vars": {
+                  "type": "flattened"
+                }
+              },
+              "type": "nested"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "output_id": {
+              "type": "keyword"
+            },
+            "package": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                },
+                "title": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest_manager_settings": {
+          "properties": {
+            "agent_auto_upgrade": {
+              "type": "keyword"
+            },
+            "has_seen_add_data_notice": {
+              "index": false,
+              "type": "boolean"
+            },
+            "kibana_ca_sha256": {
+              "type": "keyword"
+            },
+            "kibana_url": {
+              "type": "keyword"
+            },
+            "package_auto_upgrade": {
+              "type": "keyword"
+            }
+          }
+        },
+        "inventory-view": {
+          "properties": {
+            "accountId": {
+              "type": "keyword"
+            },
+            "autoBounds": {
+              "type": "boolean"
+            },
+            "autoReload": {
+              "type": "boolean"
+            },
+            "boundsOverride": {
+              "properties": {
+                "max": {
+                  "type": "integer"
+                },
+                "min": {
+                  "type": "integer"
+                }
+              }
+            },
+            "customMetrics": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "customOptions": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "text": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "filterQuery": {
+              "properties": {
+                "expression": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "groupBy": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "legend": {
+              "properties": {
+                "palette": {
+                  "type": "keyword"
+                },
+                "reverseColors": {
+                  "type": "boolean"
+                },
+                "steps": {
+                  "type": "long"
+                }
+              }
+            },
+            "metric": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "nodeType": {
+              "type": "keyword"
+            },
+            "region": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "by": {
+                  "type": "keyword"
+                },
+                "direction": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "time": {
+              "type": "long"
+            },
+            "view": {
+              "type": "keyword"
+            }
+          }
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "lens": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "expression": {
+              "index": false,
+              "type": "keyword"
+            },
+            "state": {
+              "type": "flattened"
+            },
+            "title": {
+              "type": "text"
+            },
+            "visualizationType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens-ui-telemetry": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            },
+            "date": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "maps-telemetry": {
+          "enabled": false,
+          "type": "object"
+        },
+        "metrics-explorer-view": {
+          "properties": {
+            "chartOptions": {
+              "properties": {
+                "stack": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "yAxisMode": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "currentTimerange": {
+              "properties": {
+                "from": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "options": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "filterQuery": {
+                  "type": "keyword"
+                },
+                "forceInterval": {
+                  "type": "boolean"
+                },
+                "groupBy": {
+                  "type": "keyword"
+                },
+                "limit": {
+                  "type": "integer"
+                },
+                "metrics": {
+                  "properties": {
+                    "aggregation": {
+                      "type": "keyword"
+                    },
+                    "color": {
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "label": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "source": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "dashboard": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "index-pattern": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "search": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "visualization": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-telemetry": {
+          "properties": {
+            "file_data_visualizer": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "sample-data-telemetry": {
+          "properties": {
+            "installCount": {
+              "type": "long"
+            },
+            "unInstallCount": {
+              "type": "long"
+            }
+          }
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "index": false,
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "index": false,
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "search-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "siem-detection-engine-rule-actions": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "action_type_id": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              }
+            },
+            "alertThrottle": {
+              "type": "keyword"
+            },
+            "ruleAlertId": {
+              "type": "keyword"
+            },
+            "ruleThrottle": {
+              "type": "keyword"
+            }
+          }
+        },
+        "siem-detection-engine-rule-status": {
+          "properties": {
+            "alertId": {
+              "type": "keyword"
+            },
+            "bulkCreateTimeDurations": {
+              "type": "float"
+            },
+            "gap": {
+              "type": "text"
+            },
+            "lastFailureAt": {
+              "type": "date"
+            },
+            "lastFailureMessage": {
+              "type": "text"
+            },
+            "lastLookBackDate": {
+              "type": "date"
+            },
+            "lastSuccessAt": {
+              "type": "date"
+            },
+            "lastSuccessMessage": {
+              "type": "text"
+            },
+            "searchAfterTimeDurations": {
+              "type": "float"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "statusDate": {
+              "type": "date"
+            }
+          }
+        },
+        "siem-ui-timeline": {
+          "properties": {
+            "columns": {
+              "properties": {
+                "aggregatable": {
+                  "type": "boolean"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "columnHeaderType": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "text"
+                },
+                "example": {
+                  "type": "text"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "indexes": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "placeholder": {
+                  "type": "text"
+                },
+                "searchable": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "dataProviders": {
+              "properties": {
+                "and": {
+                  "properties": {
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "excluded": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "kqlQuery": {
+                      "type": "text"
+                    },
+                    "name": {
+                      "type": "text"
+                    },
+                    "queryMatch": {
+                      "properties": {
+                        "displayField": {
+                          "type": "text"
+                        },
+                        "displayValue": {
+                          "type": "text"
+                        },
+                        "field": {
+                          "type": "text"
+                        },
+                        "operator": {
+                          "type": "text"
+                        },
+                        "value": {
+                          "type": "text"
+                        }
+                      }
+                    },
+                    "type": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "excluded": {
+                  "type": "boolean"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kqlQuery": {
+                  "type": "text"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "queryMatch": {
+                  "properties": {
+                    "displayField": {
+                      "type": "text"
+                    },
+                    "displayValue": {
+                      "type": "text"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "operator": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "type": {
+                  "type": "text"
+                }
+              }
+            },
+            "dateRange": {
+              "properties": {
+                "end": {
+                  "type": "date"
+                },
+                "start": {
+                  "type": "date"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "eventType": {
+              "type": "keyword"
+            },
+            "excludedRowRendererIds": {
+              "type": "text"
+            },
+            "favorite": {
+              "properties": {
+                "favoriteDate": {
+                  "type": "date"
+                },
+                "fullName": {
+                  "type": "text"
+                },
+                "keySearch": {
+                  "type": "text"
+                },
+                "userName": {
+                  "type": "text"
+                }
+              }
+            },
+            "filters": {
+              "properties": {
+                "exists": {
+                  "type": "text"
+                },
+                "match_all": {
+                  "type": "text"
+                },
+                "meta": {
+                  "properties": {
+                    "alias": {
+                      "type": "text"
+                    },
+                    "controlledBy": {
+                      "type": "text"
+                    },
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "formattedValue": {
+                      "type": "text"
+                    },
+                    "index": {
+                      "type": "keyword"
+                    },
+                    "key": {
+                      "type": "keyword"
+                    },
+                    "negate": {
+                      "type": "boolean"
+                    },
+                    "params": {
+                      "type": "text"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "missing": {
+                  "type": "text"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "range": {
+                  "type": "text"
+                },
+                "script": {
+                  "type": "text"
+                }
+              }
+            },
+            "kqlMode": {
+              "type": "keyword"
+            },
+            "kqlQuery": {
+              "properties": {
+                "filterQuery": {
+                  "properties": {
+                    "kuery": {
+                      "properties": {
+                        "expression": {
+                          "type": "text"
+                        },
+                        "kind": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "serializedQuery": {
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            },
+            "savedQueryId": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "columnId": {
+                  "type": "keyword"
+                },
+                "sortDirection": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "templateTimelineId": {
+              "type": "text"
+            },
+            "templateTimelineVersion": {
+              "type": "integer"
+            },
+            "timelineType": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-note": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "note": {
+              "type": "text"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-pinned-event": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "telemetry": {
+          "properties": {
+            "allowChangingOptInStatus": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "lastReported": {
+              "type": "date"
+            },
+            "lastVersionChecked": {
+              "type": "keyword"
+            },
+            "reportFailureCount": {
+              "type": "integer"
+            },
+            "reportFailureVersion": {
+              "type": "keyword"
+            },
+            "sendUsageFrom": {
+              "type": "keyword"
+            },
+            "userHasSeenNotice": {
+              "type": "boolean"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "tsvb-validation-telemetry": {
+          "properties": {
+            "failedRequests": {
+              "type": "long"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "upgrade-assistant-reindex-operation": {
+          "properties": {
+            "errorMessage": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "indexName": {
+              "type": "keyword"
+            },
+            "lastCompletedStep": {
+              "type": "long"
+            },
+            "locked": {
+              "type": "date"
+            },
+            "newIndexName": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexOptions": {
+              "properties": {
+                "openAndClose": {
+                  "type": "boolean"
+                },
+                "queueSettings": {
+                  "properties": {
+                    "queuedAt": {
+                      "type": "long"
+                    },
+                    "startedAt": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "reindexTaskId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexTaskPercComplete": {
+              "type": "float"
+            },
+            "runningReindexCount": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "integer"
+            }
+          }
+        },
+        "upgrade-assistant-telemetry": {
+          "properties": {
+            "features": {
+              "properties": {
+                "deprecation_logging": {
+                  "properties": {
+                    "enabled": {
+                      "null_value": true,
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            },
+            "ui_open": {
+              "properties": {
+                "cluster": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "indices": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "overview": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            },
+            "ui_reindex": {
+              "properties": {
+                "close": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "open": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "start": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "stop": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "uptime-dynamic-settings": {
+          "properties": {
+            "certAgeThreshold": {
+              "type": "long"
+            },
+            "certExpirationThreshold": {
+              "type": "long"
+            },
+            "heartbeatIndices": {
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "type": "text"
+            }
+          }
+        },
+        "workplace_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/data.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/data.json
new file mode 100644
index 0000000000000..98488c85878b5
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/data.json
@@ -0,0 +1,533 @@
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:22:36.352Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "sdv6996k+S1BiZ/12K3Wi6rb8Lsoh/+shwzKNqujwcmhdbeQ92ygLoO+tudJaJOnL129WT+hhanEf6OgH5PpQBezc03hl9v2AI+BlU+hssfce5OfgFRGLYg8S+ryNHwFhK6EJeN1aivoie+YholNpcpt2l/t+lQpevMI4QYGaMfUzofuivs5JM4=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:54.037Z", 
+    "default_api_key_id": "lq7iwHQBEiA0_Dvk8-Fb", 
+    "last_checkin": "2020-09-24T16:22:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "geriwHQBXUUrssdIqXB2", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-195.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "fe80::1/64", 
+       "fe80::107d:2365:5a7c:8da/64", 
+       "fdbb:cb5c:fb4:68:1ca7:3a67:de43:950c/64", 
+       "10.0.7.195/22", 
+       "fdbb:cb5c:fb4:68:d4ef:63a5:8ffc:f933/64", 
+       "fdbb:cb5c:fb4:68:b082:8681:cf85:27d0/64", 
+       "fdbb:cb5c:fb4:68:7c3d:13f3:5339:be7b/64", 
+       "fdbb:cb5c:fb4:68:19a4:2a63:cc88:6e59/64", 
+       "fdbb:cb5c:fb4:68:494a:3867:57b8:4027/64", 
+       "fdbb:cb5c:fb4:68:1c88:41e:6ce1:4be7/64", 
+       "fdbb:cb5c:fb4:68:114:b84:8faf:b12b/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-195.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:e4:06"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4231B1A9-25CB-4157-CF54-6BCD11C742E0"
+     }, 
+     "os": {
+      "kernel": "18.2.0", 
+      "full": "Mac OS X(10.14.1)", 
+      "name": "Mac OS X", 
+      "family": "darwin", 
+      "platform": "darwin", 
+      "version": "10.14.1"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:c216aea0-58ba-40a3-b6fe-afa2f5457835", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:22:36.352Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "tSCsI7HPfRVIcw3Yx3xUAl20Hfe9AdEIs/4IBBH9ZO1gxnMMjRkVb/hxhfcdg6dkW+RIc6Pc9Jz7rUvybq8fY0r/pTKGXTFr46dC2+E9jfb7rs/PmYhG2V0/Ei2p+ZQypAIp8mtknSHkX+l74N7niVXKreneLrt99e4ZWIyeuwNwr0HcGjoMEqM=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:59.088Z", 
+    "default_api_key_id": "SK7jwHQBEiA0_DvkNuIq", 
+    "last_checkin": "2020-09-24T16:22:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "OeriwHQBXUUrssdIvXGr", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-6-176.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "10.0.6.176/22", 
+       "fdbb:cb5c:fb4:68:250:56ff:feb1:3363/64", 
+       "fe80::250:56ff:feb1:3363/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-6-176.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:33:63"
+      ], 
+      "architecture": "x86_64", 
+      "id": "739e447fc6963034621b714c584eccc1"
+     }, 
+     "os": {
+      "kernel": "4.15.0-118-generic", 
+      "full": "Ubuntu bionic(18.04.1 LTS (Bionic Beaver))", 
+      "name": "Ubuntu", 
+      "family": "debian", 
+      "platform": "ubuntu", 
+      "version": "18.04.1 LTS (Bionic Beaver)"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "c216aea0-58ba-40a3-b6fe-afa2f5457835"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:2d187287-658a-4cb6-84d8-d66d1b9a6299", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:22:36.352Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "fpQcy/QWSbafzl6avELe9goTtyojPwQX3id1pe+BBqDarSCB3k5QwWLQP2SXEl2rwJdywUrBz3gMySKi80RYWJFUoWHiipfaE/jXJRqJxZZvhBe8fdSP7YPkdIdLQl/3ktIWqAzjjS1CErqMb5K4HTZIp5FswDQB40SbDkQKPECl9o8pBhLjH/A=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:28.949Z", 
+    "default_api_key_id": "aeriwHQBXUUrssdIdXAX", 
+    "last_checkin": "2020-09-24T16:22:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "Sa7iwHQBEiA0_DvkR99k", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "JCHU-WIN10-2", 
+      "ip": [
+       "fdbb:cb5c:fb4:68:dda8:b7a:3e20:9ca0/64", 
+       "fdbb:cb5c:fb4:68:e922:9626:5193:ef68/128", 
+       "fe80::dda8:b7a:3e20:9ca0/64", 
+       "10.0.6.96/22", 
+       "::1/128", 
+       "127.0.0.1/8"
+      ], 
+      "hostname": "JCHU-WIN10-2", 
+      "mac": [
+       "00:50:56:b1:26:07"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4143c277-074e-47a9-b37d-37f94b508705"
+     }, 
+     "os": {
+      "kernel": "10.0.18362.1082 (WinBuild.160101.0800)", 
+      "full": "Windows 10 Pro(10.0)", 
+      "name": "Windows 10 Pro", 
+      "family": "windows", 
+      "platform": "windows", 
+      "version": "10.0"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "2d187287-658a-4cb6-84d8-d66d1b9a6299"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:296c368b-35d3-4241-905f-75a24f52ec13", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:22:36.352Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "PEF8+bfiv21Yn5yj8I2/vIaQWMrUQK4PeBBwXsrvmVTsbuFejXM0IQtYVKXShBJAoY9CUEKPCRR4rIIdXWZc51i1ZneLoFw+yBw8BsSwhHfbQXvAVQowH7UqKHp0CiA5J9uGSgmw3Q55a4dv4IHih+sBKji7Qf2durs5gCWUJExrRCpMiU3OHSg=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:56.620Z", 
+    "default_api_key_id": "xOrjwHQBXUUrssdIDnHH", 
+    "last_checkin": "2020-09-24T16:22:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "S67iwHQBEiA0_Dvks-Cm", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-158.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "10.0.7.158/22", 
+       "fdbb:cb5c:fb4:68:250:56ff:feb1:371f/64", 
+       "fe80::250:56ff:feb1:371f/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-158.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:37:1f"
+      ], 
+      "architecture": "x86_64", 
+      "id": "739e447fc6963034621b714c584eccc1"
+     }, 
+     "os": {
+      "kernel": "4.15.0-38-generic", 
+      "full": "Ubuntu bionic(18.04.1 LTS (Bionic Beaver))", 
+      "name": "Ubuntu", 
+      "family": "debian", 
+      "platform": "ubuntu", 
+      "version": "18.04.1 LTS (Bionic Beaver)"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "296c368b-35d3-4241-905f-75a24f52ec13"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:5460518c-10c7-4c25-b2ec-3f63eafb7d47", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:22:36.352Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "MngOEjmt4OWFSCvya8AWgDF9p0nPqiCZLpNrqntWdjcGl+vPcbVs+un3ilKC3GQKtKP6KLtMziLR/60teHpAJ0Ls1f+mbCP1PjjAfFL1ZBnGHsvkR099iRJ9q4rCxzmZtifGZQ/s2+t99DRUe8GkJhIj3VR1uN/EKPXmXDWZo0f+bTUDT7vGZVY=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:58.866Z", 
+    "default_api_key_id": "ieriwHQBXUUrssdI83FW", 
+    "last_checkin": "2020-09-24T16:22:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "E-riwHQBXUUrssdIvHEw", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-116.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "fe80::1/64", 
+       "fe80::4de:9ad6:320f:79f5/64", 
+       "fdbb:cb5c:fb4:68:1ca7:3a67:de43:950c/64", 
+       "10.0.7.116/22", 
+       "fdbb:cb5c:fb4:68:1cfe:7be7:f700:8810/64", 
+       "fdbb:cb5c:fb4:68:257d:7303:389d:f335/64", 
+       "fdbb:cb5c:fb4:68:7470:3bec:14b5:2caf/64", 
+       "fdbb:cb5c:fb4:68:9c5f:eab7:8345:f711/64", 
+       "fdbb:cb5c:fb4:68:dc96:8bac:67e0:99dd/64", 
+       "fdbb:cb5c:fb4:68:60c6:73b6:1540:602/64", 
+       "fdbb:cb5c:fb4:68:144:6a1b:1aae:a57d/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-116.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:7e:49"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4231B1A9-25CB-4157-CF54-6BCD11C742E0"
+     }, 
+     "os": {
+      "kernel": "18.2.0", 
+      "full": "Mac OS X(10.14.1)", 
+      "name": "Mac OS X", 
+      "family": "darwin", 
+      "platform": "darwin", 
+      "version": "10.14.1"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "5460518c-10c7-4c25-b2ec-3f63eafb7d47"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:ac0ab6c1-2317-478c-93d9-c514d845302d", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:22:36.352Z", 
+   "fleet-agents": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "UnSz8pAKTP/0DENATzn13Yo0jcdbWq70IiBJcDY+DF5M063+El91o+448KVaMHj3rCSrULfJboBf1Ao80UKU5WKz4CYJ3ZVjHm39/f8rXMZSah5lQAkl9Ak2v5wUCFd4KTEwUUEmnUKKSQGC53cBhnvoyPdzfNjt1ml96lZFZbxXt/VyU3u8vhQ=", 
+    "current_error_events": "[]", 
+    "config_revision": 2, 
+    "enrolled_at": "2020-09-24T16:11:30.880Z", 
+    "default_api_key_id": "Va7iwHQBEiA0_DvkcN-4", 
+    "last_checkin": "2020-09-24T16:22:36.351Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "Sq7iwHQBEiA0_DvkT98X", 
+    "packages": [
+     "endpoint", 
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "JCHU-WIN10-1", 
+      "ip": [
+       "fdbb:cb5c:fb4:68:6ca6:5ea3:ae36:af51/64", 
+       "fdbb:cb5c:fb4:68:6c9d:def9:bb8a:6695/128", 
+       "fe80::6ca6:5ea3:ae36:af51/64", 
+       "10.0.7.235/22", 
+       "::1/128", 
+       "127.0.0.1/8"
+      ], 
+      "hostname": "JCHU-WIN10-1", 
+      "mac": [
+       "00:50:56:b1:65:cb"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4143c277-074e-47a9-b37d-37f94b508705"
+     }, 
+     "os": {
+      "kernel": "10.0.18362.1082 (WinBuild.160101.0800)", 
+      "full": "Windows 10 Pro(10.0)", 
+      "name": "Windows 10 Pro", 
+      "family": "windows", 
+      "platform": "windows", 
+      "version": "10.0"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "ac0ab6c1-2317-478c-93d9-c514d845302d"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:81e5aa90-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:40.138333-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5", 
+    "message": "Application: endpoint-security--7.9.2[b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:40.134985503Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[55,0,2,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":10.21008368,\"mean\":1.91476589372881}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":71143424,\"mean\":53719456}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":3.08880308880309},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsPidMonitorThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsDelayEventThread\"}],\"uptime\":{\"endpoint\":302,\"system\":1901758}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to kernel extension\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"File write event reporting is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Process event reporting is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Network event reporting is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Full Disk Access is enabled\",\"name\":\"full_disk_access\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel extension\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointmacho-v1-blocklist\",\"sha256\":\"da7ca0eaffd840e612acdc064700b3549dc64768d7d127977cc86d9bdaac22ee\"},{\"name\":\"endpointmacho-v1-exceptionlist\",\"sha256\":\"a6d93374c05e88447a3f2aafe0061efc10ff28d324d701436c103194a7594b51\"},{\"name\":\"endpointmacho-v1-model\",\"sha256\":\"213e0b5dcad10504eac23a7056b2e87d1b694da19832366eae8eb85057945c4f\"},{\"name\":\"global-exceptionlist-macos\",\"sha256\":\"4abf799e6b79f0ee66a2e0b3293a92c2a122a083274cbea9d1b2c83bf57ffce7\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-macos-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"49f4e779-287a-4fa8-80e6-247b54c554f1\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"7d59b1a5-afa1-6531-07ea-691602558230\",\"os\":{\"Ext\":{\"variant\":\"macOS\"},\"full\":\"macOS 10.14.1\",\"name\":\"macOS\",\"version\":\"10.14.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:57.177Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:8e652110-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:43.499165-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "5460518c-10c7-4c25-b2ec-3f63eafb7d47", 
+    "message": "Application: endpoint-security--7.9.2[5460518c-10c7-4c25-b2ec-3f63eafb7d47]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:43.495361445Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[44,4,0,2,2,4,1,2,0,0,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":25.33265565,\"mean\":6.21698140807909}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":58376192,\"mean\":46094231}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0.32258064516129},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0.323624595469256},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0.664451827242525},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":9.55882352941176},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsPidMonitorThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsDelayEventThread\"}],\"uptime\":{\"endpoint\":308,\"system\":3807934}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to kernel extension\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"File write event reporting is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Process event reporting is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Network event reporting is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Full Disk Access is enabled\",\"name\":\"full_disk_access\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel extension\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointmacho-v1-blocklist\",\"sha256\":\"da7ca0eaffd840e612acdc064700b3549dc64768d7d127977cc86d9bdaac22ee\"},{\"name\":\"endpointmacho-v1-exceptionlist\",\"sha256\":\"a6d93374c05e88447a3f2aafe0061efc10ff28d324d701436c103194a7594b51\"},{\"name\":\"endpointmacho-v1-model\",\"sha256\":\"213e0b5dcad10504eac23a7056b2e87d1b694da19832366eae8eb85057945c4f\"},{\"name\":\"global-exceptionlist-macos\",\"sha256\":\"4abf799e6b79f0ee66a2e0b3293a92c2a122a083274cbea9d1b2c83bf57ffce7\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-macos-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"b364a499-8e64-4d91-9770-6911c5d6964b\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"ec5403f8-6708-0d58-7aff-b2137b48b816\",\"os\":{\"Ext\":{\"variant\":\"macOS\"},\"full\":\"macOS 10.14.1\",\"name\":\"macOS\",\"version\":\"10.14.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:18:18.145Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:82b7eeb0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:13.3157023-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "ac0ab6c1-2317-478c-93d9-c514d845302d", 
+    "message": "Application: endpoint-security--7.9.2[ac0ab6c1-2317-478c-93d9-c514d845302d]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:13.13714300Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[53,1,0,1,0,0,2,1,0,3,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":49.0526570938275,\"mean\":4.53577832211642}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":285802496,\"mean\":95647240}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":1.30293159609121},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":3.18021201413428},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"}],\"uptime\":{\"endpoint\":306,\"system\":3625}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to driver\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"Successfully started process event reporting\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Successfuly started sync image load event reporting\",\"name\":\"detect_sync_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfuly started async image load event reporting\",\"name\":\"detect_async_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfully started file write event reporting\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Successfully stopped file open event reporting\",\"name\":\"detect_file_open_events\",\"status\":\"success\"},{\"message\":\"Successfully started network event reporting\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Successfully started registry event reporting\",\"name\":\"detect_registry_events\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling imageload events; current state is enabled\",\"name\":\"configure_imageload_events\",\"status\":\"success\"},{\"message\":\"Success enabling dns events; current state is enabled\",\"name\":\"configure_dns_events\",\"status\":\"success\"},{\"message\":\"Success enabling registry events; current state is enabled\",\"name\":\"configure_registry_events\",\"status\":\"success\"},{\"message\":\"Success enabling security events; current state is enabled\",\"name\":\"configure_security_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointpe-v4-blocklist\",\"sha256\":\"7fdb1b867fd4d2da37870d493e1c67630f59355eab061f91e705f4cc83dd6b9b\"},{\"name\":\"endpointpe-v4-exceptionlist\",\"sha256\":\"e21f3ba186d1563b66bb58b7ff9a362c07448e8f4dec00b2f861bf935cb15d77\"},{\"name\":\"endpointpe-v4-model\",\"sha256\":\"463709447352d429297355247266f641179331171342b3bc3e9c8f6b4b2faed2\"},{\"name\":\"global-exceptionlist-windows\",\"sha256\":\"824859b0c6749cc31951d92a73bbdddfcfe9f38abfe432087934d4dab9766ce8\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-windows-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"detect_file_open_events\",\"detect_async_image_load_events\",\"detect_registry_events\",\"configure_imageload_events\",\"configure_dns_events\",\"configure_security_events\",\"configure_registry_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"detect_file_open_events\",\"detect_sync_image_load_events\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"6474b1bd-96bc-4bde-a770-0e6a7a5bf8c4\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"c85e6c40-d4a1-db21-7458-2565a6b857f3\",\"os\":{\"Ext\":{\"variant\":\"Windows 10 Pro\"},\"full\":\"Windows 10 Pro 1903 (10.0.18362.1082)\",\"name\":\"Windows\",\"version\":\"1903 (10.0.18362.1082)\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:58.555Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:80a6c1f0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:54.930717796-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "c216aea0-58ba-40a3-b6fe-afa2f5457835", 
+    "message": "Application: endpoint-security--7.9.2[c216aea0-58ba-40a3-b6fe-afa2f5457835]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:54.929290223Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[57,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":3,\"mean\":3.49666666666667}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":49778688,\"mean\":31986824}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":2.12765957446809},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0.72992700729927},\"name\":\"EventsLoopThread\"}],\"uptime\":{\"endpoint\":300,\"system\":3863}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"a15f0431-6835-41c4-a7ee-21a70d41cf5b\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"20ccfdfa-323f-e33e-f2ef-3528edb1afea\",\"os\":{\"Ext\":{\"variant\":\"Ubuntu\"},\"full\":\"Ubuntu 18.04.1\",\"name\":\"Linux\",\"version\":\"18.04.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:55.087Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:7bdc8fb0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:45.675453579-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "296c368b-35d3-4241-905f-75a24f52ec13", 
+    "message": "Application: endpoint-security--7.9.2[296c368b-35d3-4241-905f-75a24f52ec13]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:45.674010613Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[57,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":2.8,\"mean\":3.17}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":49278976,\"mean\":31884356}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":2.12765957446809},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0.72992700729927},\"name\":\"EventsLoopThread\"}],\"uptime\":{\"endpoint\":300,\"system\":5000305}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"6f0cb2fc-3e46-4435-8892-d9f7e71b23fd\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"e9909692-0e35-fd30-e3a3-e2e7253bb5c7\",\"os\":{\"Ext\":{\"variant\":\"Ubuntu\"},\"full\":\"Ubuntu 18.04.1\",\"name\":\"Linux\",\"version\":\"18.04.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:47.051Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:7cbf9cb1-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:15.400204-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "2d187287-658a-4cb6-84d8-d66d1b9a6299", 
+    "message": "Application: endpoint-security--7.9.2[2d187287-658a-4cb6-84d8-d66d1b9a6299]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:15.96990100Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[46,2,2,2,4,2,0,0,0,2,0,0,0,0,1,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":48.3070275492921,\"mean\":6.43134047264261}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":228757504,\"mean\":94594836}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":1.30293159609121},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":1.9672131147541},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":2.62295081967213},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0.655737704918033},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":2.11267605633803},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"}],\"uptime\":{\"endpoint\":307,\"system\":3654}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to driver\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"Successfully started process event reporting\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Successfuly started sync image load event reporting\",\"name\":\"detect_sync_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfuly started async image load event reporting\",\"name\":\"detect_async_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfully started file write event reporting\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Successfully stopped file open event reporting\",\"name\":\"detect_file_open_events\",\"status\":\"success\"},{\"message\":\"Successfully started network event reporting\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Successfully started registry event reporting\",\"name\":\"detect_registry_events\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling imageload events; current state is enabled\",\"name\":\"configure_imageload_events\",\"status\":\"success\"},{\"message\":\"Success enabling dns events; current state is enabled\",\"name\":\"configure_dns_events\",\"status\":\"success\"},{\"message\":\"Success enabling registry events; current state is enabled\",\"name\":\"configure_registry_events\",\"status\":\"success\"},{\"message\":\"Success enabling security events; current state is enabled\",\"name\":\"configure_security_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointpe-v4-blocklist\",\"sha256\":\"7fdb1b867fd4d2da37870d493e1c67630f59355eab061f91e705f4cc83dd6b9b\"},{\"name\":\"endpointpe-v4-exceptionlist\",\"sha256\":\"e21f3ba186d1563b66bb58b7ff9a362c07448e8f4dec00b2f861bf935cb15d77\"},{\"name\":\"endpointpe-v4-model\",\"sha256\":\"463709447352d429297355247266f641179331171342b3bc3e9c8f6b4b2faed2\"},{\"name\":\"global-exceptionlist-windows\",\"sha256\":\"824859b0c6749cc31951d92a73bbdddfcfe9f38abfe432087934d4dab9766ce8\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-windows-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"detect_file_open_events\",\"detect_async_image_load_events\",\"detect_registry_events\",\"configure_imageload_events\",\"configure_dns_events\",\"configure_security_events\",\"configure_registry_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"detect_file_open_events\",\"detect_sync_image_load_events\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"21d182a2-5a08-41bb-b601-5d2b4aba4ecd\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"327d0e20-483e-95af-f4e4-7b065606e1aa\",\"os\":{\"Ext\":{\"variant\":\"Windows 10 Pro\"},\"full\":\"Windows 10 Pro 1903 (10.0.18362.1082)\",\"name\":\"Windows\",\"version\":\"1903 (10.0.18362.1082)\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:48.539Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/mappings.json
new file mode 100644
index 0000000000000..27aea27bebcd7
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_installed/mappings.json
@@ -0,0 +1,2592 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "7b44fba6773e37c806ce290ea9b7024e",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "app_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_daily": "43b8830d5d0df85a6823d290885fc9fd",
+          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_transactional": "3d1b76c39bfb2cc8296b024d73854724",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
+          "cases": "32aa96a6d3855ddda53010ae2048ac22",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "cases-configure": "42711cbb311976c0687853f4c1354572",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "config": "c63748b75f39d0c54de12d12c1ccbc20",
+          "dashboard": "d00f614b29a80360e1190193fd333bab",
+          "endpoint:user-artifact": "4a11183eee21e6fbad864f7a30b39ad0",
+          "endpoint:user-artifact-manifest": "4b9c0e7cfaf86d82a7ee9ed68065e50d",
+          "epm-packages": "8f6e0b09ea0374c4ffe98c3755373cff",
+          "exception-list": "497afa2f881a675d72d58e20057f3d8b",
+          "exception-list-agnostic": "497afa2f881a675d72d58e20057f3d8b",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "fleet-agent-actions": "e520c855577170c24481be05c3ae14ec",
+          "fleet-agent-events": "3231653fafe4ef3196fe3b32ab774bf2",
+          "fleet-agents": "034346488514b7058a79140b19ddf631",
+          "fleet-enrollment-api-keys": "28b91e20b105b6f928e2012600085d8f",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "66eccb05066c5a89924f48a9e9736499",
+          "infrastructure-ui-source": "2b2809653635caf490c93f090502d04c",
+          "ingest-agent-policies": "9326f99c977fd2ef5ab24b6336a0675c",
+          "ingest-outputs": "8aa988c376e65443fefc26f1075e93a3",
+          "ingest-package-policies": "8545e51d7bc8286d6dace3d41240d749",
+          "ingest_manager_settings": "012cf278ec84579495110bb827d1ed09",
+          "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "d33c68a69ff1e78c9888dedd2164ac22",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "4a05b35c3a3a58fbc72dd0202dc3487f",
+          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
+          "metrics-explorer-view": "a8df1d270ee48c969d22d23812d08187",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "5c4b9a6effceb17ae8a0ab22d0c49767",
+          "search-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "siem-detection-engine-rule-actions": "6569b288c169539db10cb262bf79de18",
+          "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
+          "siem-ui-timeline": "94bc38c7a421d15fbfe8ea565370a421",
+          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
+          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "215107c281839ea9b3ad5f6419819763",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "uptime-dynamic-settings": "fcdb453a30092f022f2642db29523d80",
+          "url": "c7f66a0df8b1b52f17c28c4adb111105",
+          "visualization": "52d7a13ad68a150c4525b292d23e12cc",
+          "workplace_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "apm-indices": {
+          "properties": {
+            "apm_oss": {
+              "properties": {
+                "errorIndices": {
+                  "type": "keyword"
+                },
+                "metricsIndices": {
+                  "type": "keyword"
+                },
+                "onboardingIndices": {
+                  "type": "keyword"
+                },
+                "sourcemapIndices": {
+                  "type": "keyword"
+                },
+                "spanIndices": {
+                  "type": "keyword"
+                },
+                "transactionIndices": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apm-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "app_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_daily": {
+          "dynamic": "false",
+          "properties": {
+            "timestamp": {
+              "type": "date"
+            }
+          }
+        },
+        "application_usage_totals": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_transactional": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "canvas-element": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "content": {
+              "type": "text"
+            },
+            "help": {
+              "type": "text"
+            },
+            "image": {
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad-template": {
+          "dynamic": "false",
+          "properties": {
+            "help": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "tags": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "template_key": {
+              "type": "keyword"
+            }
+          }
+        },
+        "cases": {
+          "properties": {
+            "closed_at": {
+              "type": "date"
+            },
+            "closed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "external_service": {
+              "properties": {
+                "connector_id": {
+                  "type": "keyword"
+                },
+                "connector_name": {
+                  "type": "keyword"
+                },
+                "external_id": {
+                  "type": "keyword"
+                },
+                "external_title": {
+                  "type": "text"
+                },
+                "external_url": {
+                  "type": "text"
+                },
+                "pushed_at": {
+                  "type": "date"
+                },
+                "pushed_by": {
+                  "properties": {
+                    "email": {
+                      "type": "keyword"
+                    },
+                    "full_name": {
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-comments": {
+          "properties": {
+            "comment": {
+              "type": "text"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "pushed_at": {
+              "type": "date"
+            },
+            "pushed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-configure": {
+          "properties": {
+            "closure_type": {
+              "type": "keyword"
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "connector_name": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-user-actions": {
+          "properties": {
+            "action": {
+              "type": "keyword"
+            },
+            "action_at": {
+              "type": "date"
+            },
+            "action_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "action_field": {
+              "type": "keyword"
+            },
+            "new_value": {
+              "type": "text"
+            },
+            "old_value": {
+              "type": "text"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "false",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "type": "text"
+            },
+            "panelsJSON": {
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "type": "keyword"
+                },
+                "pause": {
+                  "type": "boolean"
+                },
+                "section": {
+                  "type": "integer"
+                },
+                "value": {
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "type": "boolean"
+            },
+            "timeTo": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "endpoint:user-artifact": {
+          "properties": {
+            "body": {
+              "type": "binary"
+            },
+            "compressionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "decodedSha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "decodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encodedSha256": {
+              "type": "keyword"
+            },
+            "encodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encryptionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "identifier": {
+              "type": "keyword"
+            }
+          }
+        },
+        "endpoint:user-artifact-manifest": {
+          "properties": {
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "ids": {
+              "index": false,
+              "type": "keyword"
+            },
+            "schemaVersion": {
+              "type": "keyword"
+            },
+            "semanticVersion": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "epm-packages": {
+          "properties": {
+            "es_index_patterns": {
+              "enabled": false,
+              "type": "object"
+            },
+            "installed_es": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "installed_kibana": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "internal": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "removable": {
+              "type": "boolean"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list-agnostic": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "file-upload-telemetry": {
+          "properties": {
+            "filesUploadedTotalCount": {
+              "type": "long"
+            }
+          }
+        },
+        "fleet-agent-actions": {
+          "properties": {
+            "agent_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "data": {
+              "type": "binary"
+            },
+            "sent_at": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agent-events": {
+          "properties": {
+            "action_id": {
+              "type": "keyword"
+            },
+            "agent_id": {
+              "type": "keyword"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "data": {
+              "type": "text"
+            },
+            "message": {
+              "type": "text"
+            },
+            "payload": {
+              "type": "text"
+            },
+            "stream_id": {
+              "type": "keyword"
+            },
+            "subtype": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agents": {
+          "properties": {
+            "access_api_key_id": {
+              "type": "keyword"
+            },
+            "active": {
+              "type": "boolean"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "config_revision": {
+              "type": "integer"
+            },
+            "current_error_events": {
+              "index": false,
+              "type": "text"
+            },
+            "default_api_key": {
+              "type": "binary"
+            },
+            "default_api_key_id": {
+              "type": "keyword"
+            },
+            "enrolled_at": {
+              "type": "date"
+            },
+            "last_checkin": {
+              "type": "date"
+            },
+            "last_checkin_status": {
+              "type": "keyword"
+            },
+            "last_updated": {
+              "type": "date"
+            },
+            "local_metadata": {
+              "type": "flattened"
+            },
+            "packages": {
+              "type": "keyword"
+            },
+            "shared_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "unenrolled_at": {
+              "type": "date"
+            },
+            "unenrollment_started_at": {
+              "type": "date"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "user_provided_metadata": {
+              "type": "flattened"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-enrollment-api-keys": {
+          "properties": {
+            "active": {
+              "type": "boolean"
+            },
+            "api_key": {
+              "type": "binary"
+            },
+            "api_key_id": {
+              "type": "keyword"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "expire_at": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "index-pattern": {
+          "properties": {
+            "fieldFormatMap": {
+              "type": "text"
+            },
+            "fields": {
+              "type": "text"
+            },
+            "intervalName": {
+              "type": "keyword"
+            },
+            "notExpandable": {
+              "type": "boolean"
+            },
+            "sourceFilters": {
+              "type": "text"
+            },
+            "timeFieldName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "typeMeta": {
+              "type": "keyword"
+            }
+          }
+        },
+        "infrastructure-ui-source": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "fields": {
+              "properties": {
+                "container": {
+                  "type": "keyword"
+                },
+                "host": {
+                  "type": "keyword"
+                },
+                "pod": {
+                  "type": "keyword"
+                },
+                "tiebreaker": {
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "inventoryDefaultView": {
+              "type": "keyword"
+            },
+            "logAlias": {
+              "type": "keyword"
+            },
+            "logColumns": {
+              "properties": {
+                "fieldColumn": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "messageColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestampColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "metricAlias": {
+              "type": "keyword"
+            },
+            "metricsExplorerDefaultView": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "ingest-agent-policies": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "monitoring_enabled": {
+              "index": false,
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "package_configs": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-outputs": {
+          "properties": {
+            "ca_sha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "config": {
+              "type": "flattened"
+            },
+            "fleet_enroll_password": {
+              "type": "binary"
+            },
+            "fleet_enroll_username": {
+              "type": "binary"
+            },
+            "hosts": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-package-policies": {
+          "properties": {
+            "config_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "inputs": {
+              "enabled": false,
+              "properties": {
+                "config": {
+                  "type": "flattened"
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "streams": {
+                  "properties": {
+                    "compiled_stream": {
+                      "type": "flattened"
+                    },
+                    "config": {
+                      "type": "flattened"
+                    },
+                    "data_stream": {
+                      "properties": {
+                        "dataset": {
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "vars": {
+                      "type": "flattened"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "vars": {
+                  "type": "flattened"
+                }
+              },
+              "type": "nested"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "output_id": {
+              "type": "keyword"
+            },
+            "package": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                },
+                "title": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest_manager_settings": {
+          "properties": {
+            "agent_auto_upgrade": {
+              "type": "keyword"
+            },
+            "has_seen_add_data_notice": {
+              "index": false,
+              "type": "boolean"
+            },
+            "kibana_ca_sha256": {
+              "type": "keyword"
+            },
+            "kibana_url": {
+              "type": "keyword"
+            },
+            "package_auto_upgrade": {
+              "type": "keyword"
+            }
+          }
+        },
+        "inventory-view": {
+          "properties": {
+            "accountId": {
+              "type": "keyword"
+            },
+            "autoBounds": {
+              "type": "boolean"
+            },
+            "autoReload": {
+              "type": "boolean"
+            },
+            "boundsOverride": {
+              "properties": {
+                "max": {
+                  "type": "integer"
+                },
+                "min": {
+                  "type": "integer"
+                }
+              }
+            },
+            "customMetrics": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "customOptions": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "text": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "filterQuery": {
+              "properties": {
+                "expression": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "groupBy": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "legend": {
+              "properties": {
+                "palette": {
+                  "type": "keyword"
+                },
+                "reverseColors": {
+                  "type": "boolean"
+                },
+                "steps": {
+                  "type": "long"
+                }
+              }
+            },
+            "metric": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "nodeType": {
+              "type": "keyword"
+            },
+            "region": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "by": {
+                  "type": "keyword"
+                },
+                "direction": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "time": {
+              "type": "long"
+            },
+            "view": {
+              "type": "keyword"
+            }
+          }
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "lens": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "expression": {
+              "index": false,
+              "type": "keyword"
+            },
+            "state": {
+              "type": "flattened"
+            },
+            "title": {
+              "type": "text"
+            },
+            "visualizationType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens-ui-telemetry": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            },
+            "date": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "maps-telemetry": {
+          "enabled": false,
+          "type": "object"
+        },
+        "metrics-explorer-view": {
+          "properties": {
+            "chartOptions": {
+              "properties": {
+                "stack": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "yAxisMode": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "currentTimerange": {
+              "properties": {
+                "from": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "options": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "filterQuery": {
+                  "type": "keyword"
+                },
+                "forceInterval": {
+                  "type": "boolean"
+                },
+                "groupBy": {
+                  "type": "keyword"
+                },
+                "limit": {
+                  "type": "integer"
+                },
+                "metrics": {
+                  "properties": {
+                    "aggregation": {
+                      "type": "keyword"
+                    },
+                    "color": {
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "label": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "source": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "dashboard": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "index-pattern": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "search": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "visualization": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-telemetry": {
+          "properties": {
+            "file_data_visualizer": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "sample-data-telemetry": {
+          "properties": {
+            "installCount": {
+              "type": "long"
+            },
+            "unInstallCount": {
+              "type": "long"
+            }
+          }
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "index": false,
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "index": false,
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "search-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "siem-detection-engine-rule-actions": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "action_type_id": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              }
+            },
+            "alertThrottle": {
+              "type": "keyword"
+            },
+            "ruleAlertId": {
+              "type": "keyword"
+            },
+            "ruleThrottle": {
+              "type": "keyword"
+            }
+          }
+        },
+        "siem-detection-engine-rule-status": {
+          "properties": {
+            "alertId": {
+              "type": "keyword"
+            },
+            "bulkCreateTimeDurations": {
+              "type": "float"
+            },
+            "gap": {
+              "type": "text"
+            },
+            "lastFailureAt": {
+              "type": "date"
+            },
+            "lastFailureMessage": {
+              "type": "text"
+            },
+            "lastLookBackDate": {
+              "type": "date"
+            },
+            "lastSuccessAt": {
+              "type": "date"
+            },
+            "lastSuccessMessage": {
+              "type": "text"
+            },
+            "searchAfterTimeDurations": {
+              "type": "float"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "statusDate": {
+              "type": "date"
+            }
+          }
+        },
+        "siem-ui-timeline": {
+          "properties": {
+            "columns": {
+              "properties": {
+                "aggregatable": {
+                  "type": "boolean"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "columnHeaderType": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "text"
+                },
+                "example": {
+                  "type": "text"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "indexes": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "placeholder": {
+                  "type": "text"
+                },
+                "searchable": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "dataProviders": {
+              "properties": {
+                "and": {
+                  "properties": {
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "excluded": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "kqlQuery": {
+                      "type": "text"
+                    },
+                    "name": {
+                      "type": "text"
+                    },
+                    "queryMatch": {
+                      "properties": {
+                        "displayField": {
+                          "type": "text"
+                        },
+                        "displayValue": {
+                          "type": "text"
+                        },
+                        "field": {
+                          "type": "text"
+                        },
+                        "operator": {
+                          "type": "text"
+                        },
+                        "value": {
+                          "type": "text"
+                        }
+                      }
+                    },
+                    "type": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "excluded": {
+                  "type": "boolean"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kqlQuery": {
+                  "type": "text"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "queryMatch": {
+                  "properties": {
+                    "displayField": {
+                      "type": "text"
+                    },
+                    "displayValue": {
+                      "type": "text"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "operator": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "type": {
+                  "type": "text"
+                }
+              }
+            },
+            "dateRange": {
+              "properties": {
+                "end": {
+                  "type": "date"
+                },
+                "start": {
+                  "type": "date"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "eventType": {
+              "type": "keyword"
+            },
+            "excludedRowRendererIds": {
+              "type": "text"
+            },
+            "favorite": {
+              "properties": {
+                "favoriteDate": {
+                  "type": "date"
+                },
+                "fullName": {
+                  "type": "text"
+                },
+                "keySearch": {
+                  "type": "text"
+                },
+                "userName": {
+                  "type": "text"
+                }
+              }
+            },
+            "filters": {
+              "properties": {
+                "exists": {
+                  "type": "text"
+                },
+                "match_all": {
+                  "type": "text"
+                },
+                "meta": {
+                  "properties": {
+                    "alias": {
+                      "type": "text"
+                    },
+                    "controlledBy": {
+                      "type": "text"
+                    },
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "formattedValue": {
+                      "type": "text"
+                    },
+                    "index": {
+                      "type": "keyword"
+                    },
+                    "key": {
+                      "type": "keyword"
+                    },
+                    "negate": {
+                      "type": "boolean"
+                    },
+                    "params": {
+                      "type": "text"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "missing": {
+                  "type": "text"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "range": {
+                  "type": "text"
+                },
+                "script": {
+                  "type": "text"
+                }
+              }
+            },
+            "kqlMode": {
+              "type": "keyword"
+            },
+            "kqlQuery": {
+              "properties": {
+                "filterQuery": {
+                  "properties": {
+                    "kuery": {
+                      "properties": {
+                        "expression": {
+                          "type": "text"
+                        },
+                        "kind": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "serializedQuery": {
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            },
+            "savedQueryId": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "columnId": {
+                  "type": "keyword"
+                },
+                "sortDirection": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "templateTimelineId": {
+              "type": "text"
+            },
+            "templateTimelineVersion": {
+              "type": "integer"
+            },
+            "timelineType": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-note": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "note": {
+              "type": "text"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-pinned-event": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "telemetry": {
+          "properties": {
+            "allowChangingOptInStatus": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "lastReported": {
+              "type": "date"
+            },
+            "lastVersionChecked": {
+              "type": "keyword"
+            },
+            "reportFailureCount": {
+              "type": "integer"
+            },
+            "reportFailureVersion": {
+              "type": "keyword"
+            },
+            "sendUsageFrom": {
+              "type": "keyword"
+            },
+            "userHasSeenNotice": {
+              "type": "boolean"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "tsvb-validation-telemetry": {
+          "properties": {
+            "failedRequests": {
+              "type": "long"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "upgrade-assistant-reindex-operation": {
+          "properties": {
+            "errorMessage": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "indexName": {
+              "type": "keyword"
+            },
+            "lastCompletedStep": {
+              "type": "long"
+            },
+            "locked": {
+              "type": "date"
+            },
+            "newIndexName": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexOptions": {
+              "properties": {
+                "openAndClose": {
+                  "type": "boolean"
+                },
+                "queueSettings": {
+                  "properties": {
+                    "queuedAt": {
+                      "type": "long"
+                    },
+                    "startedAt": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "reindexTaskId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexTaskPercComplete": {
+              "type": "float"
+            },
+            "runningReindexCount": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "integer"
+            }
+          }
+        },
+        "upgrade-assistant-telemetry": {
+          "properties": {
+            "features": {
+              "properties": {
+                "deprecation_logging": {
+                  "properties": {
+                    "enabled": {
+                      "null_value": true,
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            },
+            "ui_open": {
+              "properties": {
+                "cluster": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "indices": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "overview": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            },
+            "ui_reindex": {
+              "properties": {
+                "close": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "open": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "start": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "stop": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "uptime-dynamic-settings": {
+          "properties": {
+            "certAgeThreshold": {
+              "type": "long"
+            },
+            "certExpirationThreshold": {
+              "type": "long"
+            },
+            "heartbeatIndices": {
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "type": "text"
+            }
+          }
+        },
+        "workplace_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/data.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/data.json
new file mode 100644
index 0000000000000..dbcd2604aed15
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/data.json
@@ -0,0 +1,527 @@
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:5460518c-10c7-4c25-b2ec-3f63eafb7d47", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:30:38.636Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "MngOEjmt4OWFSCvya8AWgDF9p0nPqiCZLpNrqntWdjcGl+vPcbVs+un3ilKC3GQKtKP6KLtMziLR/60teHpAJ0Ls1f+mbCP1PjjAfFL1ZBnGHsvkR099iRJ9q4rCxzmZtifGZQ/s2+t99DRUe8GkJhIj3VR1uN/EKPXmXDWZo0f+bTUDT7vGZVY=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:58.866Z", 
+    "default_api_key_id": "ieriwHQBXUUrssdI83FW", 
+    "last_checkin": "2020-09-24T16:29:07.071Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "E-riwHQBXUUrssdIvHEw", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-116.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "fe80::1/64", 
+       "fe80::4de:9ad6:320f:79f5/64", 
+       "fdbb:cb5c:fb4:68:1ca7:3a67:de43:950c/64", 
+       "10.0.7.116/22", 
+       "fdbb:cb5c:fb4:68:1cfe:7be7:f700:8810/64", 
+       "fdbb:cb5c:fb4:68:257d:7303:389d:f335/64", 
+       "fdbb:cb5c:fb4:68:7470:3bec:14b5:2caf/64", 
+       "fdbb:cb5c:fb4:68:9c5f:eab7:8345:f711/64", 
+       "fdbb:cb5c:fb4:68:dc96:8bac:67e0:99dd/64", 
+       "fdbb:cb5c:fb4:68:60c6:73b6:1540:602/64", 
+       "fdbb:cb5c:fb4:68:144:6a1b:1aae:a57d/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-116.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:7e:49"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4231B1A9-25CB-4157-CF54-6BCD11C742E0"
+     }, 
+     "os": {
+      "kernel": "18.2.0", 
+      "full": "Mac OS X(10.14.1)", 
+      "name": "Mac OS X", 
+      "family": "darwin", 
+      "platform": "darwin", 
+      "version": "10.14.1"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "5460518c-10c7-4c25-b2ec-3f63eafb7d47"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:ac0ab6c1-2317-478c-93d9-c514d845302d", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:30:37.974Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "UnSz8pAKTP/0DENATzn13Yo0jcdbWq70IiBJcDY+DF5M063+El91o+448KVaMHj3rCSrULfJboBf1Ao80UKU5WKz4CYJ3ZVjHm39/f8rXMZSah5lQAkl9Ak2v5wUCFd4KTEwUUEmnUKKSQGC53cBhnvoyPdzfNjt1ml96lZFZbxXt/VyU3u8vhQ=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:30.880Z", 
+    "default_api_key_id": "Va7iwHQBEiA0_DvkcN-4", 
+    "last_checkin": "2020-09-24T16:30:37.072Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "Sq7iwHQBEiA0_DvkT98X", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "JCHU-WIN10-1", 
+      "ip": [
+       "fdbb:cb5c:fb4:68:6ca6:5ea3:ae36:af51/64", 
+       "fdbb:cb5c:fb4:68:6c9d:def9:bb8a:6695/128", 
+       "fe80::6ca6:5ea3:ae36:af51/64", 
+       "10.0.7.235/22", 
+       "::1/128", 
+       "127.0.0.1/8"
+      ], 
+      "hostname": "JCHU-WIN10-1", 
+      "mac": [
+       "00:50:56:b1:65:cb"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4143c277-074e-47a9-b37d-37f94b508705"
+     }, 
+     "os": {
+      "kernel": "10.0.18362.1082 (WinBuild.160101.0800)", 
+      "full": "Windows 10 Pro(10.0)", 
+      "name": "Windows 10 Pro", 
+      "family": "windows", 
+      "platform": "windows", 
+      "version": "10.0"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "ac0ab6c1-2317-478c-93d9-c514d845302d"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:c216aea0-58ba-40a3-b6fe-afa2f5457835", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:30:37.142Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "tSCsI7HPfRVIcw3Yx3xUAl20Hfe9AdEIs/4IBBH9ZO1gxnMMjRkVb/hxhfcdg6dkW+RIc6Pc9Jz7rUvybq8fY0r/pTKGXTFr46dC2+E9jfb7rs/PmYhG2V0/Ei2p+ZQypAIp8mtknSHkX+l74N7niVXKreneLrt99e4ZWIyeuwNwr0HcGjoMEqM=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:59.088Z", 
+    "default_api_key_id": "SK7jwHQBEiA0_DvkNuIq", 
+    "last_checkin": "2020-09-24T16:30:37.072Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "OeriwHQBXUUrssdIvXGr", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-6-176.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "10.0.6.176/22", 
+       "fdbb:cb5c:fb4:68:250:56ff:feb1:3363/64", 
+       "fe80::250:56ff:feb1:3363/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-6-176.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:33:63"
+      ], 
+      "architecture": "x86_64", 
+      "id": "739e447fc6963034621b714c584eccc1"
+     }, 
+     "os": {
+      "kernel": "4.15.0-118-generic", 
+      "full": "Ubuntu bionic(18.04.1 LTS (Bionic Beaver))", 
+      "name": "Ubuntu", 
+      "family": "debian", 
+      "platform": "ubuntu", 
+      "version": "18.04.1 LTS (Bionic Beaver)"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "c216aea0-58ba-40a3-b6fe-afa2f5457835"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:30:37.072Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "sdv6996k+S1BiZ/12K3Wi6rb8Lsoh/+shwzKNqujwcmhdbeQ92ygLoO+tudJaJOnL129WT+hhanEf6OgH5PpQBezc03hl9v2AI+BlU+hssfce5OfgFRGLYg8S+ryNHwFhK6EJeN1aivoie+YholNpcpt2l/t+lQpevMI4QYGaMfUzofuivs5JM4=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:54.037Z", 
+    "default_api_key_id": "lq7iwHQBEiA0_Dvk8-Fb", 
+    "last_checkin": "2020-09-24T16:30:37.072Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "geriwHQBXUUrssdIqXB2", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-195.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "fe80::1/64", 
+       "fe80::107d:2365:5a7c:8da/64", 
+       "fdbb:cb5c:fb4:68:1ca7:3a67:de43:950c/64", 
+       "10.0.7.195/22", 
+       "fdbb:cb5c:fb4:68:d4ef:63a5:8ffc:f933/64", 
+       "fdbb:cb5c:fb4:68:b082:8681:cf85:27d0/64", 
+       "fdbb:cb5c:fb4:68:7c3d:13f3:5339:be7b/64", 
+       "fdbb:cb5c:fb4:68:19a4:2a63:cc88:6e59/64", 
+       "fdbb:cb5c:fb4:68:494a:3867:57b8:4027/64", 
+       "fdbb:cb5c:fb4:68:1c88:41e:6ce1:4be7/64", 
+       "fdbb:cb5c:fb4:68:114:b84:8faf:b12b/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-195.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:e4:06"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4231B1A9-25CB-4157-CF54-6BCD11C742E0"
+     }, 
+     "os": {
+      "kernel": "18.2.0", 
+      "full": "Mac OS X(10.14.1)", 
+      "name": "Mac OS X", 
+      "family": "darwin", 
+      "platform": "darwin", 
+      "version": "10.14.1"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:296c368b-35d3-4241-905f-75a24f52ec13", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:30:37.072Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "PEF8+bfiv21Yn5yj8I2/vIaQWMrUQK4PeBBwXsrvmVTsbuFejXM0IQtYVKXShBJAoY9CUEKPCRR4rIIdXWZc51i1ZneLoFw+yBw8BsSwhHfbQXvAVQowH7UqKHp0CiA5J9uGSgmw3Q55a4dv4IHih+sBKji7Qf2durs5gCWUJExrRCpMiU3OHSg=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:56.620Z", 
+    "default_api_key_id": "xOrjwHQBXUUrssdIDnHH", 
+    "last_checkin": "2020-09-24T16:30:37.072Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "S67iwHQBEiA0_Dvks-Cm", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "mainqa-atlcolo-10-0-7-158.eng.endgames.local", 
+      "ip": [
+       "127.0.0.1/8", 
+       "::1/128", 
+       "10.0.7.158/22", 
+       "fdbb:cb5c:fb4:68:250:56ff:feb1:371f/64", 
+       "fe80::250:56ff:feb1:371f/64"
+      ], 
+      "hostname": "mainqa-atlcolo-10-0-7-158.eng.endgames.local", 
+      "mac": [
+       "00:50:56:b1:37:1f"
+      ], 
+      "architecture": "x86_64", 
+      "id": "739e447fc6963034621b714c584eccc1"
+     }, 
+     "os": {
+      "kernel": "4.15.0-38-generic", 
+      "full": "Ubuntu bionic(18.04.1 LTS (Bionic Beaver))", 
+      "name": "Ubuntu", 
+      "family": "debian", 
+      "platform": "ubuntu", 
+      "version": "18.04.1 LTS (Bionic Beaver)"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "296c368b-35d3-4241-905f-75a24f52ec13"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agents:2d187287-658a-4cb6-84d8-d66d1b9a6299", 
+  "source": {
+   "type": "fleet-agents", 
+   "references": [], 
+   "updated_at": "2020-09-24T16:30:37.072Z", 
+   "fleet-agents": {
+    "config_id": "6d9d3630-fe80-11ea-82b3-5be7a91e28b6", 
+    "default_api_key": "fpQcy/QWSbafzl6avELe9goTtyojPwQX3id1pe+BBqDarSCB3k5QwWLQP2SXEl2rwJdywUrBz3gMySKi80RYWJFUoWHiipfaE/jXJRqJxZZvhBe8fdSP7YPkdIdLQl/3ktIWqAzjjS1CErqMb5K4HTZIp5FswDQB40SbDkQKPECl9o8pBhLjH/A=", 
+    "current_error_events": "[]", 
+    "config_revision": 1, 
+    "enrolled_at": "2020-09-24T16:11:28.949Z", 
+    "default_api_key_id": "aeriwHQBXUUrssdIdXAX", 
+    "last_checkin": "2020-09-24T16:30:37.072Z", 
+    "active": true, 
+    "user_provided_metadata": {}, 
+    "access_api_key_id": "Sa7iwHQBEiA0_DvkR99k", 
+    "packages": [
+     "system"
+    ], 
+    "type": "PERMANENT", 
+    "local_metadata": {
+     "host": {
+      "name": "JCHU-WIN10-2", 
+      "ip": [
+       "fdbb:cb5c:fb4:68:dda8:b7a:3e20:9ca0/64", 
+       "fdbb:cb5c:fb4:68:e922:9626:5193:ef68/128", 
+       "fe80::dda8:b7a:3e20:9ca0/64", 
+       "10.0.6.96/22", 
+       "::1/128", 
+       "127.0.0.1/8"
+      ], 
+      "hostname": "JCHU-WIN10-2", 
+      "mac": [
+       "00:50:56:b1:26:07"
+      ], 
+      "architecture": "x86_64", 
+      "id": "4143c277-074e-47a9-b37d-37f94b508705"
+     }, 
+     "os": {
+      "kernel": "10.0.18362.1082 (WinBuild.160101.0800)", 
+      "full": "Windows 10 Pro(10.0)", 
+      "name": "Windows 10 Pro", 
+      "family": "windows", 
+      "platform": "windows", 
+      "version": "10.0"
+     }, 
+     "elastic": {
+      "agent": {
+       "version": "7.9.2", 
+       "id": "2d187287-658a-4cb6-84d8-d66d1b9a6299"
+      }
+     }
+    }
+   }
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:81e5aa90-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:40.138333-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5", 
+    "message": "Application: endpoint-security--7.9.2[b1c968f1-a8cf-4bc4-ac81-110c8ffdbde5]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:40.134985503Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[55,0,2,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":10.21008368,\"mean\":1.91476589372881}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":71143424,\"mean\":53719456}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":3.08880308880309},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsPidMonitorThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsDelayEventThread\"}],\"uptime\":{\"endpoint\":302,\"system\":1901758}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to kernel extension\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"File write event reporting is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Process event reporting is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Network event reporting is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Full Disk Access is enabled\",\"name\":\"full_disk_access\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel extension\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointmacho-v1-blocklist\",\"sha256\":\"da7ca0eaffd840e612acdc064700b3549dc64768d7d127977cc86d9bdaac22ee\"},{\"name\":\"endpointmacho-v1-exceptionlist\",\"sha256\":\"a6d93374c05e88447a3f2aafe0061efc10ff28d324d701436c103194a7594b51\"},{\"name\":\"endpointmacho-v1-model\",\"sha256\":\"213e0b5dcad10504eac23a7056b2e87d1b694da19832366eae8eb85057945c4f\"},{\"name\":\"global-exceptionlist-macos\",\"sha256\":\"4abf799e6b79f0ee66a2e0b3293a92c2a122a083274cbea9d1b2c83bf57ffce7\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-macos-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"49f4e779-287a-4fa8-80e6-247b54c554f1\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"7d59b1a5-afa1-6531-07ea-691602558230\",\"os\":{\"Ext\":{\"variant\":\"macOS\"},\"full\":\"macOS 10.14.1\",\"name\":\"macOS\",\"version\":\"10.14.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:57.177Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:8e652110-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:43.499165-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "5460518c-10c7-4c25-b2ec-3f63eafb7d47", 
+    "message": "Application: endpoint-security--7.9.2[5460518c-10c7-4c25-b2ec-3f63eafb7d47]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:43.495361445Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[44,4,0,2,2,4,1,2,0,0,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":25.33265565,\"mean\":6.21698140807909}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":58376192,\"mean\":46094231}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0.32258064516129},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0.323624595469256},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0.664451827242525},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":9.55882352941176},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsPidMonitorThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsDelayEventThread\"}],\"uptime\":{\"endpoint\":308,\"system\":3807934}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to kernel extension\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"File write event reporting is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Process event reporting is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Network event reporting is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Full Disk Access is enabled\",\"name\":\"full_disk_access\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel extension\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointmacho-v1-blocklist\",\"sha256\":\"da7ca0eaffd840e612acdc064700b3549dc64768d7d127977cc86d9bdaac22ee\"},{\"name\":\"endpointmacho-v1-exceptionlist\",\"sha256\":\"a6d93374c05e88447a3f2aafe0061efc10ff28d324d701436c103194a7594b51\"},{\"name\":\"endpointmacho-v1-model\",\"sha256\":\"213e0b5dcad10504eac23a7056b2e87d1b694da19832366eae8eb85057945c4f\"},{\"name\":\"global-exceptionlist-macos\",\"sha256\":\"4abf799e6b79f0ee66a2e0b3293a92c2a122a083274cbea9d1b2c83bf57ffce7\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-macos-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"full_disk_access\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"b364a499-8e64-4d91-9770-6911c5d6964b\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"ec5403f8-6708-0d58-7aff-b2137b48b816\",\"os\":{\"Ext\":{\"variant\":\"macOS\"},\"full\":\"macOS 10.14.1\",\"name\":\"macOS\",\"version\":\"10.14.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:18:18.145Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:82b7eeb0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:13.3157023-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "ac0ab6c1-2317-478c-93d9-c514d845302d", 
+    "message": "Application: endpoint-security--7.9.2[ac0ab6c1-2317-478c-93d9-c514d845302d]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:13.13714300Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[53,1,0,1,0,0,2,1,0,3,0,0,0,0,0,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":49.0526570938275,\"mean\":4.53577832211642}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":285802496,\"mean\":95647240}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":1.30293159609121},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":3.18021201413428},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"}],\"uptime\":{\"endpoint\":306,\"system\":3625}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to driver\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"Successfully started process event reporting\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Successfuly started sync image load event reporting\",\"name\":\"detect_sync_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfuly started async image load event reporting\",\"name\":\"detect_async_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfully started file write event reporting\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Successfully stopped file open event reporting\",\"name\":\"detect_file_open_events\",\"status\":\"success\"},{\"message\":\"Successfully started network event reporting\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Successfully started registry event reporting\",\"name\":\"detect_registry_events\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling imageload events; current state is enabled\",\"name\":\"configure_imageload_events\",\"status\":\"success\"},{\"message\":\"Success enabling dns events; current state is enabled\",\"name\":\"configure_dns_events\",\"status\":\"success\"},{\"message\":\"Success enabling registry events; current state is enabled\",\"name\":\"configure_registry_events\",\"status\":\"success\"},{\"message\":\"Success enabling security events; current state is enabled\",\"name\":\"configure_security_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointpe-v4-blocklist\",\"sha256\":\"7fdb1b867fd4d2da37870d493e1c67630f59355eab061f91e705f4cc83dd6b9b\"},{\"name\":\"endpointpe-v4-exceptionlist\",\"sha256\":\"e21f3ba186d1563b66bb58b7ff9a362c07448e8f4dec00b2f861bf935cb15d77\"},{\"name\":\"endpointpe-v4-model\",\"sha256\":\"463709447352d429297355247266f641179331171342b3bc3e9c8f6b4b2faed2\"},{\"name\":\"global-exceptionlist-windows\",\"sha256\":\"824859b0c6749cc31951d92a73bbdddfcfe9f38abfe432087934d4dab9766ce8\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-windows-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"detect_file_open_events\",\"detect_async_image_load_events\",\"detect_registry_events\",\"configure_imageload_events\",\"configure_dns_events\",\"configure_security_events\",\"configure_registry_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"detect_file_open_events\",\"detect_sync_image_load_events\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"6474b1bd-96bc-4bde-a770-0e6a7a5bf8c4\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"c85e6c40-d4a1-db21-7458-2565a6b857f3\",\"os\":{\"Ext\":{\"variant\":\"Windows 10 Pro\"},\"full\":\"Windows 10 Pro 1903 (10.0.18362.1082)\",\"name\":\"Windows\",\"version\":\"1903 (10.0.18362.1082)\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:58.555Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:80a6c1f0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:54.930717796-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "c216aea0-58ba-40a3-b6fe-afa2f5457835", 
+    "message": "Application: endpoint-security--7.9.2[c216aea0-58ba-40a3-b6fe-afa2f5457835]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:54.929290223Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[57,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":3,\"mean\":3.49666666666667}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":49778688,\"mean\":31986824}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":2.12765957446809},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0.72992700729927},\"name\":\"EventsLoopThread\"}],\"uptime\":{\"endpoint\":300,\"system\":3863}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"a15f0431-6835-41c4-a7ee-21a70d41cf5b\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"20ccfdfa-323f-e33e-f2ef-3528edb1afea\",\"os\":{\"Ext\":{\"variant\":\"Ubuntu\"},\"full\":\"Ubuntu 18.04.1\",\"name\":\"Linux\",\"version\":\"18.04.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:55.087Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:7bdc8fb0-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:45.675453579-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "296c368b-35d3-4241-905f-75a24f52ec13", 
+    "message": "Application: endpoint-security--7.9.2[296c368b-35d3-4241-905f-75a24f52ec13]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:45.674010613Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[57,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":2.8,\"mean\":3.17}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":49278976,\"mean\":31884356}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":2.12765957446809},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"},{\"cpu\":{\"mean\":0.72992700729927},\"name\":\"EventsLoopThread\"}],\"uptime\":{\"endpoint\":300,\"system\":5000305}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"6f0cb2fc-3e46-4435-8892-d9f7e71b23fd\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"e9909692-0e35-fd30-e3a3-e2e7253bb5c7\",\"os\":{\"Ext\":{\"variant\":\"Ubuntu\"},\"full\":\"Ubuntu 18.04.1\",\"name\":\"Linux\",\"version\":\"18.04.1\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:47.051Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
+
+{
+ "type": "doc", 
+ "value": {
+  "index": ".kibana_1", 
+  "type": "_doc", 
+  "id": "fleet-agent-events:7cbf9cb1-fe81-11ea-ac23-9bd6426c270f", 
+  "source": {
+   "references": [], 
+   "fleet-agent-events": {
+    "config_id": "81188c00-fe80-11ea-82b3-5be7a91e28b6", 
+    "timestamp": "2020-09-24T12:17:15.400204-04:00", 
+    "subtype": "RUNNING", 
+    "agent_id": "2d187287-658a-4cb6-84d8-d66d1b9a6299", 
+    "message": "Application: endpoint-security--7.9.2[2d187287-658a-4cb6-84d8-d66d1b9a6299]: State changed to RUNNING: ", 
+    "type": "STATE", 
+    "payload": "{\"endpoint-security\":{\"@timestamp\":\"2020-09-24T16:17:15.96990100Z\",\"Endpoint\":{\"configuration\":{\"inputs\":[{\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"policy\":{\"linux\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"}},\"mac\":{\"events\":{\"file\":true,\"network\":true,\"process\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}},\"windows\":{\"events\":{\"dll_and_driver_load\":true,\"dns\":true,\"file\":true,\"network\":true,\"process\":true,\"registry\":true,\"security\":true},\"logging\":{\"file\":\"info\"},\"malware\":{\"mode\":\"prevent\"}}}}]},\"metrics\":{\"cpu\":{\"endpoint\":{\"histogram\":{\"counts\":[46,2,2,2,4,2,0,0,0,2,0,0,0,0,1,0,0,0,0,0],\"values\":[5,10,15,20,25,30,35,40,45,50,55,60,65,70,75,80,85,90,95,100]},\"latest\":48.3070275492921,\"mean\":6.43134047264261}},\"memory\":{\"endpoint\":{\"private\":{\"latest\":228757504,\"mean\":94594836}}},\"threads\":[{\"cpu\":{\"mean\":0},\"name\":\"Cron\"},{\"cpu\":{\"mean\":0},\"name\":\"File Cache\"},{\"cpu\":{\"mean\":0},\"name\":\"FileLogThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingMaintenance\"},{\"cpu\":{\"mean\":0},\"name\":\"BulkConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DocumentLoggingConsumerThread\"},{\"cpu\":{\"mean\":1.30293159609121},\"name\":\"ArtifactManifestDownload\"},{\"cpu\":{\"mean\":0},\"name\":\"PerformanceMonitorWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"MetadataThread\"},{\"cpu\":{\"mean\":0},\"name\":\"EventsQueueThread\"},{\"cpu\":{\"mean\":0},\"name\":\"FileScoreAsyncEventThread\"},{\"cpu\":{\"mean\":0},\"name\":\"QuarantineManagerWorkerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"DelayedAlertEnrichment\"},{\"cpu\":{\"mean\":0},\"name\":\"grpcConnectionManagerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":1.9672131147541},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":2.62295081967213},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncMessageThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelAsyncMessageQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelSyncQueueConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":0.655737704918033},\"name\":\"KernelPortConsumerThread\"},{\"cpu\":{\"mean\":2.11267605633803},\"name\":\"checkinAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"actionsAPIThread\"},{\"cpu\":{\"mean\":0},\"name\":\"stateReportThread\"}],\"uptime\":{\"endpoint\":307,\"system\":3654}},\"policy\":{\"applied\":{\"actions\":[{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"read_elasticsearch_config\",\"status\":\"success\"},{\"message\":\"Successfully read events configuration\",\"name\":\"read_events_config\",\"status\":\"success\"},{\"message\":\"Successfully read malware prevent configuration\",\"name\":\"read_malware_config\",\"status\":\"success\"},{\"message\":\"Succesfully read kernel configuration\",\"name\":\"read_kernel_config\",\"status\":\"success\"},{\"message\":\"Successfully read logging configuration\",\"name\":\"read_logging_config\",\"status\":\"success\"},{\"message\":\"Successfully parsed configuration\",\"name\":\"load_config\",\"status\":\"success\"},{\"message\":\"Successfully downloaded user artifacts\",\"name\":\"download_user_artifacts\",\"status\":\"success\"},{\"message\":\"Global artifacts are available for use\",\"name\":\"download_global_artifacts\",\"status\":\"success\"},{\"message\":\"Successfully configured logging\",\"name\":\"configure_logging\",\"status\":\"success\"},{\"message\":\"Successfully read Elasticsearch configuration\",\"name\":\"configure_elasticsearch_connection\",\"status\":\"success\"},{\"message\":\"Successfully connected to driver\",\"name\":\"connect_kernel\",\"status\":\"success\"},{\"message\":\"Successfully started process event reporting\",\"name\":\"detect_process_events\",\"status\":\"success\"},{\"message\":\"Successfuly started sync image load event reporting\",\"name\":\"detect_sync_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfuly started async image load event reporting\",\"name\":\"detect_async_image_load_events\",\"status\":\"success\"},{\"message\":\"Successfully started file write event reporting\",\"name\":\"detect_file_write_events\",\"status\":\"success\"},{\"message\":\"Successfully stopped file open event reporting\",\"name\":\"detect_file_open_events\",\"status\":\"success\"},{\"message\":\"Successfully started network event reporting\",\"name\":\"detect_network_events\",\"status\":\"success\"},{\"message\":\"Successfully started registry event reporting\",\"name\":\"detect_registry_events\",\"status\":\"success\"},{\"message\":\"Successfully configured kernel\",\"name\":\"configure_kernel\",\"status\":\"success\"},{\"message\":\"Successfully loaded malware model\",\"name\":\"load_malware_model\",\"status\":\"success\"},{\"message\":\"Successfully configured malware prevention/detection\",\"name\":\"configure_malware\",\"status\":\"success\"},{\"message\":\"Success enabling file events; current state is enabled\",\"name\":\"configure_file_events\",\"status\":\"success\"},{\"message\":\"Success enabling network events; current state is enabled\",\"name\":\"configure_network_events\",\"status\":\"success\"},{\"message\":\"Success enabling process events; current state is enabled\",\"name\":\"configure_process_events\",\"status\":\"success\"},{\"message\":\"Success enabling imageload events; current state is enabled\",\"name\":\"configure_imageload_events\",\"status\":\"success\"},{\"message\":\"Success enabling dns events; current state is enabled\",\"name\":\"configure_dns_events\",\"status\":\"success\"},{\"message\":\"Success enabling registry events; current state is enabled\",\"name\":\"configure_registry_events\",\"status\":\"success\"},{\"message\":\"Success enabling security events; current state is enabled\",\"name\":\"configure_security_events\",\"status\":\"success\"},{\"message\":\"Successfully connected to Agent\",\"name\":\"agent_connectivity\",\"status\":\"success\"},{\"message\":\"Successfully executed all workflows\",\"name\":\"workflow\",\"status\":\"success\"}],\"artifacts\":{\"global\":{\"identifiers\":[{\"name\":\"endpointpe-v4-blocklist\",\"sha256\":\"7fdb1b867fd4d2da37870d493e1c67630f59355eab061f91e705f4cc83dd6b9b\"},{\"name\":\"endpointpe-v4-exceptionlist\",\"sha256\":\"e21f3ba186d1563b66bb58b7ff9a362c07448e8f4dec00b2f861bf935cb15d77\"},{\"name\":\"endpointpe-v4-model\",\"sha256\":\"463709447352d429297355247266f641179331171342b3bc3e9c8f6b4b2faed2\"},{\"name\":\"global-exceptionlist-windows\",\"sha256\":\"824859b0c6749cc31951d92a73bbdddfcfe9f38abfe432087934d4dab9766ce8\"}],\"version\":\"1.0.0\"},\"user\":{\"identifiers\":[{\"name\":\"endpoint-exceptionlist-windows-v1\",\"sha256\":\"d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658\"}],\"version\":\"1.0.0\"}},\"id\":\"8f802370-fe80-11ea-82b3-5be7a91e28b6\",\"response\":{\"configurations\":{\"events\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"read_events_config\",\"detect_process_events\",\"detect_file_write_events\",\"detect_network_events\",\"configure_file_events\",\"configure_network_events\",\"configure_process_events\",\"read_kernel_config\",\"configure_kernel\",\"connect_kernel\",\"detect_file_open_events\",\"detect_async_image_load_events\",\"detect_registry_events\",\"configure_imageload_events\",\"configure_dns_events\",\"configure_security_events\",\"configure_registry_events\"],\"status\":\"success\"},\"logging\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_logging_config\",\"configure_logging\",\"workflow\"],\"status\":\"success\"},\"malware\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"workflow\",\"download_global_artifacts\",\"download_user_artifacts\",\"configure_malware\",\"read_malware_config\",\"load_malware_model\",\"read_kernel_config\",\"configure_kernel\",\"detect_process_events\",\"detect_file_write_events\",\"connect_kernel\",\"detect_file_open_events\",\"detect_sync_image_load_events\"],\"status\":\"success\"},\"streaming\":{\"concerned_actions\":[\"agent_connectivity\",\"load_config\",\"read_elasticsearch_config\",\"configure_elasticsearch_connection\",\"workflow\"],\"status\":\"success\"}}},\"status\":\"success\"}}},\"agent\":{\"id\":\"21d182a2-5a08-41bb-b601-5d2b4aba4ecd\",\"version\":\"7.9.2\"},\"ecs\":{\"version\":\"1.5.0\"},\"event\":{\"action\":\"elastic_endpoint_telemetry\"},\"host\":{\"architecture\":\"x86_64\",\"id\":\"327d0e20-483e-95af-f4e4-7b065606e1aa\",\"os\":{\"Ext\":{\"variant\":\"Windows 10 Pro\"},\"full\":\"Windows 10 Pro 1903 (10.0.18362.1082)\",\"name\":\"Windows\",\"version\":\"1903 (10.0.18362.1082)\"}}}}"
+   }, 
+   "updated_at": "2020-09-24T16:17:48.539Z", 
+   "type": "fleet-agent-events"
+  }
+ }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/mappings.json b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/mappings.json
new file mode 100644
index 0000000000000..27aea27bebcd7
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/telemetry/cloned_endpoint_uninstalled/mappings.json
@@ -0,0 +1,2592 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "7b44fba6773e37c806ce290ea9b7024e",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "app_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_daily": "43b8830d5d0df85a6823d290885fc9fd",
+          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_transactional": "3d1b76c39bfb2cc8296b024d73854724",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
+          "cases": "32aa96a6d3855ddda53010ae2048ac22",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "cases-configure": "42711cbb311976c0687853f4c1354572",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "config": "c63748b75f39d0c54de12d12c1ccbc20",
+          "dashboard": "d00f614b29a80360e1190193fd333bab",
+          "endpoint:user-artifact": "4a11183eee21e6fbad864f7a30b39ad0",
+          "endpoint:user-artifact-manifest": "4b9c0e7cfaf86d82a7ee9ed68065e50d",
+          "epm-packages": "8f6e0b09ea0374c4ffe98c3755373cff",
+          "exception-list": "497afa2f881a675d72d58e20057f3d8b",
+          "exception-list-agnostic": "497afa2f881a675d72d58e20057f3d8b",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "fleet-agent-actions": "e520c855577170c24481be05c3ae14ec",
+          "fleet-agent-events": "3231653fafe4ef3196fe3b32ab774bf2",
+          "fleet-agents": "034346488514b7058a79140b19ddf631",
+          "fleet-enrollment-api-keys": "28b91e20b105b6f928e2012600085d8f",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "66eccb05066c5a89924f48a9e9736499",
+          "infrastructure-ui-source": "2b2809653635caf490c93f090502d04c",
+          "ingest-agent-policies": "9326f99c977fd2ef5ab24b6336a0675c",
+          "ingest-outputs": "8aa988c376e65443fefc26f1075e93a3",
+          "ingest-package-policies": "8545e51d7bc8286d6dace3d41240d749",
+          "ingest_manager_settings": "012cf278ec84579495110bb827d1ed09",
+          "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "d33c68a69ff1e78c9888dedd2164ac22",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "4a05b35c3a3a58fbc72dd0202dc3487f",
+          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
+          "metrics-explorer-view": "a8df1d270ee48c969d22d23812d08187",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "5c4b9a6effceb17ae8a0ab22d0c49767",
+          "search-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "siem-detection-engine-rule-actions": "6569b288c169539db10cb262bf79de18",
+          "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
+          "siem-ui-timeline": "94bc38c7a421d15fbfe8ea565370a421",
+          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
+          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "215107c281839ea9b3ad5f6419819763",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "uptime-dynamic-settings": "fcdb453a30092f022f2642db29523d80",
+          "url": "c7f66a0df8b1b52f17c28c4adb111105",
+          "visualization": "52d7a13ad68a150c4525b292d23e12cc",
+          "workplace_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "apm-indices": {
+          "properties": {
+            "apm_oss": {
+              "properties": {
+                "errorIndices": {
+                  "type": "keyword"
+                },
+                "metricsIndices": {
+                  "type": "keyword"
+                },
+                "onboardingIndices": {
+                  "type": "keyword"
+                },
+                "sourcemapIndices": {
+                  "type": "keyword"
+                },
+                "spanIndices": {
+                  "type": "keyword"
+                },
+                "transactionIndices": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apm-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "app_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_daily": {
+          "dynamic": "false",
+          "properties": {
+            "timestamp": {
+              "type": "date"
+            }
+          }
+        },
+        "application_usage_totals": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_transactional": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "canvas-element": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "content": {
+              "type": "text"
+            },
+            "help": {
+              "type": "text"
+            },
+            "image": {
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad-template": {
+          "dynamic": "false",
+          "properties": {
+            "help": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "tags": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "template_key": {
+              "type": "keyword"
+            }
+          }
+        },
+        "cases": {
+          "properties": {
+            "closed_at": {
+              "type": "date"
+            },
+            "closed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "external_service": {
+              "properties": {
+                "connector_id": {
+                  "type": "keyword"
+                },
+                "connector_name": {
+                  "type": "keyword"
+                },
+                "external_id": {
+                  "type": "keyword"
+                },
+                "external_title": {
+                  "type": "text"
+                },
+                "external_url": {
+                  "type": "text"
+                },
+                "pushed_at": {
+                  "type": "date"
+                },
+                "pushed_by": {
+                  "properties": {
+                    "email": {
+                      "type": "keyword"
+                    },
+                    "full_name": {
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-comments": {
+          "properties": {
+            "comment": {
+              "type": "text"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "pushed_at": {
+              "type": "date"
+            },
+            "pushed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-configure": {
+          "properties": {
+            "closure_type": {
+              "type": "keyword"
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "connector_name": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-user-actions": {
+          "properties": {
+            "action": {
+              "type": "keyword"
+            },
+            "action_at": {
+              "type": "date"
+            },
+            "action_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "action_field": {
+              "type": "keyword"
+            },
+            "new_value": {
+              "type": "text"
+            },
+            "old_value": {
+              "type": "text"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "false",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "type": "text"
+            },
+            "panelsJSON": {
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "type": "keyword"
+                },
+                "pause": {
+                  "type": "boolean"
+                },
+                "section": {
+                  "type": "integer"
+                },
+                "value": {
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "type": "boolean"
+            },
+            "timeTo": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "endpoint:user-artifact": {
+          "properties": {
+            "body": {
+              "type": "binary"
+            },
+            "compressionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "decodedSha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "decodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encodedSha256": {
+              "type": "keyword"
+            },
+            "encodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encryptionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "identifier": {
+              "type": "keyword"
+            }
+          }
+        },
+        "endpoint:user-artifact-manifest": {
+          "properties": {
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "ids": {
+              "index": false,
+              "type": "keyword"
+            },
+            "schemaVersion": {
+              "type": "keyword"
+            },
+            "semanticVersion": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "epm-packages": {
+          "properties": {
+            "es_index_patterns": {
+              "enabled": false,
+              "type": "object"
+            },
+            "installed_es": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "installed_kibana": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "internal": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "removable": {
+              "type": "boolean"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list-agnostic": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "file-upload-telemetry": {
+          "properties": {
+            "filesUploadedTotalCount": {
+              "type": "long"
+            }
+          }
+        },
+        "fleet-agent-actions": {
+          "properties": {
+            "agent_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "data": {
+              "type": "binary"
+            },
+            "sent_at": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agent-events": {
+          "properties": {
+            "action_id": {
+              "type": "keyword"
+            },
+            "agent_id": {
+              "type": "keyword"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "data": {
+              "type": "text"
+            },
+            "message": {
+              "type": "text"
+            },
+            "payload": {
+              "type": "text"
+            },
+            "stream_id": {
+              "type": "keyword"
+            },
+            "subtype": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agents": {
+          "properties": {
+            "access_api_key_id": {
+              "type": "keyword"
+            },
+            "active": {
+              "type": "boolean"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "config_revision": {
+              "type": "integer"
+            },
+            "current_error_events": {
+              "index": false,
+              "type": "text"
+            },
+            "default_api_key": {
+              "type": "binary"
+            },
+            "default_api_key_id": {
+              "type": "keyword"
+            },
+            "enrolled_at": {
+              "type": "date"
+            },
+            "last_checkin": {
+              "type": "date"
+            },
+            "last_checkin_status": {
+              "type": "keyword"
+            },
+            "last_updated": {
+              "type": "date"
+            },
+            "local_metadata": {
+              "type": "flattened"
+            },
+            "packages": {
+              "type": "keyword"
+            },
+            "shared_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "unenrolled_at": {
+              "type": "date"
+            },
+            "unenrollment_started_at": {
+              "type": "date"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "user_provided_metadata": {
+              "type": "flattened"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-enrollment-api-keys": {
+          "properties": {
+            "active": {
+              "type": "boolean"
+            },
+            "api_key": {
+              "type": "binary"
+            },
+            "api_key_id": {
+              "type": "keyword"
+            },
+            "config_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "expire_at": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "index-pattern": {
+          "properties": {
+            "fieldFormatMap": {
+              "type": "text"
+            },
+            "fields": {
+              "type": "text"
+            },
+            "intervalName": {
+              "type": "keyword"
+            },
+            "notExpandable": {
+              "type": "boolean"
+            },
+            "sourceFilters": {
+              "type": "text"
+            },
+            "timeFieldName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "typeMeta": {
+              "type": "keyword"
+            }
+          }
+        },
+        "infrastructure-ui-source": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "fields": {
+              "properties": {
+                "container": {
+                  "type": "keyword"
+                },
+                "host": {
+                  "type": "keyword"
+                },
+                "pod": {
+                  "type": "keyword"
+                },
+                "tiebreaker": {
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "inventoryDefaultView": {
+              "type": "keyword"
+            },
+            "logAlias": {
+              "type": "keyword"
+            },
+            "logColumns": {
+              "properties": {
+                "fieldColumn": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "messageColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestampColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "metricAlias": {
+              "type": "keyword"
+            },
+            "metricsExplorerDefaultView": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "ingest-agent-policies": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "monitoring_enabled": {
+              "index": false,
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "package_configs": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-outputs": {
+          "properties": {
+            "ca_sha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "config": {
+              "type": "flattened"
+            },
+            "fleet_enroll_password": {
+              "type": "binary"
+            },
+            "fleet_enroll_username": {
+              "type": "binary"
+            },
+            "hosts": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-package-policies": {
+          "properties": {
+            "config_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "inputs": {
+              "enabled": false,
+              "properties": {
+                "config": {
+                  "type": "flattened"
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "streams": {
+                  "properties": {
+                    "compiled_stream": {
+                      "type": "flattened"
+                    },
+                    "config": {
+                      "type": "flattened"
+                    },
+                    "data_stream": {
+                      "properties": {
+                        "dataset": {
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "vars": {
+                      "type": "flattened"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "vars": {
+                  "type": "flattened"
+                }
+              },
+              "type": "nested"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "output_id": {
+              "type": "keyword"
+            },
+            "package": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                },
+                "title": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest_manager_settings": {
+          "properties": {
+            "agent_auto_upgrade": {
+              "type": "keyword"
+            },
+            "has_seen_add_data_notice": {
+              "index": false,
+              "type": "boolean"
+            },
+            "kibana_ca_sha256": {
+              "type": "keyword"
+            },
+            "kibana_url": {
+              "type": "keyword"
+            },
+            "package_auto_upgrade": {
+              "type": "keyword"
+            }
+          }
+        },
+        "inventory-view": {
+          "properties": {
+            "accountId": {
+              "type": "keyword"
+            },
+            "autoBounds": {
+              "type": "boolean"
+            },
+            "autoReload": {
+              "type": "boolean"
+            },
+            "boundsOverride": {
+              "properties": {
+                "max": {
+                  "type": "integer"
+                },
+                "min": {
+                  "type": "integer"
+                }
+              }
+            },
+            "customMetrics": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "customOptions": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "text": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "filterQuery": {
+              "properties": {
+                "expression": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "groupBy": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "legend": {
+              "properties": {
+                "palette": {
+                  "type": "keyword"
+                },
+                "reverseColors": {
+                  "type": "boolean"
+                },
+                "steps": {
+                  "type": "long"
+                }
+              }
+            },
+            "metric": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "nodeType": {
+              "type": "keyword"
+            },
+            "region": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "by": {
+                  "type": "keyword"
+                },
+                "direction": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "time": {
+              "type": "long"
+            },
+            "view": {
+              "type": "keyword"
+            }
+          }
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "lens": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "expression": {
+              "index": false,
+              "type": "keyword"
+            },
+            "state": {
+              "type": "flattened"
+            },
+            "title": {
+              "type": "text"
+            },
+            "visualizationType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens-ui-telemetry": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            },
+            "date": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "maps-telemetry": {
+          "enabled": false,
+          "type": "object"
+        },
+        "metrics-explorer-view": {
+          "properties": {
+            "chartOptions": {
+              "properties": {
+                "stack": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "yAxisMode": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "currentTimerange": {
+              "properties": {
+                "from": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "options": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "filterQuery": {
+                  "type": "keyword"
+                },
+                "forceInterval": {
+                  "type": "boolean"
+                },
+                "groupBy": {
+                  "type": "keyword"
+                },
+                "limit": {
+                  "type": "integer"
+                },
+                "metrics": {
+                  "properties": {
+                    "aggregation": {
+                      "type": "keyword"
+                    },
+                    "color": {
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "label": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "source": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "dashboard": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "index-pattern": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "search": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "visualization": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-telemetry": {
+          "properties": {
+            "file_data_visualizer": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "sample-data-telemetry": {
+          "properties": {
+            "installCount": {
+              "type": "long"
+            },
+            "unInstallCount": {
+              "type": "long"
+            }
+          }
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "index": false,
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "index": false,
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "search-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "siem-detection-engine-rule-actions": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "action_type_id": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              }
+            },
+            "alertThrottle": {
+              "type": "keyword"
+            },
+            "ruleAlertId": {
+              "type": "keyword"
+            },
+            "ruleThrottle": {
+              "type": "keyword"
+            }
+          }
+        },
+        "siem-detection-engine-rule-status": {
+          "properties": {
+            "alertId": {
+              "type": "keyword"
+            },
+            "bulkCreateTimeDurations": {
+              "type": "float"
+            },
+            "gap": {
+              "type": "text"
+            },
+            "lastFailureAt": {
+              "type": "date"
+            },
+            "lastFailureMessage": {
+              "type": "text"
+            },
+            "lastLookBackDate": {
+              "type": "date"
+            },
+            "lastSuccessAt": {
+              "type": "date"
+            },
+            "lastSuccessMessage": {
+              "type": "text"
+            },
+            "searchAfterTimeDurations": {
+              "type": "float"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "statusDate": {
+              "type": "date"
+            }
+          }
+        },
+        "siem-ui-timeline": {
+          "properties": {
+            "columns": {
+              "properties": {
+                "aggregatable": {
+                  "type": "boolean"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "columnHeaderType": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "text"
+                },
+                "example": {
+                  "type": "text"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "indexes": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "placeholder": {
+                  "type": "text"
+                },
+                "searchable": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "dataProviders": {
+              "properties": {
+                "and": {
+                  "properties": {
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "excluded": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "kqlQuery": {
+                      "type": "text"
+                    },
+                    "name": {
+                      "type": "text"
+                    },
+                    "queryMatch": {
+                      "properties": {
+                        "displayField": {
+                          "type": "text"
+                        },
+                        "displayValue": {
+                          "type": "text"
+                        },
+                        "field": {
+                          "type": "text"
+                        },
+                        "operator": {
+                          "type": "text"
+                        },
+                        "value": {
+                          "type": "text"
+                        }
+                      }
+                    },
+                    "type": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "excluded": {
+                  "type": "boolean"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kqlQuery": {
+                  "type": "text"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "queryMatch": {
+                  "properties": {
+                    "displayField": {
+                      "type": "text"
+                    },
+                    "displayValue": {
+                      "type": "text"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "operator": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "type": {
+                  "type": "text"
+                }
+              }
+            },
+            "dateRange": {
+              "properties": {
+                "end": {
+                  "type": "date"
+                },
+                "start": {
+                  "type": "date"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "eventType": {
+              "type": "keyword"
+            },
+            "excludedRowRendererIds": {
+              "type": "text"
+            },
+            "favorite": {
+              "properties": {
+                "favoriteDate": {
+                  "type": "date"
+                },
+                "fullName": {
+                  "type": "text"
+                },
+                "keySearch": {
+                  "type": "text"
+                },
+                "userName": {
+                  "type": "text"
+                }
+              }
+            },
+            "filters": {
+              "properties": {
+                "exists": {
+                  "type": "text"
+                },
+                "match_all": {
+                  "type": "text"
+                },
+                "meta": {
+                  "properties": {
+                    "alias": {
+                      "type": "text"
+                    },
+                    "controlledBy": {
+                      "type": "text"
+                    },
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "formattedValue": {
+                      "type": "text"
+                    },
+                    "index": {
+                      "type": "keyword"
+                    },
+                    "key": {
+                      "type": "keyword"
+                    },
+                    "negate": {
+                      "type": "boolean"
+                    },
+                    "params": {
+                      "type": "text"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "missing": {
+                  "type": "text"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "range": {
+                  "type": "text"
+                },
+                "script": {
+                  "type": "text"
+                }
+              }
+            },
+            "kqlMode": {
+              "type": "keyword"
+            },
+            "kqlQuery": {
+              "properties": {
+                "filterQuery": {
+                  "properties": {
+                    "kuery": {
+                      "properties": {
+                        "expression": {
+                          "type": "text"
+                        },
+                        "kind": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "serializedQuery": {
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            },
+            "savedQueryId": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "columnId": {
+                  "type": "keyword"
+                },
+                "sortDirection": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "templateTimelineId": {
+              "type": "text"
+            },
+            "templateTimelineVersion": {
+              "type": "integer"
+            },
+            "timelineType": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-note": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "note": {
+              "type": "text"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-pinned-event": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "telemetry": {
+          "properties": {
+            "allowChangingOptInStatus": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "lastReported": {
+              "type": "date"
+            },
+            "lastVersionChecked": {
+              "type": "keyword"
+            },
+            "reportFailureCount": {
+              "type": "integer"
+            },
+            "reportFailureVersion": {
+              "type": "keyword"
+            },
+            "sendUsageFrom": {
+              "type": "keyword"
+            },
+            "userHasSeenNotice": {
+              "type": "boolean"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "tsvb-validation-telemetry": {
+          "properties": {
+            "failedRequests": {
+              "type": "long"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "upgrade-assistant-reindex-operation": {
+          "properties": {
+            "errorMessage": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "indexName": {
+              "type": "keyword"
+            },
+            "lastCompletedStep": {
+              "type": "long"
+            },
+            "locked": {
+              "type": "date"
+            },
+            "newIndexName": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexOptions": {
+              "properties": {
+                "openAndClose": {
+                  "type": "boolean"
+                },
+                "queueSettings": {
+                  "properties": {
+                    "queuedAt": {
+                      "type": "long"
+                    },
+                    "startedAt": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "reindexTaskId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexTaskPercComplete": {
+              "type": "float"
+            },
+            "runningReindexCount": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "integer"
+            }
+          }
+        },
+        "upgrade-assistant-telemetry": {
+          "properties": {
+            "features": {
+              "properties": {
+                "deprecation_logging": {
+                  "properties": {
+                    "enabled": {
+                      "null_value": true,
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            },
+            "ui_open": {
+              "properties": {
+                "cluster": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "indices": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "overview": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            },
+            "ui_reindex": {
+              "properties": {
+                "close": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "open": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "start": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "stop": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "uptime-dynamic-settings": {
+          "properties": {
+            "certAgeThreshold": {
+              "type": "long"
+            },
+            "certExpirationThreshold": {
+              "type": "long"
+            },
+            "heartbeatIndices": {
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "type": "text"
+            }
+          }
+        },
+        "workplace_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_telemetry.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_telemetry.ts
index 533ce49b14325..eb0cf4a34b2cc 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_telemetry.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_telemetry.ts
@@ -157,5 +157,123 @@ export default function ({ getService }: FtrProviderContext) {
         });
       });
     });
+    describe('when agents are connected with cloned endpoints', () => {
+      describe('with endpoint integration installed with malware enabled', () => {
+        before(async () => {
+          await telemetryTestResources.getArchiveSetCheckIn(
+            'cloned_endpoint_installed',
+            'cloned_endpoint_test',
+            0
+          );
+          await esArchiver.load('endpoint/telemetry/cloned_endpoint_test');
+          await telemetryTestResources.deleteArchive('cloned_endpoint_test');
+        });
+        it('reports all endpoints and policies', async () => {
+          const endpointTelemetry = await telemetryTestResources.getEndpointTelemetry();
+          expect(endpointTelemetry).to.eql({
+            total_installed: 6,
+            active_within_last_24_hours: 6,
+            os: [
+              {
+                full_name: 'Ubuntu bionic(18.04.1 LTS (Bionic Beaver))',
+                platform: 'ubuntu',
+                version: '18.04.1 LTS (Bionic Beaver)',
+                count: 2,
+              },
+              {
+                full_name: 'Mac OS X(10.14.1)',
+                platform: 'darwin',
+                version: '10.14.1',
+                count: 2,
+              },
+              {
+                full_name: 'Windows 10 Pro(10.0)',
+                platform: 'windows',
+                version: '10.0',
+                count: 2,
+              },
+            ],
+            policies: {
+              malware: {
+                active: 4,
+                inactive: 0,
+                failure: 0,
+              },
+            },
+          });
+        });
+      });
+      describe('with endpoint integration installed on half the endpoints with malware enabled', () => {
+        before(async () => {
+          await telemetryTestResources.getArchiveSetCheckIn(
+            'cloned_endpoint_different_states',
+            'cloned_endpoint_test',
+            0
+          );
+          await esArchiver.load('endpoint/telemetry/cloned_endpoint_test');
+          await telemetryTestResources.deleteArchive('cloned_endpoint_test');
+        });
+        it('reports all endpoints and policies', async () => {
+          const endpointTelemetry = await telemetryTestResources.getEndpointTelemetry();
+          expect(endpointTelemetry).to.eql({
+            total_installed: 3,
+            active_within_last_24_hours: 3,
+            os: [
+              {
+                full_name: 'Mac OS X(10.14.1)',
+                platform: 'darwin',
+                version: '10.14.1',
+                count: 1,
+              },
+              {
+                full_name: 'Ubuntu bionic(18.04.1 LTS (Bionic Beaver))',
+                platform: 'ubuntu',
+                version: '18.04.1 LTS (Bionic Beaver)',
+                count: 1,
+              },
+              {
+                full_name: 'Windows 10 Pro(10.0)',
+                platform: 'windows',
+                version: '10.0',
+                count: 1,
+              },
+            ],
+            policies: {
+              malware: {
+                active: 2,
+                inactive: 0,
+                failure: 0,
+              },
+            },
+          });
+        });
+      });
+      describe('with endpoint integration uninstalled', () => {
+        before(async () => {
+          await telemetryTestResources.getArchiveSetCheckIn(
+            'cloned_endpoint_uninstalled',
+            'cloned_endpoint_test',
+            0
+          );
+          await esArchiver.load('endpoint/telemetry/cloned_endpoint_test');
+          await telemetryTestResources.deleteArchive('cloned_endpoint_test');
+        });
+        it('reports all endpoints and policies', async () => {
+          const endpointTelemetry = await telemetryTestResources.getEndpointTelemetry();
+          expect(endpointTelemetry).to.eql({
+            total_installed: 0,
+            active_within_last_24_hours: 0,
+            os: [],
+            policies: {
+              malware: {
+                active: 0,
+                inactive: 0,
+                failure: 0,
+              },
+            },
+          });
+        });
+      });
+    });
   });
 }

From 5da9650f21337591cf4e62b8a218425b47abb6b2 Mon Sep 17 00:00:00 2001
From: Kaarina Tungseth <kaarina.tungseth@elastic.co>
Date: Tue, 1 Dec 2020 12:39:42 -0600
Subject: [PATCH 15/28] Changes UI links for drilldowns (#83971)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 src/core/public/doc_links/doc_links_service.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index 6af14734444d1..15df6b34e22ff 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -39,9 +39,9 @@ export class DocLinksService {
         dashboard: {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/dashboard.html`,
           drilldowns: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/drilldowns.html`,
-          drilldownsTriggerPicker: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/drilldowns.html#url-drilldown`,
+          drilldownsTriggerPicker: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/drilldowns.html#url-drilldowns`,
           urlDrilldownTemplateSyntax: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/url_templating-language.html`,
-          urlDrilldownVariables: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/url_templating-language.html#variables`,
+          urlDrilldownVariables: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/url_templating-language.html#url-template-variables`,
         },
         filebeat: {
           base: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}`,

From 78faa107aabc2b0ce6eed88f19633617244e19a1 Mon Sep 17 00:00:00 2001
From: Scotty Bollinger <scotty.bollinger@elastic.co>
Date: Tue, 1 Dec 2020 12:47:57 -0600
Subject: [PATCH 16/28] Add routes for use in Sources Schema (#84579)

---
 .../routes/workplace_search/sources.test.ts   | 272 ++++++++++++++++++
 .../server/routes/workplace_search/sources.ts | 172 +++++++++++
 2 files changed, 444 insertions(+)

diff --git a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.test.ts b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.test.ts
index 62f4dceeac363..d97a587e57ff2 100644
--- a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.test.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.test.ts
@@ -19,6 +19,9 @@ import {
   registerAccountPrepareSourcesRoute,
   registerAccountSourceSearchableRoute,
   registerAccountSourceDisplaySettingsConfig,
+  registerAccountSourceSchemasRoute,
+  registerAccountSourceReindexJobRoute,
+  registerAccountSourceReindexJobStatusRoute,
   registerOrgSourcesRoute,
   registerOrgSourcesStatusRoute,
   registerOrgSourceRoute,
@@ -31,6 +34,9 @@ import {
   registerOrgPrepareSourcesRoute,
   registerOrgSourceSearchableRoute,
   registerOrgSourceDisplaySettingsConfig,
+  registerOrgSourceSchemasRoute,
+  registerOrgSourceReindexJobRoute,
+  registerOrgSourceReindexJobStatusRoute,
   registerOrgSourceOauthConfigurationsRoute,
   registerOrgSourceOauthConfigurationRoute,
 } from './sources';
@@ -523,6 +529,139 @@ describe('sources routes', () => {
     });
   });
 
+  describe('GET /api/workplace_search/account/sources/{id}/schemas', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('creates a request handler', () => {
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/workplace_search/account/sources/{id}/schemas',
+        payload: 'params',
+      });
+
+      registerAccountSourceSchemasRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+
+      const mockRequest = {
+        params: {
+          id: '123',
+        },
+      };
+
+      mockRouter.callRoute(mockRequest);
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/sources/123/schemas',
+      });
+    });
+  });
+
+  describe('POST /api/workplace_search/account/sources/{id}/schemas', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'post',
+        path: '/api/workplace_search/account/sources/{id}/schemas',
+        payload: 'body',
+      });
+
+      registerAccountSourceSchemasRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      const mockRequest = {
+        params: { id: '123' },
+        body: {},
+      };
+
+      mockRouter.callRoute(mockRequest);
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/sources/123/schemas',
+        body: mockRequest.body,
+      });
+    });
+  });
+
+  describe('GET /api/workplace_search/account/sources/{source_id}/reindex_job/{job_id}', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('creates a request handler', () => {
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/workplace_search/account/sources/{source_id}/reindex_job/{job_id}',
+        payload: 'params',
+      });
+
+      registerAccountSourceReindexJobRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+
+      const mockRequest = {
+        params: {
+          source_id: '123',
+          job_id: '345',
+        },
+      };
+
+      mockRouter.callRoute(mockRequest);
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/sources/123/reindex_job/345',
+      });
+    });
+  });
+
+  describe('GET /api/workplace_search/account/sources/{source_id}/reindex_job/{job_id}/status', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('creates a request handler', () => {
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/workplace_search/account/sources/{source_id}/reindex_job/{job_id}/status',
+        payload: 'params',
+      });
+
+      registerAccountSourceReindexJobStatusRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+
+      const mockRequest = {
+        params: {
+          source_id: '123',
+          job_id: '345',
+        },
+      };
+
+      mockRouter.callRoute(mockRequest);
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/sources/123/reindex_job/345/status',
+      });
+    });
+  });
+
   describe('GET /api/workplace_search/org/sources', () => {
     let mockRouter: MockRouter;
 
@@ -1000,6 +1139,139 @@ describe('sources routes', () => {
     });
   });
 
+  describe('GET /api/workplace_search/org/sources/{id}/schemas', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('creates a request handler', () => {
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/workplace_search/org/sources/{id}/schemas',
+        payload: 'params',
+      });
+
+      registerOrgSourceSchemasRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+
+      const mockRequest = {
+        params: {
+          id: '123',
+        },
+      };
+
+      mockRouter.callRoute(mockRequest);
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/org/sources/123/schemas',
+      });
+    });
+  });
+
+  describe('POST /api/workplace_search/org/sources/{id}/schemas', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'post',
+        path: '/api/workplace_search/org/sources/{id}/schemas',
+        payload: 'body',
+      });
+
+      registerOrgSourceSchemasRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request handler', () => {
+      const mockRequest = {
+        params: { id: '123' },
+        body: {},
+      };
+
+      mockRouter.callRoute(mockRequest);
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/org/sources/123/schemas',
+        body: mockRequest.body,
+      });
+    });
+  });
+
+  describe('GET /api/workplace_search/org/sources/{source_id}/reindex_job/{job_id}', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('creates a request handler', () => {
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/workplace_search/org/sources/{source_id}/reindex_job/{job_id}',
+        payload: 'params',
+      });
+
+      registerOrgSourceReindexJobRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+
+      const mockRequest = {
+        params: {
+          source_id: '123',
+          job_id: '345',
+        },
+      };
+
+      mockRouter.callRoute(mockRequest);
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/org/sources/123/reindex_job/345',
+      });
+    });
+  });
+
+  describe('GET /api/workplace_search/org/sources/{source_id}/reindex_job/{job_id}/status', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('creates a request handler', () => {
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/workplace_search/org/sources/{source_id}/reindex_job/{job_id}/status',
+        payload: 'params',
+      });
+
+      registerOrgSourceReindexJobStatusRoute({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+
+      const mockRequest = {
+        params: {
+          source_id: '123',
+          job_id: '345',
+        },
+      };
+
+      mockRouter.callRoute(mockRequest);
+
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/ws/org/sources/123/reindex_job/345/status',
+      });
+    });
+  });
+
   describe('GET /api/workplace_search/org/settings/connectors', () => {
     let mockRouter: MockRouter;
 
diff --git a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
index d43a4252c7e1f..9beac109be510 100644
--- a/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/workplace_search/sources.ts
@@ -339,6 +339,89 @@ export function registerAccountSourceDisplaySettingsConfig({
   );
 }
 
+export function registerAccountSourceSchemasRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/workplace_search/account/sources/{id}/schemas',
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return enterpriseSearchRequestHandler.createRequest({
+        path: `/ws/sources/${request.params.id}/schemas`,
+      })(context, request, response);
+    }
+  );
+
+  router.post(
+    {
+      path: '/api/workplace_search/account/sources/{id}/schemas',
+      validate: {
+        body: schema.object({}),
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return enterpriseSearchRequestHandler.createRequest({
+        path: `/ws/sources/${request.params.id}/schemas`,
+        body: request.body,
+      })(context, request, response);
+    }
+  );
+}
+
+export function registerAccountSourceReindexJobRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/workplace_search/account/sources/{source_id}/reindex_job/{job_id}',
+      validate: {
+        params: schema.object({
+          source_id: schema.string(),
+          job_id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return enterpriseSearchRequestHandler.createRequest({
+        path: `/ws/sources/${request.params.source_id}/reindex_job/${request.params.job_id}`,
+      })(context, request, response);
+    }
+  );
+}
+
+export function registerAccountSourceReindexJobStatusRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/workplace_search/account/sources/{source_id}/reindex_job/{job_id}/status',
+      validate: {
+        params: schema.object({
+          source_id: schema.string(),
+          job_id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return enterpriseSearchRequestHandler.createRequest({
+        path: `/ws/sources/${request.params.source_id}/reindex_job/${request.params.job_id}/status`,
+      })(context, request, response);
+    }
+  );
+}
+
 export function registerOrgSourcesRoute({
   router,
   enterpriseSearchRequestHandler,
@@ -638,6 +721,89 @@ export function registerOrgSourceDisplaySettingsConfig({
   );
 }
 
+export function registerOrgSourceSchemasRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/workplace_search/org/sources/{id}/schemas',
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return enterpriseSearchRequestHandler.createRequest({
+        path: `/ws/org/sources/${request.params.id}/schemas`,
+      })(context, request, response);
+    }
+  );
+
+  router.post(
+    {
+      path: '/api/workplace_search/org/sources/{id}/schemas',
+      validate: {
+        body: schema.object({}),
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return enterpriseSearchRequestHandler.createRequest({
+        path: `/ws/org/sources/${request.params.id}/schemas`,
+        body: request.body,
+      })(context, request, response);
+    }
+  );
+}
+
+export function registerOrgSourceReindexJobRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/workplace_search/org/sources/{source_id}/reindex_job/{job_id}',
+      validate: {
+        params: schema.object({
+          source_id: schema.string(),
+          job_id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return enterpriseSearchRequestHandler.createRequest({
+        path: `/ws/org/sources/${request.params.source_id}/reindex_job/${request.params.job_id}`,
+      })(context, request, response);
+    }
+  );
+}
+
+export function registerOrgSourceReindexJobStatusRoute({
+  router,
+  enterpriseSearchRequestHandler,
+}: RouteDependencies) {
+  router.get(
+    {
+      path: '/api/workplace_search/org/sources/{source_id}/reindex_job/{job_id}/status',
+      validate: {
+        params: schema.object({
+          source_id: schema.string(),
+          job_id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return enterpriseSearchRequestHandler.createRequest({
+        path: `/ws/org/sources/${request.params.source_id}/reindex_job/${request.params.job_id}/status`,
+      })(context, request, response);
+    }
+  );
+}
+
 export function registerOrgSourceOauthConfigurationsRoute({
   router,
   enterpriseSearchRequestHandler,
@@ -741,6 +907,9 @@ export const registerSourcesRoutes = (dependencies: RouteDependencies) => {
   registerAccountPrepareSourcesRoute(dependencies);
   registerAccountSourceSearchableRoute(dependencies);
   registerAccountSourceDisplaySettingsConfig(dependencies);
+  registerAccountSourceSchemasRoute(dependencies);
+  registerAccountSourceReindexJobRoute(dependencies);
+  registerAccountSourceReindexJobStatusRoute(dependencies);
   registerOrgSourcesRoute(dependencies);
   registerOrgSourcesStatusRoute(dependencies);
   registerOrgSourceRoute(dependencies);
@@ -753,6 +922,9 @@ export const registerSourcesRoutes = (dependencies: RouteDependencies) => {
   registerOrgPrepareSourcesRoute(dependencies);
   registerOrgSourceSearchableRoute(dependencies);
   registerOrgSourceDisplaySettingsConfig(dependencies);
+  registerOrgSourceSchemasRoute(dependencies);
+  registerOrgSourceReindexJobRoute(dependencies);
+  registerOrgSourceReindexJobStatusRoute(dependencies);
   registerOrgSourceOauthConfigurationsRoute(dependencies);
   registerOrgSourceOauthConfigurationRoute(dependencies);
 };

From 4b1ba0f3b261491f028c9b79d9163ff7c4000070 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Tue, 1 Dec 2020 12:10:14 -0700
Subject: [PATCH 17/28] [maps] remove fields from index-pattern test artifacts
 (#84379)

* [maps] remove fields from index-pattern test artifacts

* only remove non-scripted fields

* fix data.json parse issues - darn trailing comma

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../es_archives/maps/kibana/data.json          | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/x-pack/test/functional/es_archives/maps/kibana/data.json b/x-pack/test/functional/es_archives/maps/kibana/data.json
index 71b4a85d63f08..5d6a355939d30 100644
--- a/x-pack/test/functional/es_archives/maps/kibana/data.json
+++ b/x-pack/test/functional/es_archives/maps/kibana/data.json
@@ -20,7 +20,7 @@
     "index": ".kibana",
     "source": {
       "index-pattern": {
-        "fields" : "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"@message\"}}},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"@tags\"}}},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"agent\"}}},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"extension\"}}},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"headings\"}}},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"host\"}}},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"index\"}}},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"links\"}}},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"machine.os\"}}},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.article:section\"}}},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.article:tag\"}}},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:description\"}}},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image\"}}},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image:height\"}}},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image:width\"}}},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:site_name\"}}},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:title\"}}},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:type\"}}},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:url\"}}},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:card\"}}},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:description\"}}},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:image\"}}},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:site\"}}},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:title\"}}},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.url\"}}},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"request\"}}},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"response\"}}},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"spaces\"}}},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"url\"}}},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"xss\"}}},{\"name\":\"hour_of_day\",\"type\":\"number\",\"count\":0,\"scripted\":true,\"script\":\"doc['@timestamp'].value.getHour()\",\"lang\":\"painless\",\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false}]",
+        "fields" : "[{\"name\":\"hour_of_day\",\"type\":\"number\",\"count\":0,\"scripted\":true,\"script\":\"doc['@timestamp'].value.getHour()\",\"lang\":\"painless\",\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false}]",
         "timeFieldName": "@timestamp",
         "title": "logstash-*"
       },
@@ -36,7 +36,7 @@
     "index": ".kibana",
     "source": {
       "index-pattern": {
-        "fields" : "[{\"name\":\"_id\",\"type\":\"string\",\"esTypes\":[\"_id\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"esTypes\":[\"_index\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"esTypes\":[\"_source\"],\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"esTypes\":[\"_type\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"geometry\",\"type\":\"geo_shape\",\"esTypes\":[\"geo_shape\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"name\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"prop1\",\"type\":\"number\",\"esTypes\":[\"byte\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
+        "fields" : "[]",
         "title": "geo_shapes*"
       },
       "type": "index-pattern"
@@ -51,7 +51,7 @@
     "index": ".kibana",
     "source": {
       "index-pattern": {
-        "fields": "[{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"prop1\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"shape_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
+        "fields" : "[]",
         "title": "meta_for_geo_shapes*"
       },
       "type": "index-pattern"
@@ -66,7 +66,7 @@
     "index": ".kibana",
     "source": {
       "index-pattern": {
-        "fields": "[{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"location\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
+        "fields" : "[]",
         "title": "antimeridian_points"
       },
       "type": "index-pattern"
@@ -81,7 +81,7 @@
     "index": ".kibana",
     "source": {
       "index-pattern": {
-        "fields": "[{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"location\",\"type\":\"geo_shape\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false}]",
+        "fields" : "[]",
         "title": "antimeridian_shapes"
       },
       "type": "index-pattern"
@@ -96,8 +96,8 @@
     "index": ".kibana",
     "source": {
       "index-pattern" : {
-        "title" : "flights",
-        "fields" : "[{\"name\":\"_id\",\"type\":\"string\",\"esTypes\":[\"_id\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"esTypes\":[\"_index\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"esTypes\":[\"_source\"],\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"esTypes\":[\"_type\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"altitude\",\"type\":\"number\",\"esTypes\":[\"integer\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"heading\",\"type\":\"number\",\"esTypes\":[\"integer\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"location\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]"
+        "fields" : "[]",
+        "title" : "flights"
       },
       "type" : "index-pattern",
       "references" : [ ],
@@ -116,8 +116,8 @@
     "index": ".kibana",
     "source": {
       "index-pattern" : {
-        "title" : "connections",
-        "fields" : "[{\"name\":\"_id\",\"type\":\"string\",\"esTypes\":[\"_id\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"esTypes\":[\"_index\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"esTypes\":[\"_source\"],\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"esTypes\":[\"_type\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"destination\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"source\",\"type\":\"geo_point\",\"esTypes\":[\"geo_point\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]"
+        "fields" : "[]",
+        "title" : "connections"
       },
       "type" : "index-pattern",
       "references" : [ ],

From ae9df6902863d78c422f93d260a216e2da8d0a9c Mon Sep 17 00:00:00 2001
From: Scotty Bollinger <scotty.bollinger@elastic.co>
Date: Tue, 1 Dec 2020 14:24:02 -0600
Subject: [PATCH 18/28] [Enterprise Search] Migrate shared Indexing Status
 component (#84571)

* Add react-motion package

This is needed to animate the loading progress bar in the Enterprise Search schema views

* Add shared interface

* Migrate IndexingStatusContent component

This is a straight copy/paste with only linting changes and tests added

* Migrate IndexingStatusErrors component

This is a copy/paste with linting changes and tests added. Also changed out the Link component to our EuiLinkTo component for internal routing

* Migrate IndexingStatus component

This is a straight copy/paste with only linting changes and tests added

* Migrate IndexingStatusFetcher component

This is a copy/paste with some modifications. The http/axios code has been removed in favor of the HTTPLogic in Kibana.

This is a WIP that I am merging to master until I can get it working in the UI. Without either Schema component in the UIs for App Search or Workplace Search this is only a POC. Will not backport until this is verified working and have written tests.

* Add i18n

* Revert "Add react-motion package"

This reverts commit 92db929d2ab45bba36be7fd53acee495e4969981.

* Remove motion dependency

* Update copy

Co-authored-by: Constance <constancecchen@users.noreply.github.com>

* Refactor per code review

- Remove stui classes
- Inline status

Co-authored-by: Constance <constancecchen@users.noreply.github.com>
---
 .../shared/indexing_status/constants.ts       | 28 ++++++++
 .../shared/indexing_status/index.ts           |  7 ++
 .../indexing_status/indexing_status.test.tsx  | 51 +++++++++++++++
 .../indexing_status/indexing_status.tsx       | 44 +++++++++++++
 .../indexing_status_content.test.tsx          | 21 ++++++
 .../indexing_status_content.tsx               | 27 ++++++++
 .../indexing_status_errors.test.tsx           | 25 ++++++++
 .../indexing_status_errors.tsx                | 31 +++++++++
 .../indexing_status_fetcher.tsx               | 64 +++++++++++++++++++
 .../public/applications/shared/types.ts       | 11 ++++
 10 files changed, 309 insertions(+)
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/constants.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/index.ts
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_content.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_content.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_errors.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_errors.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_fetcher.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/types.ts

diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/constants.ts b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/constants.ts
new file mode 100644
index 0000000000000..b2b76d5b987b9
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/constants.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const INDEXING_STATUS_PROGRESS_TITLE = i18n.translate(
+  'xpack.enterpriseSearch.indexingStatus.progress.title',
+  {
+    defaultMessage: 'Indexing progress',
+  }
+);
+
+export const INDEXING_STATUS_HAS_ERRORS_TITLE = i18n.translate(
+  'xpack.enterpriseSearch.indexingStatus.hasErrors.title',
+  {
+    defaultMessage: 'Several documents have field conversion errors.',
+  }
+);
+
+export const INDEXING_STATUS_HAS_ERRORS_BUTTON = i18n.translate(
+  'xpack.enterpriseSearch.indexingStatus.hasErrors.button',
+  {
+    defaultMessage: 'View errors',
+  }
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/index.ts b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/index.ts
new file mode 100644
index 0000000000000..4a97f11e8f0ee
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { IndexingStatus } from './indexing_status';
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status.test.tsx
new file mode 100644
index 0000000000000..097c3bbc8e9ff
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status.test.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiPanel } from '@elastic/eui';
+
+import { IndexingStatusContent } from './indexing_status_content';
+import { IndexingStatusErrors } from './indexing_status_errors';
+import { IndexingStatusFetcher } from './indexing_status_fetcher';
+import { IndexingStatus } from './indexing_status';
+
+describe('IndexingStatus', () => {
+  const getItemDetailPath = jest.fn();
+  const getStatusPath = jest.fn();
+  const onComplete = jest.fn();
+  const setGlobalIndexingStatus = jest.fn();
+
+  const props = {
+    percentageComplete: 50,
+    numDocumentsWithErrors: 1,
+    activeReindexJobId: 12,
+    viewLinkPath: '/path',
+    itemId: '1',
+    getItemDetailPath,
+    getStatusPath,
+    onComplete,
+    setGlobalIndexingStatus,
+  };
+
+  it('renders', () => {
+    const wrapper = shallow(<IndexingStatus {...props} />);
+    const fetcher = wrapper.find(IndexingStatusFetcher).prop('children')(
+      props.percentageComplete,
+      props.numDocumentsWithErrors
+    );
+
+    expect(shallow(fetcher).find(EuiPanel)).toHaveLength(1);
+    expect(shallow(fetcher).find(IndexingStatusContent)).toHaveLength(1);
+  });
+
+  it('renders errors', () => {
+    const wrapper = shallow(<IndexingStatus {...props} percentageComplete={100} />);
+    const fetcher = wrapper.find(IndexingStatusFetcher).prop('children')(100, 1);
+    expect(shallow(fetcher).find(IndexingStatusErrors)).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status.tsx
new file mode 100644
index 0000000000000..beec0babea590
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status.tsx
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { EuiPanel, EuiSpacer } from '@elastic/eui';
+
+import { IndexingStatusContent } from './indexing_status_content';
+import { IndexingStatusErrors } from './indexing_status_errors';
+import { IndexingStatusFetcher } from './indexing_status_fetcher';
+
+import { IIndexingStatus } from '../types';
+
+export interface IIndexingStatusProps extends IIndexingStatus {
+  viewLinkPath: string;
+  itemId: string;
+  getItemDetailPath?(itemId: string): string;
+  getStatusPath(itemId: string, activeReindexJobId: number): string;
+  onComplete(numDocumentsWithErrors: number): void;
+  setGlobalIndexingStatus?(activeReindexJob: IIndexingStatus): void;
+}
+
+export const IndexingStatus: React.FC<IIndexingStatusProps> = (props) => (
+  <IndexingStatusFetcher {...props}>
+    {(percentageComplete, numDocumentsWithErrors) => (
+      <div>
+        {percentageComplete < 100 && (
+          <EuiPanel paddingSize="l" hasShadow>
+            <IndexingStatusContent percentageComplete={percentageComplete} />
+          </EuiPanel>
+        )}
+        {percentageComplete === 100 && numDocumentsWithErrors > 0 && (
+          <>
+            <EuiSpacer />
+            <IndexingStatusErrors viewLinkPath={props.viewLinkPath} />
+          </>
+        )}
+      </div>
+    )}
+  </IndexingStatusFetcher>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_content.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_content.test.tsx
new file mode 100644
index 0000000000000..9fe0e890e6943
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_content.test.tsx
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiProgress, EuiTitle } from '@elastic/eui';
+
+import { IndexingStatusContent } from './indexing_status_content';
+
+describe('IndexingStatusContent', () => {
+  it('renders', () => {
+    const wrapper = shallow(<IndexingStatusContent percentageComplete={50} />);
+
+    expect(wrapper.find(EuiTitle)).toHaveLength(1);
+    expect(wrapper.find(EuiProgress)).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_content.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_content.tsx
new file mode 100644
index 0000000000000..a0c67388621a8
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_content.tsx
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { EuiProgress, EuiSpacer, EuiTitle } from '@elastic/eui';
+
+import { INDEXING_STATUS_PROGRESS_TITLE } from './constants';
+
+interface IIndexingStatusContentProps {
+  percentageComplete: number;
+}
+
+export const IndexingStatusContent: React.FC<IIndexingStatusContentProps> = ({
+  percentageComplete,
+}) => (
+  <div data-test-subj="IndexingStatusProgressMeter">
+    <EuiTitle size="s">
+      <h3>{INDEXING_STATUS_PROGRESS_TITLE}</h3>
+    </EuiTitle>
+    <EuiSpacer size="s" />
+    <EuiProgress color="primary" size="m" value={percentageComplete} max={100} />
+  </div>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_errors.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_errors.test.tsx
new file mode 100644
index 0000000000000..fc706aee659a5
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_errors.test.tsx
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { EuiCallOut, EuiButton } from '@elastic/eui';
+
+import { EuiLinkTo } from '../react_router_helpers';
+
+import { IndexingStatusErrors } from './indexing_status_errors';
+
+describe('IndexingStatusErrors', () => {
+  it('renders', () => {
+    const wrapper = shallow(<IndexingStatusErrors viewLinkPath="/path" />);
+
+    expect(wrapper.find(EuiButton)).toHaveLength(1);
+    expect(wrapper.find(EuiCallOut)).toHaveLength(1);
+    expect(wrapper.find(EuiLinkTo)).toHaveLength(1);
+    expect(wrapper.find(EuiLinkTo).prop('to')).toEqual('/path');
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_errors.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_errors.tsx
new file mode 100644
index 0000000000000..a928400b2338c
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_errors.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { EuiButton, EuiCallOut } from '@elastic/eui';
+
+import { EuiLinkTo } from '../react_router_helpers';
+
+import { INDEXING_STATUS_HAS_ERRORS_TITLE, INDEXING_STATUS_HAS_ERRORS_BUTTON } from './constants';
+
+interface IIndexingStatusErrorsProps {
+  viewLinkPath: string;
+}
+
+export const IndexingStatusErrors: React.FC<IIndexingStatusErrorsProps> = ({ viewLinkPath }) => (
+  <EuiCallOut
+    color="danger"
+    iconType="cross"
+    title="There was an error"
+    data-test-subj="IndexingStatusErrors"
+  >
+    <p>{INDEXING_STATUS_HAS_ERRORS_TITLE}</p>
+    <EuiButton color="danger" fill={true} size="s" data-test-subj="ViewErrorsButton">
+      <EuiLinkTo to={viewLinkPath}>{INDEXING_STATUS_HAS_ERRORS_BUTTON}</EuiLinkTo>
+    </EuiButton>
+  </EuiCallOut>
+);
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_fetcher.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_fetcher.tsx
new file mode 100644
index 0000000000000..cb7c82f91ed61
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/indexing_status/indexing_status_fetcher.tsx
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useEffect, useState, useRef } from 'react';
+
+import { HttpLogic } from '../http';
+import { flashAPIErrors } from '../flash_messages';
+
+interface IIndexingStatusFetcherProps {
+  activeReindexJobId: number;
+  itemId: string;
+  percentageComplete: number;
+  numDocumentsWithErrors: number;
+  onComplete?(numDocumentsWithErrors: number): void;
+  getStatusPath(itemId: string, activeReindexJobId: number): string;
+  children(percentageComplete: number, numDocumentsWithErrors: number): JSX.Element;
+}
+
+export const IndexingStatusFetcher: React.FC<IIndexingStatusFetcherProps> = ({
+  activeReindexJobId,
+  children,
+  getStatusPath,
+  itemId,
+  numDocumentsWithErrors,
+  onComplete,
+  percentageComplete = 0,
+}) => {
+  const [indexingStatus, setIndexingStatus] = useState({
+    numDocumentsWithErrors,
+    percentageComplete,
+  });
+  const pollingInterval = useRef<number>();
+
+  useEffect(() => {
+    pollingInterval.current = window.setInterval(async () => {
+      try {
+        const response = await HttpLogic.values.http.get(getStatusPath(itemId, activeReindexJobId));
+        if (response.percentageComplete >= 100) {
+          clearInterval(pollingInterval.current);
+        }
+        setIndexingStatus({
+          percentageComplete: response.percentageComplete,
+          numDocumentsWithErrors: response.numDocumentsWithErrors,
+        });
+        if (response.percentageComplete >= 100 && onComplete) {
+          onComplete(response.numDocumentsWithErrors);
+        }
+      } catch (e) {
+        flashAPIErrors(e);
+      }
+    }, 3000);
+
+    return () => {
+      if (pollingInterval.current) {
+        clearInterval(pollingInterval.current);
+      }
+    };
+  }, []);
+
+  return children(indexingStatus.percentageComplete, indexingStatus.numDocumentsWithErrors);
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/types.ts b/x-pack/plugins/enterprise_search/public/applications/shared/types.ts
new file mode 100644
index 0000000000000..3866d1a7199e4
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/types.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface IIndexingStatus {
+  percentageComplete: number;
+  numDocumentsWithErrors: number;
+  activeReindexJobId: number;
+}

From 4ae84a00a549ed834d618d19e00008666791f107 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yulia=20=C4=8Cech?=
 <6585477+yuliacech@users.noreply.github.com>
Date: Tue, 1 Dec 2020 21:37:56 +0100
Subject: [PATCH 19/28] [CCR] Fix row actions in follower index and auto-follow
 pattern tables (#84433)

* Fixed auto follow actions

* Created a provider for all follower index table actions to fix modal auto-closing

* Moved i18n texts into a const to avoid duplication

* Removed unnecessary imports and added index.js file for follower_index_actions_provider imports

* Fixed wrong imports deletion

* Fixed wrong imports deletion

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../follower_index_actions_provider.js        |  34 ++++
 .../follower_index_pause_provider.js          |   6 +-
 .../follower_index_resume_provider.js         |   8 +-
 .../follower_index_unfollow_provider.js       |   4 +-
 .../follower_index_actions_providers/index.js |  10 +
 .../public/app/components/index.js            |   7 +-
 .../auto_follow_pattern_table.js              | 178 ++++++++---------
 .../follower_indices_table.js                 | 185 ++++++++----------
 8 files changed, 217 insertions(+), 215 deletions(-)
 create mode 100644 x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_actions_provider.js
 rename x-pack/plugins/cross_cluster_replication/public/app/components/{ => follower_index_actions_providers}/follower_index_pause_provider.js (95%)
 rename x-pack/plugins/cross_cluster_replication/public/app/components/{ => follower_index_actions_providers}/follower_index_resume_provider.js (95%)
 rename x-pack/plugins/cross_cluster_replication/public/app/components/{ => follower_index_actions_providers}/follower_index_unfollow_provider.js (97%)
 create mode 100644 x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/index.js

diff --git a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_actions_provider.js b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_actions_provider.js
new file mode 100644
index 0000000000000..df3017ebf92a4
--- /dev/null
+++ b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_actions_provider.js
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { FollowerIndexPauseProvider } from './follower_index_pause_provider';
+import { FollowerIndexResumeProvider } from './follower_index_resume_provider';
+import { FollowerIndexUnfollowProvider } from './follower_index_unfollow_provider';
+
+export const FollowerIndexActionsProvider = (props) => {
+  return (
+    <FollowerIndexPauseProvider>
+      {(pauseFollowerIndex) => (
+        <FollowerIndexResumeProvider>
+          {(resumeFollowerIndex) => (
+            <FollowerIndexUnfollowProvider>
+              {(unfollowLeaderIndex) => {
+                const { children } = props;
+                return children(() => ({
+                  pauseFollowerIndex,
+                  resumeFollowerIndex,
+                  unfollowLeaderIndex,
+                }));
+              }}
+            </FollowerIndexUnfollowProvider>
+          )}
+        </FollowerIndexResumeProvider>
+      )}
+    </FollowerIndexPauseProvider>
+  );
+};
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_pause_provider.js b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_pause_provider.js
similarity index 95%
rename from x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_pause_provider.js
rename to x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_pause_provider.js
index 9c1e8255d069c..7d1168d831631 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_pause_provider.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_pause_provider.js
@@ -11,9 +11,9 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiConfirmModal, EuiOverlayMask } from '@elastic/eui';
 
-import { pauseFollowerIndex } from '../store/actions';
-import { arrify } from '../../../common/services/utils';
-import { areAllSettingsDefault } from '../services/follower_index_default_settings';
+import { pauseFollowerIndex } from '../../store/actions';
+import { arrify } from '../../../../common/services/utils';
+import { areAllSettingsDefault } from '../../services/follower_index_default_settings';
 
 class FollowerIndexPauseProviderUi extends PureComponent {
   static propTypes = {
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_resume_provider.js b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_resume_provider.js
similarity index 95%
rename from x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_resume_provider.js
rename to x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_resume_provider.js
index 101e3df6bf710..86f8c0447e734 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_resume_provider.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_resume_provider.js
@@ -10,10 +10,10 @@ import { connect } from 'react-redux';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiConfirmModal, EuiLink, EuiOverlayMask } from '@elastic/eui';
-import { reactRouterNavigate } from '../../../../../../src/plugins/kibana_react/public';
-import { routing } from '../services/routing';
-import { resumeFollowerIndex } from '../store/actions';
-import { arrify } from '../../../common/services/utils';
+import { reactRouterNavigate } from '../../../../../../../src/plugins/kibana_react/public';
+import { routing } from '../../services/routing';
+import { resumeFollowerIndex } from '../../store/actions';
+import { arrify } from '../../../../common/services/utils';
 
 class FollowerIndexResumeProviderUi extends PureComponent {
   static propTypes = {
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_unfollow_provider.js b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_unfollow_provider.js
similarity index 97%
rename from x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_unfollow_provider.js
rename to x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_unfollow_provider.js
index 68b6b970ad90b..f9644aa20c2c2 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_unfollow_provider.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/follower_index_unfollow_provider.js
@@ -11,8 +11,8 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiConfirmModal, EuiOverlayMask } from '@elastic/eui';
 
-import { unfollowLeaderIndex } from '../store/actions';
-import { arrify } from '../../../common/services/utils';
+import { unfollowLeaderIndex } from '../../store/actions';
+import { arrify } from '../../../../common/services/utils';
 
 class FollowerIndexUnfollowProviderUi extends PureComponent {
   static propTypes = {
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/index.js b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/index.js
new file mode 100644
index 0000000000000..fe1a7d82a56a1
--- /dev/null
+++ b/x-pack/plugins/cross_cluster_replication/public/app/components/follower_index_actions_providers/index.js
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { FollowerIndexActionsProvider } from './follower_index_actions_provider';
+export { FollowerIndexPauseProvider } from './follower_index_pause_provider';
+export { FollowerIndexResumeProvider } from './follower_index_resume_provider';
+export { FollowerIndexUnfollowProvider } from './follower_index_unfollow_provider';
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/components/index.js b/x-pack/plugins/cross_cluster_replication/public/app/components/index.js
index 6d971bff03981..55609fa85fb11 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/components/index.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/components/index.js
@@ -12,9 +12,10 @@ export { AutoFollowPatternForm } from './auto_follow_pattern_form';
 export { AutoFollowPatternDeleteProvider } from './auto_follow_pattern_delete_provider';
 export { AutoFollowPatternPageTitle } from './auto_follow_pattern_page_title';
 export { AutoFollowPatternIndicesPreview } from './auto_follow_pattern_indices_preview';
-export { FollowerIndexPauseProvider } from './follower_index_pause_provider';
-export { FollowerIndexResumeProvider } from './follower_index_resume_provider';
-export { FollowerIndexUnfollowProvider } from './follower_index_unfollow_provider';
+export { FollowerIndexPauseProvider } from './follower_index_actions_providers';
+export { FollowerIndexResumeProvider } from './follower_index_actions_providers';
+export { FollowerIndexUnfollowProvider } from './follower_index_actions_providers';
+export { FollowerIndexActionsProvider } from './follower_index_actions_providers';
 export { FollowerIndexForm } from './follower_index_form';
 export { FollowerIndexPageTitle } from './follower_index_page_title';
 export { FormEntryRow } from './form_entry_row';
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.js b/x-pack/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.js
index 2309dece3f92b..dd5fe6f212808 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { PureComponent, Fragment } from 'react';
+import React, { PureComponent } from 'react';
 import PropTypes from 'prop-types';
 import { i18n } from '@kbn/i18n';
 import {
@@ -13,7 +13,6 @@ import {
   EuiLoadingKibana,
   EuiOverlayMask,
   EuiHealth,
-  EuiIcon,
 } from '@elastic/eui';
 import { API_STATUS, UIM_AUTO_FOLLOW_PATTERN_SHOW_DETAILS_CLICK } from '../../../../../constants';
 import {
@@ -23,6 +22,33 @@ import {
 import { routing } from '../../../../../services/routing';
 import { trackUiMetric } from '../../../../../services/track_ui_metric';
 
+const actionI18nTexts = {
+  pause: i18n.translate(
+    'xpack.crossClusterReplication.autoFollowPatternList.table.actionPauseDescription',
+    {
+      defaultMessage: 'Pause replication',
+    }
+  ),
+  resume: i18n.translate(
+    'xpack.crossClusterReplication.autoFollowPatternList.table.actionResumeDescription',
+    {
+      defaultMessage: 'Resume replication',
+    }
+  ),
+  edit: i18n.translate(
+    'xpack.crossClusterReplication.autoFollowPatternList.table.actionEditDescription',
+    {
+      defaultMessage: 'Edit auto-follow pattern',
+    }
+  ),
+  delete: i18n.translate(
+    'xpack.crossClusterReplication.autoFollowPatternList.table.actionDeleteDescription',
+    {
+      defaultMessage: 'Delete auto-follow pattern',
+    }
+  ),
+};
+
 const getFilteredPatterns = (autoFollowPatterns, queryText) => {
   if (queryText) {
     const normalizedSearchText = queryText.toLowerCase();
@@ -93,7 +119,7 @@ export class AutoFollowPatternTable extends PureComponent {
     });
   };
 
-  getTableColumns() {
+  getTableColumns(deleteAutoFollowPattern) {
     const { selectAutoFollowPattern } = this.props;
 
     return [
@@ -200,88 +226,34 @@ export class AutoFollowPatternTable extends PureComponent {
         ),
         actions: [
           {
-            render: ({ name, active }) => {
-              const label = active
-                ? i18n.translate(
-                    'xpack.crossClusterReplication.autoFollowPatternList.table.actionPauseDescription',
-                    {
-                      defaultMessage: 'Pause replication',
-                    }
-                  )
-                : i18n.translate(
-                    'xpack.crossClusterReplication.autoFollowPatternList.table.actionResumeDescription',
-                    {
-                      defaultMessage: 'Resume replication',
-                    }
-                  );
-
-              return (
-                <span
-                  onClick={(event) => {
-                    if (event.stopPropagation) {
-                      event.stopPropagation();
-                    }
-                    if (active) {
-                      this.props.pauseAutoFollowPattern(name);
-                    } else {
-                      this.props.resumeAutoFollowPattern(name);
-                    }
-                  }}
-                  data-test-subj={active ? 'contextMenuPauseButton' : 'contextMenuResumeButton'}
-                >
-                  <EuiIcon
-                    aria-label={label}
-                    type={active ? 'pause' : 'play'}
-                    className="euiContextMenu__icon"
-                  />
-                  <span>{label}</span>
-                </span>
-              );
-            },
+            name: actionI18nTexts.pause,
+            description: actionI18nTexts.pause,
+            icon: 'pause',
+            onClick: (item) => this.props.pauseAutoFollowPattern(item.name),
+            available: (item) => item.active,
+            'data-test-subj': 'contextMenuPauseButton',
           },
           {
-            render: ({ name }) => {
-              const label = i18n.translate(
-                'xpack.crossClusterReplication.autoFollowPatternList.table.actionEditDescription',
-                {
-                  defaultMessage: 'Edit auto-follow pattern',
-                }
-              );
-
-              return (
-                <span
-                  onClick={() => routing.navigate(routing.getAutoFollowPatternPath(name))}
-                  data-test-subj="contextMenuEditButton"
-                >
-                  <EuiIcon aria-label={label} type="pencil" className="euiContextMenu__icon" />
-                  <span>{label}</span>
-                </span>
-              );
-            },
+            name: actionI18nTexts.resume,
+            description: actionI18nTexts.resume,
+            icon: 'play',
+            onClick: (item) => this.props.resumeAutoFollowPattern(item.name),
+            available: (item) => !item.active,
+            'data-test-subj': 'contextMenuResumeButton',
           },
           {
-            render: ({ name }) => {
-              const label = i18n.translate(
-                'xpack.crossClusterReplication.autoFollowPatternList.table.actionDeleteDescription',
-                {
-                  defaultMessage: 'Delete auto-follow pattern',
-                }
-              );
-
-              return (
-                <AutoFollowPatternDeleteProvider>
-                  {(deleteAutoFollowPattern) => (
-                    <span
-                      onClick={() => deleteAutoFollowPattern(name)}
-                      data-test-subj="contextMenuDeleteButton"
-                    >
-                      <EuiIcon aria-label={label} type="trash" className="euiContextMenu__icon" />
-                      <span>{label}</span>
-                    </span>
-                  )}
-                </AutoFollowPatternDeleteProvider>
-              );
-            },
+            name: actionI18nTexts.edit,
+            description: actionI18nTexts.edit,
+            icon: 'pencil',
+            onClick: (item) => routing.navigate(routing.getAutoFollowPatternPath(item.name)),
+            'data-test-subj': 'contextMenuEditButton',
+          },
+          {
+            name: actionI18nTexts.delete,
+            description: actionI18nTexts.delete,
+            icon: 'trash',
+            onClick: (item) => deleteAutoFollowPattern(item.name),
+            'data-test-subj': 'contextMenuDeleteButton',
           },
         ],
         width: '100px',
@@ -339,26 +311,30 @@ export class AutoFollowPatternTable extends PureComponent {
     };
 
     return (
-      <Fragment>
-        <EuiInMemoryTable
-          items={filteredAutoFollowPatterns}
-          itemId="name"
-          columns={this.getTableColumns()}
-          search={search}
-          pagination={pagination}
-          sorting={sorting}
-          selection={selection}
-          isSelectable={true}
-          rowProps={() => ({
-            'data-test-subj': 'row',
-          })}
-          cellProps={(item, column) => ({
-            'data-test-subj': `cell_${column.field}`,
-          })}
-          data-test-subj="autoFollowPatternListTable"
-        />
-        {this.renderLoading()}
-      </Fragment>
+      <AutoFollowPatternDeleteProvider>
+        {(deleteAutoFollowPattern) => (
+          <>
+            <EuiInMemoryTable
+              items={filteredAutoFollowPatterns}
+              itemId="name"
+              columns={this.getTableColumns(deleteAutoFollowPattern)}
+              search={search}
+              pagination={pagination}
+              sorting={sorting}
+              selection={selection}
+              isSelectable={true}
+              rowProps={() => ({
+                'data-test-subj': 'row',
+              })}
+              cellProps={(item, column) => ({
+                'data-test-subj': `cell_${column.field}`,
+              })}
+              data-test-subj="autoFollowPatternListTable"
+            />
+            {this.renderLoading()}
+          </>
+        )}
+      </AutoFollowPatternDeleteProvider>
     );
   }
 }
diff --git a/x-pack/plugins/cross_cluster_replication/public/app/sections/home/follower_indices_list/components/follower_indices_table/follower_indices_table.js b/x-pack/plugins/cross_cluster_replication/public/app/sections/home/follower_indices_list/components/follower_indices_table/follower_indices_table.js
index 0c57b3f7330cf..2ea73e272b24e 100644
--- a/x-pack/plugins/cross_cluster_replication/public/app/sections/home/follower_indices_list/components/follower_indices_table/follower_indices_table.js
+++ b/x-pack/plugins/cross_cluster_replication/public/app/sections/home/follower_indices_list/components/follower_indices_table/follower_indices_table.js
@@ -4,12 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { PureComponent, Fragment } from 'react';
+import React, { PureComponent } from 'react';
 import PropTypes from 'prop-types';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import {
-  EuiIcon,
   EuiHealth,
   EuiInMemoryTable,
   EuiLink,
@@ -17,15 +16,38 @@ import {
   EuiOverlayMask,
 } from '@elastic/eui';
 import { API_STATUS, UIM_FOLLOWER_INDEX_SHOW_DETAILS_CLICK } from '../../../../../constants';
-import {
-  FollowerIndexPauseProvider,
-  FollowerIndexResumeProvider,
-  FollowerIndexUnfollowProvider,
-} from '../../../../../components';
+import { FollowerIndexActionsProvider } from '../../../../../components';
 import { routing } from '../../../../../services/routing';
 import { trackUiMetric } from '../../../../../services/track_ui_metric';
 import { ContextMenu } from '../context_menu';
 
+const actionI18nTexts = {
+  pause: i18n.translate(
+    'xpack.crossClusterReplication.followerIndexList.table.actionPauseDescription',
+    {
+      defaultMessage: 'Pause replication',
+    }
+  ),
+  resume: i18n.translate(
+    'xpack.crossClusterReplication.followerIndexList.table.actionResumeDescription',
+    {
+      defaultMessage: 'Resume replication',
+    }
+  ),
+  edit: i18n.translate(
+    'xpack.crossClusterReplication.followerIndexList.table.actionEditDescription',
+    {
+      defaultMessage: 'Edit follower index',
+    }
+  ),
+  unfollow: i18n.translate(
+    'xpack.crossClusterReplication.followerIndexList.table.actionUnfollowDescription',
+    {
+      defaultMessage: 'Unfollow leader index',
+    }
+  ),
+};
+
 const getFilteredIndices = (followerIndices, queryText) => {
   if (queryText) {
     const normalizedSearchText = queryText.toLowerCase();
@@ -101,91 +123,43 @@ export class FollowerIndicesTable extends PureComponent {
     routing.navigate(uri);
   };
 
-  getTableColumns() {
+  getTableColumns(actionHandlers) {
     const { selectFollowerIndex } = this.props;
 
     const actions = [
-      /* Pause or resume follower index */
+      /* Pause follower index */
       {
-        render: (followerIndex) => {
-          const { name, isPaused } = followerIndex;
-          const label = isPaused
-            ? i18n.translate(
-                'xpack.crossClusterReplication.followerIndexList.table.actionResumeDescription',
-                {
-                  defaultMessage: 'Resume replication',
-                }
-              )
-            : i18n.translate(
-                'xpack.crossClusterReplication.followerIndexList.table.actionPauseDescription',
-                {
-                  defaultMessage: 'Pause replication',
-                }
-              );
-
-          return isPaused ? (
-            <FollowerIndexResumeProvider>
-              {(resumeFollowerIndex) => (
-                <span onClick={() => resumeFollowerIndex(name)} data-test-subj="resumeButton">
-                  <EuiIcon aria-label={label} type="play" className="euiContextMenu__icon" />
-                  <span>{label}</span>
-                </span>
-              )}
-            </FollowerIndexResumeProvider>
-          ) : (
-            <FollowerIndexPauseProvider>
-              {(pauseFollowerIndex) => (
-                <span
-                  onClick={() => pauseFollowerIndex(followerIndex)}
-                  data-test-subj="pauseButton"
-                >
-                  <EuiIcon aria-label={label} type="pause" className="euiContextMenu__icon" />
-                  <span>{label}</span>
-                </span>
-              )}
-            </FollowerIndexPauseProvider>
-          );
-        },
+        name: actionI18nTexts.pause,
+        description: actionI18nTexts.pause,
+        icon: 'pause',
+        onClick: (item) => actionHandlers.pauseFollowerIndex(item),
+        available: (item) => !item.isPaused,
+        'data-test-subj': 'pauseButton',
+      },
+      /* Resume follower index */
+      {
+        name: actionI18nTexts.resume,
+        description: actionI18nTexts.resume,
+        icon: 'play',
+        onClick: (item) => actionHandlers.resumeFollowerIndex(item.name),
+        available: (item) => item.isPaused,
+        'data-test-subj': 'resumeButton',
       },
       /* Edit follower index */
       {
-        render: ({ name }) => {
-          const label = i18n.translate(
-            'xpack.crossClusterReplication.followerIndexList.table.actionEditDescription',
-            {
-              defaultMessage: 'Edit follower index',
-            }
-          );
-
-          return (
-            <span onClick={() => this.editFollowerIndex(name)} data-test-subj="editButton">
-              <EuiIcon aria-label={label} type="pencil" className="euiContextMenu__icon" />
-              <span>{label}</span>
-            </span>
-          );
-        },
+        name: actionI18nTexts.edit,
+        description: actionI18nTexts.edit,
+        onClick: (item) => this.editFollowerIndex(item.name),
+        icon: 'pencil',
+        'data-test-subj': 'editButton',
       },
       /* Unfollow leader index */
       {
-        render: ({ name }) => {
-          const label = i18n.translate(
-            'xpack.crossClusterReplication.followerIndexList.table.actionUnfollowDescription',
-            {
-              defaultMessage: 'Unfollow leader index',
-            }
-          );
-
-          return (
-            <FollowerIndexUnfollowProvider>
-              {(unfollowLeaderIndex) => (
-                <span onClick={() => unfollowLeaderIndex(name)} data-test-subj="unfollowButton">
-                  <EuiIcon aria-label={label} type="indexFlush" className="euiContextMenu__icon" />
-                  <span>{label}</span>
-                </span>
-              )}
-            </FollowerIndexUnfollowProvider>
-          );
-        },
+        name: actionI18nTexts.unfollow,
+        description: actionI18nTexts.unfollow,
+        onClick: (item) => actionHandlers.unfollowLeaderIndex(item.name),
+        icon: 'indexFlush',
+        'data-test-subj': 'unfollowButton',
       },
     ];
 
@@ -321,26 +295,33 @@ export class FollowerIndicesTable extends PureComponent {
     };
 
     return (
-      <Fragment>
-        <EuiInMemoryTable
-          items={filteredIndices}
-          itemId="name"
-          columns={this.getTableColumns()}
-          search={search}
-          pagination={pagination}
-          sorting={sorting}
-          selection={selection}
-          isSelectable={true}
-          rowProps={() => ({
-            'data-test-subj': 'row',
-          })}
-          cellProps={(item, column) => ({
-            'data-test-subj': `cell-${column.field}`,
-          })}
-          data-test-subj="followerIndexListTable"
-        />
-        {this.renderLoading()}
-      </Fragment>
+      <FollowerIndexActionsProvider>
+        {(getActionHandlers) => {
+          const actionHandlers = getActionHandlers();
+          return (
+            <>
+              <EuiInMemoryTable
+                items={filteredIndices}
+                itemId="name"
+                columns={this.getTableColumns(actionHandlers)}
+                search={search}
+                pagination={pagination}
+                sorting={sorting}
+                selection={selection}
+                isSelectable={true}
+                rowProps={() => ({
+                  'data-test-subj': 'row',
+                })}
+                cellProps={(item, column) => ({
+                  'data-test-subj': `cell-${column.field}`,
+                })}
+                data-test-subj="followerIndexListTable"
+              />
+              {this.renderLoading()}
+            </>
+          );
+        }}
+      </FollowerIndexActionsProvider>
     );
   }
 }

From 49f0ca082756673d9613bdf576023e7a00a305ed Mon Sep 17 00:00:00 2001
From: Thomas Neirynck <thomas@elastic.co>
Date: Tue, 1 Dec 2020 16:33:16 -0500
Subject: [PATCH 20/28] [Maps] Support runtime fields in tooltips (#84377)

---
 .../classes/sources/es_search_source/es_search_source.tsx | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx
index d31f6ee626245..1c0645ae797ec 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx
@@ -487,8 +487,14 @@ export class ESSearchSource extends AbstractESSource implements ITiledSingleLaye
       return {};
     }
 
+    const { docValueFields } = getDocValueAndSourceFields(
+      indexPattern,
+      this._getTooltipPropertyNames()
+    );
+
+    const initialSearchContext = { docvalue_fields: docValueFields }; // Request fields in docvalue_fields insted of _source
     const searchService = getSearchService();
-    const searchSource = searchService.searchSource.createEmpty();
+    const searchSource = await searchService.searchSource.create(initialSearchContext as object);
 
     searchSource.setField('index', indexPattern);
     searchSource.setField('size', 1);

From b9a64ba7d5f859e4803f38544a471040111a4100 Mon Sep 17 00:00:00 2001
From: Christos Nasikas <christos.nasikas@elastic.co>
Date: Tue, 1 Dec 2020 23:39:27 +0200
Subject: [PATCH 21/28] [Security Solutino][Case] Case connector alert UI
 (#82405)

Co-authored-by: Patryk Kopycinski <contact@patrykkopycinski.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../security_solution/common/constants.ts     |   6 +
 .../components/add_comment/index.test.tsx     |  94 ++--
 .../cases/components/add_comment/index.tsx    |  18 +-
 .../all_cases/table_filters.test.tsx          |   1 -
 .../configure_cases/connectors_dropdown.tsx   |   2 +-
 .../configure_cases/field_mapping.test.tsx    |   3 +-
 .../configure_cases/field_mapping.tsx         |  14 +-
 .../configure_cases/field_mapping_row.tsx     |   2 +-
 .../components/configure_cases/index.tsx      |   2 +-
 .../connector_selector/form.test.tsx          |  68 +++
 .../components/connector_selector/form.tsx    |  24 +-
 .../connectors/case/cases_dropdown.tsx        |  72 +++
 .../connectors/case/existing_case.tsx         |  54 +++
 .../components/connectors/case/fields.tsx     | 101 ++++
 .../components}/connectors/case/index.ts      |  22 +-
 .../connectors/case/translations.ts           |  86 ++++
 .../cases/components/connectors/case/types.ts |  17 +
 .../components}/connectors/config.ts          |   0
 .../components}/connectors/index.ts           |   4 +
 .../components}/connectors/types.ts           |   0
 .../components}/connectors/utils.ts           |   0
 .../components/create/connector.test.tsx      | 186 ++++++++
 .../cases/components/create/connector.tsx     |  83 ++++
 .../components/create/description.test.tsx    |  57 +++
 .../cases/components/create/description.tsx   |  31 ++
 .../cases/components/create/form.test.tsx     |  66 +++
 .../public/cases/components/create/form.tsx   |  94 ++++
 .../cases/components/create/form_context.tsx  |  66 +++
 .../cases/components/create/index.test.tsx    | 443 +++++++++++++-----
 .../public/cases/components/create/index.tsx  | 342 ++------------
 .../optional_field_label/index.test.tsx       |  18 +
 .../create/optional_field_label/index.tsx     |   2 +-
 .../public/cases/components/create/schema.tsx |   7 +-
 .../components/create/submit_button.test.tsx  |  83 ++++
 .../cases/components/create/submit_button.tsx |  30 ++
 .../cases/components/create/tags.test.tsx     |  77 +++
 .../public/cases/components/create/tags.tsx   |  48 ++
 .../cases/components/create/title.test.tsx    |  67 +++
 .../public/cases/components/create/title.tsx  |  32 ++
 .../public/cases/components/settings/card.tsx |   2 +-
 .../cases/components/settings/fields_form.tsx |  23 +-
 .../cases/components/tag_list/index.tsx       |   5 +-
 .../use_all_cases_modal/all_cases_modal.tsx   |   5 +-
 .../create_case_modal.tsx                     |  68 +++
 .../use_create_case_modal/index.tsx           |  45 ++
 .../components/use_insert_timeline/index.tsx  |  63 +++
 .../lib/connectors/case/translations.ts       |  21 -
 .../security_solution/public/plugin.tsx       |   2 +-
 .../use_insert_timeline.tsx                   |  70 ---
 49 files changed, 2018 insertions(+), 608 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/connector_selector/form.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/connectors/case/cases_dropdown.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/connectors/case/existing_case.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/connectors/case/fields.tsx
 rename x-pack/plugins/security_solution/public/{common/lib => cases/components}/connectors/case/index.ts (57%)
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/connectors/case/translations.ts
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/connectors/case/types.ts
 rename x-pack/plugins/security_solution/public/{common/lib => cases/components}/connectors/config.ts (100%)
 rename x-pack/plugins/security_solution/public/{common/lib => cases/components}/connectors/index.ts (79%)
 rename x-pack/plugins/security_solution/public/{common/lib => cases/components}/connectors/types.ts (100%)
 rename x-pack/plugins/security_solution/public/{common/lib => cases/components}/connectors/utils.ts (100%)
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/connector.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/connector.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/description.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/description.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/form.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/form.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/form_context.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/optional_field_label/index.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/submit_button.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/submit_button.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/tags.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/tags.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/title.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/create/title.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/use_create_case_modal/create_case_modal.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/use_create_case_modal/index.tsx
 create mode 100644 x-pack/plugins/security_solution/public/cases/components/use_insert_timeline/index.tsx
 delete mode 100644 x-pack/plugins/security_solution/public/common/lib/connectors/case/translations.ts
 delete mode 100644 x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx

diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index e58aed15a8a10..c47ec70341845 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -160,6 +160,7 @@ export const ML_GROUP_IDS = [ML_GROUP_ID, LEGACY_ML_GROUP_ID];
 /*
   Rule notifications options
 */
+export const ENABLE_CASE_CONNECTOR = false;
 export const NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS = [
   '.email',
   '.slack',
@@ -169,6 +170,11 @@ export const NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS = [
   '.jira',
   '.resilient',
 ];
+
+if (ENABLE_CASE_CONNECTOR) {
+  NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS.push('.case');
+}
+
 export const NOTIFICATION_THROTTLE_NO_ACTIONS = 'no_actions';
 export const NOTIFICATION_THROTTLE_RULE = 'rule';
 
diff --git a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.test.tsx
index 2c8051f902b17..50e139bcd215f 100644
--- a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.test.tsx
@@ -6,42 +6,24 @@
 
 import React from 'react';
 import { mount } from 'enzyme';
+import { waitFor, act } from '@testing-library/react';
 
 import { AddComment, AddCommentRefObject } from '.';
 import { TestProviders } from '../../../common/mock';
-import { getFormMock } from '../__mock__/form';
 import { Router, routeData, mockHistory, mockLocation } from '../__mock__/router';
 
 import { CommentRequest, CommentType } from '../../../../../case/common/api';
-import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
+import { useInsertTimeline } from '../use_insert_timeline';
 import { usePostComment } from '../../containers/use_post_comment';
-import { useForm } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form';
-import { useFormData } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data';
 
-import { waitFor } from '@testing-library/react';
-
-jest.mock(
-  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form'
-);
-
-jest.mock(
-  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data'
-);
-
-jest.mock('../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline');
 jest.mock('../../containers/use_post_comment');
+jest.mock('../use_insert_timeline');
 
-const useFormMock = useForm as jest.Mock;
-const useFormDataMock = useFormData as jest.Mock;
-
-const useInsertTimelineMock = useInsertTimeline as jest.Mock;
 const usePostCommentMock = usePostComment as jest.Mock;
-
+const useInsertTimelineMock = useInsertTimeline as jest.Mock;
 const onCommentSaving = jest.fn();
 const onCommentPosted = jest.fn();
 const postComment = jest.fn();
-const handleCursorChange = jest.fn();
-const handleOnTimelineChange = jest.fn();
 
 const addCommentProps = {
   caseId: '1234',
@@ -52,15 +34,6 @@ const addCommentProps = {
   showLoading: false,
 };
 
-const defaultInsertTimeline = {
-  cursorPosition: {
-    start: 0,
-    end: 0,
-  },
-  handleCursorChange,
-  handleOnTimelineChange,
-};
-
 const defaultPostCommment = {
   isLoading: false,
   isError: false,
@@ -73,14 +46,9 @@ const sampleData: CommentRequest = {
 };
 
 describe('AddComment ', () => {
-  const formHookMock = getFormMock(sampleData);
-
   beforeEach(() => {
     jest.resetAllMocks();
-    useInsertTimelineMock.mockImplementation(() => defaultInsertTimeline);
     usePostCommentMock.mockImplementation(() => defaultPostCommment);
-    useFormMock.mockImplementation(() => ({ form: formHookMock }));
-    useFormDataMock.mockImplementation(() => [{ comment: sampleData.comment }]);
     jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocation);
   });
 
@@ -92,14 +60,25 @@ describe('AddComment ', () => {
         </Router>
       </TestProviders>
     );
+
+    await act(async () => {
+      wrapper
+        .find(`[data-test-subj="add-comment"] textarea`)
+        .first()
+        .simulate('change', { target: { value: sampleData.comment } });
+    });
+
     expect(wrapper.find(`[data-test-subj="add-comment"]`).exists()).toBeTruthy();
     expect(wrapper.find(`[data-test-subj="loading-spinner"]`).exists()).toBeFalsy();
 
-    wrapper.find(`[data-test-subj="submit-comment"]`).first().simulate('click');
+    await act(async () => {
+      wrapper.find(`[data-test-subj="submit-comment"]`).first().simulate('click');
+    });
+
     await waitFor(() => {
       expect(onCommentSaving).toBeCalled();
       expect(postComment).toBeCalledWith(sampleData, onCommentPosted);
-      expect(formHookMock.reset).toBeCalled();
+      expect(wrapper.find(`[data-test-subj="add-comment"] textarea`).text()).toBe('');
     });
   });
 
@@ -112,6 +91,7 @@ describe('AddComment ', () => {
         </Router>
       </TestProviders>
     );
+
     expect(wrapper.find(`[data-test-subj="loading-spinner"]`).exists()).toBeTruthy();
     expect(
       wrapper.find(`[data-test-subj="submit-comment"]`).first().prop('isDisabled')
@@ -127,15 +107,16 @@ describe('AddComment ', () => {
         </Router>
       </TestProviders>
     );
+
     expect(
       wrapper.find(`[data-test-subj="submit-comment"]`).first().prop('isDisabled')
     ).toBeTruthy();
   });
 
-  it('should insert a quote', () => {
+  it('should insert a quote', async () => {
     const sampleQuote = 'what a cool quote';
     const ref = React.createRef<AddCommentRefObject>();
-    mount(
+    const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
           <AddComment {...{ ...addCommentProps }} ref={ref} />
@@ -143,10 +124,37 @@ describe('AddComment ', () => {
       </TestProviders>
     );
 
-    ref.current!.addQuote(sampleQuote);
-    expect(formHookMock.setFieldValue).toBeCalledWith(
-      'comment',
+    await act(async () => {
+      wrapper
+        .find(`[data-test-subj="add-comment"] textarea`)
+        .first()
+        .simulate('change', { target: { value: sampleData.comment } });
+    });
+
+    await act(async () => {
+      ref.current!.addQuote(sampleQuote);
+    });
+
+    expect(wrapper.find(`[data-test-subj="add-comment"] textarea`).text()).toBe(
       `${sampleData.comment}\n\n${sampleQuote}`
     );
   });
+
+  it('it should insert a timeline', async () => {
+    useInsertTimelineMock.mockImplementation((comment, onTimelineAttached) => {
+      onTimelineAttached(`[title](url)`);
+    });
+
+    const wrapper = mount(
+      <TestProviders>
+        <Router history={mockHistory}>
+          <AddComment {...{ ...addCommentProps }} />
+        </Router>
+      </TestProviders>
+    );
+
+    await waitFor(() => {
+      expect(wrapper.find(`[data-test-subj="add-comment"] textarea`).text()).toBe('[title](url)');
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
index 859ba3d1a0951..daa7c24858b94 100644
--- a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
@@ -12,12 +12,11 @@ import { CommentType } from '../../../../../case/common/api';
 import { usePostComment } from '../../containers/use_post_comment';
 import { Case } from '../../containers/types';
 import { MarkdownEditorForm } from '../../../common/components/markdown_editor/eui_form';
-import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
 import { Form, useForm, UseField, useFormData } from '../../../shared_imports';
 
 import * as i18n from './translations';
 import { schema, AddCommentFormSchema } from './schema';
-import { useTimelineClick } from '../../../common/utils/timeline/use_timeline_click';
+import { useInsertTimeline } from '../use_insert_timeline';
 
 const MySpinner = styled(EuiLoadingSpinner)`
   position: absolute;
@@ -56,12 +55,6 @@ export const AddComment = React.memo(
       const { setFieldValue, reset, submit } = form;
       const [{ comment }] = useFormData<{ comment: string }>({ form, watch: [fieldName] });
 
-      const onCommentChange = useCallback((newValue) => setFieldValue(fieldName, newValue), [
-        setFieldValue,
-      ]);
-
-      const { handleCursorChange } = useInsertTimeline(comment, onCommentChange);
-
       const addQuote = useCallback(
         (quote) => {
           setFieldValue(fieldName, `${comment}${comment.length > 0 ? '\n\n' : ''}${quote}`);
@@ -73,7 +66,12 @@ export const AddComment = React.memo(
         addQuote,
       }));
 
-      const handleTimelineClick = useTimelineClick();
+      const onTimelineAttached = useCallback(
+        (newValue: string) => setFieldValue(fieldName, newValue),
+        [setFieldValue]
+      );
+
+      useInsertTimeline(comment ?? '', onTimelineAttached);
 
       const onSubmit = useCallback(async () => {
         const { isValid, data } = await submit();
@@ -98,8 +96,6 @@ export const AddComment = React.memo(
                 isDisabled: isLoading,
                 dataTestSubj: 'add-comment',
                 placeholder: i18n.ADD_COMMENT_HELP_TEXT,
-                onCursorPositionUpdate: handleCursorChange,
-                onClickTimeline: handleTimelineClick,
                 bottomRightContent: (
                   <EuiButton
                     data-test-subj="submit-comment"
diff --git a/x-pack/plugins/security_solution/public/cases/components/all_cases/table_filters.test.tsx b/x-pack/plugins/security_solution/public/cases/components/all_cases/table_filters.test.tsx
index 4371a180bc81d..9b516f600e9e5 100644
--- a/x-pack/plugins/security_solution/public/cases/components/all_cases/table_filters.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/all_cases/table_filters.test.tsx
@@ -13,7 +13,6 @@ import { TestProviders } from '../../../common/mock';
 import { useGetTags } from '../../containers/use_get_tags';
 import { useGetReporters } from '../../containers/use_get_reporters';
 import { DEFAULT_FILTER_OPTIONS } from '../../containers/use_get_cases';
-jest.mock('../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline');
 jest.mock('../../containers/use_get_reporters');
 jest.mock('../../containers/use_get_tags');
 
diff --git a/x-pack/plugins/security_solution/public/cases/components/configure_cases/connectors_dropdown.tsx b/x-pack/plugins/security_solution/public/cases/components/configure_cases/connectors_dropdown.tsx
index 895406b4f77c3..6e78ba3b2df62 100644
--- a/x-pack/plugins/security_solution/public/cases/components/configure_cases/connectors_dropdown.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/configure_cases/connectors_dropdown.tsx
@@ -9,7 +9,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiIcon, EuiSuperSelect } from '@elastic/eui
 import styled from 'styled-components';
 
 import { ActionConnector } from '../../containers/configure/types';
-import { connectorsConfiguration } from '../../../common/lib/connectors/config';
+import { connectorsConfiguration } from '../connectors';
 import * as i18n from './translations';
 
 export interface Props {
diff --git a/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping.test.tsx b/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping.test.tsx
index 67963c7487826..e79c031c7002c 100644
--- a/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping.test.tsx
@@ -7,8 +7,7 @@
 import React from 'react';
 import { mount, ReactWrapper } from 'enzyme';
 
-import { connectorsConfiguration } from '../../../common/lib/connectors/config';
-import { createDefaultMapping } from '../../../common/lib/connectors/utils';
+import { connectorsConfiguration, createDefaultMapping } from '../connectors';
 
 import { FieldMapping, FieldMappingProps } from './field_mapping';
 import { mapping } from './__mock__';
diff --git a/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping.tsx b/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping.tsx
index fe5c0c19820a1..b15c82f254aea 100644
--- a/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping.tsx
@@ -14,16 +14,16 @@ import {
   ActionType,
   ThirdPartyField,
 } from '../../containers/configure/types';
-import { FieldMappingRow } from './field_mapping_row';
-import * as i18n from './translations';
-
-import { connectorsConfiguration } from '../../../common/lib/connectors/config';
-import { setActionTypeToMapping, setThirdPartyToMapping } from './utils';
 import {
   ThirdPartyField as ConnectorConfigurationThirdPartyField,
   AllThirdPartyFields,
-} from '../../../common/lib/connectors/types';
-import { createDefaultMapping } from '../../../common/lib/connectors/utils';
+  createDefaultMapping,
+  connectorsConfiguration,
+} from '../connectors';
+
+import { FieldMappingRow } from './field_mapping_row';
+import * as i18n from './translations';
+import { setActionTypeToMapping, setThirdPartyToMapping } from './utils';
 
 const FieldRowWrapper = styled.div`
   margin-top: 8px;
diff --git a/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping_row.tsx b/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping_row.tsx
index 6e688b213f82c..b924cad1475a8 100644
--- a/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping_row.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/configure_cases/field_mapping_row.tsx
@@ -15,7 +15,7 @@ import {
 
 import { capitalize } from 'lodash/fp';
 import { CaseField, ActionType, ThirdPartyField } from '../../containers/configure/types';
-import { AllThirdPartyFields } from '../../../common/lib/connectors/types';
+import { AllThirdPartyFields } from '../connectors';
 
 export interface RowProps {
   id: string;
diff --git a/x-pack/plugins/security_solution/public/cases/components/configure_cases/index.tsx b/x-pack/plugins/security_solution/public/cases/components/configure_cases/index.tsx
index 1c24738f2b2c0..e2dd405b7804d 100644
--- a/x-pack/plugins/security_solution/public/cases/components/configure_cases/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/configure_cases/index.tsx
@@ -18,7 +18,7 @@ import { ClosureType } from '../../containers/configure/types';
 
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { ActionConnectorTableItem } from '../../../../../triggers_actions_ui/public/types';
-import { connectorsConfiguration } from '../../../common/lib/connectors/config';
+import { connectorsConfiguration } from '../connectors';
 
 import { SectionWrapper } from '../wrappers';
 import { Connectors } from './connectors';
diff --git a/x-pack/plugins/security_solution/public/cases/components/connector_selector/form.test.tsx b/x-pack/plugins/security_solution/public/cases/components/connector_selector/form.test.tsx
new file mode 100644
index 0000000000000..7b1c177908b22
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/connector_selector/form.test.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { UseField, Form, useForm, FormHook } from '../../../shared_imports';
+import { ConnectorSelector } from './form';
+import { connectorsMock } from '../../containers/mock';
+import { getFormMock } from '../__mock__/form';
+
+jest.mock(
+  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form'
+);
+
+const useFormMock = useForm as jest.Mock;
+
+describe('ConnectorSelector', () => {
+  const formHookMock = getFormMock({ connectorId: connectorsMock[0].id });
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    useFormMock.mockImplementation(() => ({ form: formHookMock }));
+  });
+
+  it('it should render', async () => {
+    const wrapper = mount(
+      <Form form={(formHookMock as unknown) as FormHook}>
+        <UseField
+          path="connectorId"
+          component={ConnectorSelector}
+          componentProps={{
+            connectors: connectorsMock,
+            dataTestSubj: 'caseConnectors',
+            disabled: false,
+            idAria: 'caseConnectors',
+            isLoading: false,
+          }}
+        />
+      </Form>
+    );
+
+    expect(wrapper.find(`[data-test-subj="caseConnectors"]`).exists()).toBeTruthy();
+  });
+
+  it('it should not render when is not in edit mode', async () => {
+    const wrapper = mount(
+      <Form form={(formHookMock as unknown) as FormHook}>
+        <UseField
+          path="connectorId"
+          component={ConnectorSelector}
+          componentProps={{
+            connectors: connectorsMock,
+            dataTestSubj: 'caseConnectors',
+            disabled: false,
+            idAria: 'caseConnectors',
+            isLoading: false,
+            isEdit: false,
+          }}
+        />
+      </Form>
+    );
+
+    expect(wrapper.find(`[data-test-subj="caseConnectors"]`).exists()).toBeFalsy();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/connector_selector/form.tsx b/x-pack/plugins/security_solution/public/cases/components/connector_selector/form.tsx
index 7de7b3d6b2a96..9017365eea02b 100644
--- a/x-pack/plugins/security_solution/public/cases/components/connector_selector/form.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/connector_selector/form.tsx
@@ -4,8 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import React from 'react';
+import { isEmpty } from 'lodash/fp';
 import { EuiFormRow } from '@elastic/eui';
-import React, { useCallback, useEffect } from 'react';
 
 import { FieldHook, getFieldValidityAndErrorMessage } from '../../../shared_imports';
 import { ConnectorsDropdown } from '../configure_cases/connectors_dropdown';
@@ -14,9 +15,8 @@ import { ActionConnector } from '../../../../../case/common/api/cases';
 interface ConnectorSelectorProps {
   connectors: ActionConnector[];
   dataTestSubj: string;
-  defaultValue?: ActionConnector;
   disabled: boolean;
-  field: FieldHook;
+  field: FieldHook<string>;
   idAria: string;
   isEdit: boolean;
   isLoading: boolean;
@@ -24,7 +24,6 @@ interface ConnectorSelectorProps {
 export const ConnectorSelector = ({
   connectors,
   dataTestSubj,
-  defaultValue,
   disabled = false,
   field,
   idAria,
@@ -32,19 +31,6 @@ export const ConnectorSelector = ({
   isLoading = false,
 }: ConnectorSelectorProps) => {
   const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
-
-  useEffect(() => {
-    field.setValue(defaultValue);
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValue]);
-
-  const handleContentChange = useCallback(
-    (newConnector: string) => {
-      field.setValue(newConnector);
-    },
-    [field]
-  );
-
   return isEdit ? (
     <EuiFormRow
       data-test-subj={dataTestSubj}
@@ -60,8 +46,8 @@ export const ConnectorSelector = ({
         connectors={connectors}
         disabled={disabled}
         isLoading={isLoading}
-        onChange={handleContentChange}
-        selectedConnector={(field.value as string) ?? 'none'}
+        onChange={field.setValue}
+        selectedConnector={isEmpty(field.value) ? 'none' : field.value}
       />
     </EuiFormRow>
   ) : null;
diff --git a/x-pack/plugins/security_solution/public/cases/components/connectors/case/cases_dropdown.tsx b/x-pack/plugins/security_solution/public/cases/components/connectors/case/cases_dropdown.tsx
new file mode 100644
index 0000000000000..931e23e811b1b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/connectors/case/cases_dropdown.tsx
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiFormRow, EuiSuperSelect, EuiSuperSelectOption } from '@elastic/eui';
+import React, { memo, useMemo, useCallback } from 'react';
+import { Case } from '../../../containers/types';
+
+import * as i18n from './translations';
+
+interface CaseDropdownProps {
+  isLoading: boolean;
+  cases: Case[];
+  selectedCase?: string;
+  onCaseChanged: (id: string) => void;
+}
+
+export const ADD_CASE_BUTTON_ID = 'add-case';
+
+const addNewCase = {
+  value: ADD_CASE_BUTTON_ID,
+  inputDisplay: (
+    <span className="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--xSmall euiButtonEmpty--flushLeft">
+      {i18n.CASE_CONNECTOR_ADD_NEW_CASE}
+    </span>
+  ),
+  'data-test-subj': 'dropdown-connector-add-connector',
+};
+
+const CasesDropdownComponent: React.FC<CaseDropdownProps> = ({
+  isLoading,
+  cases,
+  selectedCase,
+  onCaseChanged,
+}) => {
+  const caseOptions: Array<EuiSuperSelectOption<string>> = useMemo(
+    () =>
+      cases.reduce<Array<EuiSuperSelectOption<string>>>(
+        (acc, theCase) => [
+          ...acc,
+          {
+            value: theCase.id,
+            inputDisplay: <span>{theCase.title}</span>,
+            'data-test-subj': `case-connector-cases-dropdown-${theCase.id}`,
+          },
+        ],
+        []
+      ),
+    [cases]
+  );
+
+  const options = useMemo(() => [...caseOptions, addNewCase], [caseOptions]);
+  const onChange = useCallback((id: string) => onCaseChanged(id), [onCaseChanged]);
+
+  return (
+    <EuiFormRow label={i18n.CASE_CONNECTOR_CASES_DROPDOWN_ROW_LABEL} fullWidth={true}>
+      <EuiSuperSelect
+        options={options}
+        data-test-subj="case-connector-cases-dropdown"
+        disabled={isLoading}
+        fullWidth
+        isLoading={isLoading}
+        valueOfSelected={selectedCase}
+        onChange={onChange}
+      />
+    </EuiFormRow>
+  );
+};
+
+export const CasesDropdown = memo(CasesDropdownComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/connectors/case/existing_case.tsx b/x-pack/plugins/security_solution/public/cases/components/connectors/case/existing_case.tsx
new file mode 100644
index 0000000000000..28e051a713bf4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/connectors/case/existing_case.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useMemo, useCallback } from 'react';
+import { useGetCases } from '../../../containers/use_get_cases';
+import { useCreateCaseModal } from '../../use_create_case_modal';
+import { CasesDropdown, ADD_CASE_BUTTON_ID } from './cases_dropdown';
+
+interface ExistingCaseProps {
+  selectedCase: string | null;
+  onCaseChanged: (id: string) => void;
+}
+
+const ExistingCaseComponent: React.FC<ExistingCaseProps> = ({ onCaseChanged, selectedCase }) => {
+  const { data: cases, loading: isLoadingCases, refetchCases } = useGetCases();
+
+  const onCaseCreated = useCallback(() => refetchCases(), [refetchCases]);
+
+  const { Modal: CreateCaseModal, openModal } = useCreateCaseModal({ onCaseCreated });
+
+  const onChange = useCallback(
+    (id: string) => {
+      if (id === ADD_CASE_BUTTON_ID) {
+        openModal();
+        return;
+      }
+
+      onCaseChanged(id);
+    },
+    [onCaseChanged, openModal]
+  );
+
+  const isCasesLoading = useMemo(
+    () => isLoadingCases.includes('cases') || isLoadingCases.includes('caseUpdate'),
+    [isLoadingCases]
+  );
+
+  return (
+    <>
+      <CasesDropdown
+        isLoading={isCasesLoading}
+        cases={cases.cases}
+        selectedCase={selectedCase ?? undefined}
+        onCaseChanged={onChange}
+      />
+      <CreateCaseModal />
+    </>
+  );
+};
+
+export const ExistingCase = memo(ExistingCaseComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/connectors/case/fields.tsx b/x-pack/plugins/security_solution/public/cases/components/connectors/case/fields.tsx
new file mode 100644
index 0000000000000..91087138e52d5
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/connectors/case/fields.tsx
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable @kbn/eslint/no-restricted-paths */
+
+import React, { useCallback, useEffect, useState } from 'react';
+import styled from 'styled-components';
+import { EuiCallOut } from '@elastic/eui';
+
+import { ActionParamsProps } from '../../../../../../triggers_actions_ui/public/types';
+import { CommentType } from '../../../../../../case/common/api';
+
+import { CaseActionParams } from './types';
+import { ExistingCase } from './existing_case';
+
+import * as i18n from './translations';
+
+const Container = styled.div`
+  ${({ theme }) => `
+    margin-top: ${theme.eui?.euiSize ?? '16px'};
+  `}
+`;
+
+const defaultAlertComment = {
+  type: CommentType.alert,
+  alertId: '{{context.rule.id}}',
+  index: '{{context.rule.output_index}}',
+};
+
+const CaseParamsFields: React.FunctionComponent<ActionParamsProps<CaseActionParams>> = ({
+  actionParams,
+  editAction,
+  index,
+  errors,
+  messageVariables,
+  actionConnector,
+}) => {
+  const { caseId = null, comment = defaultAlertComment } = actionParams.subActionParams ?? {};
+
+  const [selectedCase, setSelectedCase] = useState<string | null>(null);
+
+  const editSubActionProperty = useCallback(
+    (key: string, value: unknown) => {
+      const newProps = { ...actionParams.subActionParams, [key]: value };
+      editAction('subActionParams', newProps, index);
+    },
+    [actionParams.subActionParams, editAction, index]
+  );
+
+  const onCaseChanged = useCallback(
+    (id: string) => {
+      setSelectedCase(id);
+      editSubActionProperty('caseId', id);
+    },
+    [editSubActionProperty]
+  );
+
+  useEffect(() => {
+    if (!actionParams.subAction) {
+      editAction('subAction', 'addComment', index);
+    }
+
+    if (!actionParams.subActionParams?.caseId) {
+      editSubActionProperty('caseId', caseId);
+    }
+
+    if (!actionParams.subActionParams?.comment) {
+      editSubActionProperty('comment', comment);
+    }
+
+    if (caseId != null) {
+      setSelectedCase((prevCaseId) => (prevCaseId !== caseId ? caseId : prevCaseId));
+    }
+
+    // editAction creates an infinity loop.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [
+    actionConnector,
+    index,
+    actionParams.subActionParams?.caseId,
+    actionParams.subActionParams?.comment,
+    caseId,
+    comment,
+    actionParams.subAction,
+  ]);
+
+  return (
+    <>
+      <EuiCallOut size="s" title={i18n.CASE_CONNECTOR_CALL_OUT_INFO} iconType="iInCircle" />
+      <Container>
+        <ExistingCase onCaseChanged={onCaseChanged} selectedCase={selectedCase} />
+      </Container>
+    </>
+  );
+};
+
+// eslint-disable-next-line import/no-default-export
+export { CaseParamsFields as default };
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/case/index.ts b/x-pack/plugins/security_solution/public/cases/components/connectors/case/index.ts
similarity index 57%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/case/index.ts
rename to x-pack/plugins/security_solution/public/cases/components/connectors/case/index.ts
index 271b1bfd2e3de..0aacd61991771 100644
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/case/index.ts
+++ b/x-pack/plugins/security_solution/public/cases/components/connectors/case/index.ts
@@ -3,11 +3,29 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { lazy } from 'react';
 
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { ActionTypeModel } from '../../../../../../triggers_actions_ui/public/types';
+import { CaseActionParams } from './types';
 import * as i18n from './translations';
 
+interface ValidationResult {
+  errors: {
+    caseId: string[];
+  };
+}
+
+const validateParams = (actionParams: CaseActionParams) => {
+  const validationResult: ValidationResult = { errors: { caseId: [] } };
+
+  if (actionParams.subActionParams && !actionParams.subActionParams.caseId) {
+    validationResult.errors.caseId.push(i18n.CASE_CONNECTOR_CASE_REQUIRED);
+  }
+
+  return validationResult;
+};
+
 export function getActionType(): ActionTypeModel {
   return {
     id: '.case',
@@ -15,8 +33,8 @@ export function getActionType(): ActionTypeModel {
     selectMessage: i18n.CASE_CONNECTOR_DESC,
     actionTypeTitle: i18n.CASE_CONNECTOR_TITLE,
     validateConnector: () => ({ errors: {} }),
-    validateParams: () => ({ errors: {} }),
+    validateParams,
     actionConnectorFields: null,
-    actionParamsFields: null,
+    actionParamsFields: lazy(() => import('./fields')),
   };
 }
diff --git a/x-pack/plugins/security_solution/public/cases/components/connectors/case/translations.ts b/x-pack/plugins/security_solution/public/cases/components/connectors/case/translations.ts
new file mode 100644
index 0000000000000..8cfcf2b9a073b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/connectors/case/translations.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export * from '../../../translations';
+
+export const CASE_CONNECTOR_DESC = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.selectMessageText',
+  {
+    defaultMessage: 'Create or update a case.',
+  }
+);
+
+export const CASE_CONNECTOR_TITLE = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.actionTypeTitle',
+  {
+    defaultMessage: 'Cases',
+  }
+);
+
+export const CASE_CONNECTOR_COMMENT_LABEL = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.commentLabel',
+  {
+    defaultMessage: 'Comment',
+  }
+);
+
+export const CASE_CONNECTOR_COMMENT_REQUIRED = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.commentRequired',
+  {
+    defaultMessage: 'Comment is required.',
+  }
+);
+
+export const CASE_CONNECTOR_CASES_DROPDOWN_ROW_LABEL = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.casesDropdownRowLabel',
+  {
+    defaultMessage: 'Case',
+  }
+);
+
+export const CASE_CONNECTOR_CASES_DROPDOWN_PLACEHOLDER = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.casesDropdownPlaceholder',
+  {
+    defaultMessage: 'Select case',
+  }
+);
+
+export const CASE_CONNECTOR_CASES_OPTION_NEW_CASE = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.optionAddNewCase',
+  {
+    defaultMessage: 'Add to a new case',
+  }
+);
+
+export const CASE_CONNECTOR_CASES_OPTION_EXISTING_CASE = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.optionAddToExistingCase',
+  {
+    defaultMessage: 'Add to existing case',
+  }
+);
+
+export const CASE_CONNECTOR_CASE_REQUIRED = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.caseRequired',
+  {
+    defaultMessage: 'You must select a case.',
+  }
+);
+
+export const CASE_CONNECTOR_CALL_OUT_INFO = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.callOutInfo',
+  {
+    defaultMessage: 'All alerts after rule creation will be appended to the selected case.',
+  }
+);
+
+export const CASE_CONNECTOR_ADD_NEW_CASE = i18n.translate(
+  'xpack.securitySolution.case.components.connectors.case.addNewCaseOption',
+  {
+    defaultMessage: 'Add new case',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/cases/components/connectors/case/types.ts b/x-pack/plugins/security_solution/public/cases/components/connectors/case/types.ts
new file mode 100644
index 0000000000000..8173a814c2d89
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/connectors/case/types.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface CaseActionParams {
+  subAction: string;
+  subActionParams: {
+    caseId: string;
+    comment: {
+      alertId: string;
+      index: string;
+      type: 'alert';
+    };
+  };
+}
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/config.ts b/x-pack/plugins/security_solution/public/cases/components/connectors/config.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/config.ts
rename to x-pack/plugins/security_solution/public/cases/components/connectors/config.ts
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/index.ts b/x-pack/plugins/security_solution/public/cases/components/connectors/index.ts
similarity index 79%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/index.ts
rename to x-pack/plugins/security_solution/public/cases/components/connectors/index.ts
index 58d7e89e080e7..e77aa9bdd84b1 100644
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/index.ts
+++ b/x-pack/plugins/security_solution/public/cases/components/connectors/index.ts
@@ -5,3 +5,7 @@
  */
 
 export { getActionType as getCaseConnectorUI } from './case';
+
+export * from './config';
+export * from './types';
+export * from './utils';
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/types.ts b/x-pack/plugins/security_solution/public/cases/components/connectors/types.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/types.ts
rename to x-pack/plugins/security_solution/public/cases/components/connectors/types.ts
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/utils.ts b/x-pack/plugins/security_solution/public/cases/components/connectors/utils.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/utils.ts
rename to x-pack/plugins/security_solution/public/cases/components/connectors/utils.ts
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/connector.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/connector.test.tsx
new file mode 100644
index 0000000000000..89b9e3b30ede1
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/connector.test.tsx
@@ -0,0 +1,186 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { act, waitFor } from '@testing-library/react';
+import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
+
+import { useForm, Form, FormHook } from '../../../shared_imports';
+import { connectorsMock } from '../../containers/mock';
+import { Connector } from './connector';
+import { useConnectors } from '../../containers/configure/use_connectors';
+import { useGetIncidentTypes } from '../settings/resilient/use_get_incident_types';
+import { useGetSeverity } from '../settings/resilient/use_get_severity';
+
+jest.mock('../../../common/lib/kibana', () => {
+  return {
+    useKibana: () => ({
+      services: {
+        notifications: {},
+        http: {},
+      },
+    }),
+  };
+});
+jest.mock('../../containers/configure/use_connectors');
+jest.mock('../settings/resilient/use_get_incident_types');
+jest.mock('../settings/resilient/use_get_severity');
+
+const useConnectorsMock = useConnectors as jest.Mock;
+const useGetIncidentTypesMock = useGetIncidentTypes as jest.Mock;
+const useGetSeverityMock = useGetSeverity as jest.Mock;
+
+const useGetIncidentTypesResponse = {
+  isLoading: false,
+  incidentTypes: [
+    {
+      id: 19,
+      name: 'Malware',
+    },
+    {
+      id: 21,
+      name: 'Denial of Service',
+    },
+  ],
+};
+
+const useGetSeverityResponse = {
+  isLoading: false,
+  severity: [
+    {
+      id: 4,
+      name: 'Low',
+    },
+    {
+      id: 5,
+      name: 'Medium',
+    },
+    {
+      id: 6,
+      name: 'High',
+    },
+  ],
+};
+
+describe('Connector', () => {
+  let globalForm: FormHook;
+
+  const MockHookWrapperComponent: React.FC = ({ children }) => {
+    const { form } = useForm<{ connectorId: string; fields: Record<string, unknown> | null }>({
+      defaultValue: { connectorId: connectorsMock[0].id, fields: null },
+    });
+
+    globalForm = form;
+
+    return <Form form={form}>{children}</Form>;
+  };
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    useConnectorsMock.mockReturnValue({ loading: false, connectors: connectorsMock });
+    useGetIncidentTypesMock.mockReturnValue(useGetIncidentTypesResponse);
+    useGetSeverityMock.mockReturnValue(useGetSeverityResponse);
+  });
+
+  it('it renders', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Connector isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find(`[data-test-subj="caseConnectors"]`).exists()).toBeTruthy();
+    expect(wrapper.find(`[data-test-subj="connector-settings"]`).exists()).toBeTruthy();
+
+    waitFor(() => {
+      expect(wrapper.find(`[data-test-subj="connector-settings-sn"]`).exists()).toBeTruthy();
+    });
+  });
+
+  it('it is loading when fetching connectors', async () => {
+    useConnectorsMock.mockReturnValue({ loading: true, connectors: connectorsMock });
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Connector isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(
+      wrapper.find('[data-test-subj="dropdown-connectors"]').first().prop('isLoading')
+    ).toEqual(true);
+  });
+
+  it('it is disabled when fetching connectors', async () => {
+    useConnectorsMock.mockReturnValue({ loading: true, connectors: connectorsMock });
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Connector isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find('[data-test-subj="dropdown-connectors"]').first().prop('disabled')).toEqual(
+      true
+    );
+  });
+
+  it('it is disabled and loading when passing loading as true', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Connector isLoading={true} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(
+      wrapper.find('[data-test-subj="dropdown-connectors"]').first().prop('isLoading')
+    ).toEqual(true);
+    expect(wrapper.find('[data-test-subj="dropdown-connectors"]').first().prop('disabled')).toEqual(
+      true
+    );
+  });
+
+  it(`it should change connector`, async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Connector isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    await waitFor(() => {
+      expect(wrapper.find(`[data-test-subj="connector-settings-resilient"]`).exists()).toBeFalsy();
+      wrapper.find('button[data-test-subj="dropdown-connectors"]').simulate('click');
+      wrapper.find(`button[data-test-subj="dropdown-connector-resilient-2"]`).simulate('click');
+      wrapper.update();
+    });
+
+    await waitFor(() => {
+      wrapper.update();
+      expect(wrapper.find(`[data-test-subj="connector-settings-resilient"]`).exists()).toBeTruthy();
+    });
+
+    act(() => {
+      ((wrapper.find(EuiComboBox).props() as unknown) as {
+        onChange: (a: EuiComboBoxOptionOption[]) => void;
+      }).onChange([{ value: '19', label: 'Denial of Service' }]);
+    });
+
+    act(() => {
+      wrapper
+        .find('select[data-test-subj="severitySelect"]')
+        .first()
+        .simulate('change', {
+          target: { value: '4' },
+        });
+    });
+
+    await waitFor(() => {
+      expect(globalForm.getFormData()).toEqual({
+        connectorId: 'resilient-2',
+        fields: { incidentTypes: ['19'], severityCode: '4' },
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/connector.tsx b/x-pack/plugins/security_solution/public/cases/components/create/connector.tsx
new file mode 100644
index 0000000000000..b2a0f3c351552
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/connector.tsx
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useEffect } from 'react';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+
+import { ConnectorTypeFields } from '../../../../../case/common/api/connectors';
+import { UseField, useFormData, FieldHook } from '../../../shared_imports';
+import { useConnectors } from '../../containers/configure/use_connectors';
+import { ConnectorSelector } from '../connector_selector/form';
+import { SettingFieldsForm } from '../settings/fields_form';
+import { ActionConnector } from '../../containers/types';
+import { getConnectorById } from '../configure_cases/utils';
+
+interface Props {
+  isLoading: boolean;
+}
+
+interface SettingsFieldProps {
+  connectors: ActionConnector[];
+  field: FieldHook<ConnectorTypeFields['fields']>;
+  isEdit: boolean;
+}
+
+const SettingsField = ({ connectors, isEdit, field }: SettingsFieldProps) => {
+  const [{ connectorId }] = useFormData({ watch: ['connectorId'] });
+  const { setValue } = field;
+  const connector = getConnectorById(connectorId, connectors) ?? null;
+
+  useEffect(() => {
+    if (connectorId) {
+      setValue(null);
+    }
+  }, [setValue, connectorId]);
+
+  return (
+    <SettingFieldsForm
+      connector={connector}
+      fields={field.value}
+      isEdit={isEdit}
+      onChange={setValue}
+    />
+  );
+};
+
+const ConnectorComponent: React.FC<Props> = ({ isLoading }) => {
+  const { loading: isLoadingConnectors, connectors } = useConnectors();
+
+  return (
+    <EuiFlexGroup>
+      <EuiFlexItem>
+        <UseField
+          path="connectorId"
+          component={ConnectorSelector}
+          componentProps={{
+            connectors,
+            dataTestSubj: 'caseConnectors',
+            disabled: isLoading || isLoadingConnectors,
+            idAria: 'caseConnectors',
+            isLoading: isLoading || isLoadingConnectors,
+          }}
+        />
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <UseField
+          path="fields"
+          component={SettingsField}
+          componentProps={{
+            connectors,
+            isEdit: true,
+          }}
+        />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+ConnectorComponent.displayName = 'ConnectorComponent';
+
+export const Connector = memo(ConnectorComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/description.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/description.test.tsx
new file mode 100644
index 0000000000000..201a61febc628
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/description.test.tsx
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { act } from '@testing-library/react';
+
+import { useForm, Form, FormHook } from '../../../shared_imports';
+import { Description } from './description';
+
+describe('Description', () => {
+  let globalForm: FormHook;
+
+  const MockHookWrapperComponent: React.FC = ({ children }) => {
+    const { form } = useForm<{ description: string }>({
+      defaultValue: { description: 'My description' },
+    });
+
+    globalForm = form;
+
+    return <Form form={form}>{children}</Form>;
+  };
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
+  it('it renders', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Description isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find(`[data-test-subj="caseDescription"]`).exists()).toBeTruthy();
+  });
+
+  it('it changes the description', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Description isLoading={true} />
+      </MockHookWrapperComponent>
+    );
+
+    await act(async () => {
+      wrapper
+        .find(`[data-test-subj="caseDescription"] textarea`)
+        .first()
+        .simulate('change', { target: { value: 'My new description' } });
+    });
+
+    expect(globalForm.getFormData()).toEqual({ description: 'My new description' });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/description.tsx b/x-pack/plugins/security_solution/public/cases/components/create/description.tsx
new file mode 100644
index 0000000000000..f130bd14644f8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/description.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { MarkdownEditorForm } from '../../../common/components/markdown_editor/eui_form';
+import { UseField } from '../../../shared_imports';
+
+interface Props {
+  isLoading: boolean;
+}
+
+export const fieldName = 'description';
+
+const DescriptionComponent: React.FC<Props> = ({ isLoading }) => (
+  <UseField
+    path={fieldName}
+    component={MarkdownEditorForm}
+    componentProps={{
+      dataTestSubj: 'caseDescription',
+      idAria: 'caseDescription',
+      isDisabled: isLoading,
+    }}
+  />
+);
+
+DescriptionComponent.displayName = 'DescriptionComponent';
+
+export const Description = memo(DescriptionComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/form.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/form.test.tsx
new file mode 100644
index 0000000000000..e64b2b3a05080
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/form.test.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+
+import { useForm, Form } from '../../../shared_imports';
+import { useGetTags } from '../../containers/use_get_tags';
+import { useConnectors } from '../../containers/configure/use_connectors';
+import { connectorsMock } from '../../containers/mock';
+import { schema, FormProps } from './schema';
+import { CreateCaseForm } from './form';
+
+jest.mock('../../containers/use_get_tags');
+jest.mock('../../containers/configure/use_connectors');
+const useGetTagsMock = useGetTags as jest.Mock;
+const useConnectorsMock = useConnectors as jest.Mock;
+
+const initialCaseValue: FormProps = {
+  description: '',
+  tags: [],
+  title: '',
+  connectorId: 'none',
+  fields: null,
+};
+
+describe('CreateCaseForm', () => {
+  const MockHookWrapperComponent: React.FC = ({ children }) => {
+    const { form } = useForm<FormProps>({
+      defaultValue: initialCaseValue,
+      options: { stripEmptyFields: false },
+      schema,
+    });
+
+    return <Form form={form}>{children}</Form>;
+  };
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    useGetTagsMock.mockReturnValue({ tags: ['test'] });
+    useConnectorsMock.mockReturnValue({ loading: false, connectors: connectorsMock });
+  });
+
+  it('it renders with steps', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <CreateCaseForm />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find(`[data-test-subj="case-creation-form-steps"]`).exists()).toBeTruthy();
+  });
+
+  it('it renders without steps', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <CreateCaseForm withSteps={false} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find(`[data-test-subj="case-creation-form-steps"]`).exists()).toBeFalsy();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/form.tsx b/x-pack/plugins/security_solution/public/cases/components/create/form.tsx
new file mode 100644
index 0000000000000..40db4d792c1c8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/form.tsx
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useMemo } from 'react';
+import { EuiLoadingSpinner, EuiSteps } from '@elastic/eui';
+import styled, { css } from 'styled-components';
+
+import { useFormContext } from '../../../shared_imports';
+
+import { Title } from './title';
+import { Description } from './description';
+import { Tags } from './tags';
+import { Connector } from './connector';
+import * as i18n from './translations';
+
+interface ContainerProps {
+  big?: boolean;
+}
+
+const Container = styled.div.attrs((props) => props)<ContainerProps>`
+  ${({ big, theme }) => css`
+    margin-top: ${big ? theme.eui?.euiSizeXL ?? '32px' : theme.eui?.euiSize ?? '16px'};
+  `}
+`;
+
+const MySpinner = styled(EuiLoadingSpinner)`
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  z-index: 99;
+`;
+
+interface Props {
+  withSteps?: boolean;
+}
+
+export const CreateCaseForm: React.FC<Props> = React.memo(({ withSteps = true }) => {
+  const { isSubmitting } = useFormContext();
+
+  const firstStep = useMemo(
+    () => ({
+      title: i18n.STEP_ONE_TITLE,
+      children: (
+        <>
+          <Title isLoading={isSubmitting} />
+          <Container>
+            <Tags isLoading={isSubmitting} />
+          </Container>
+          <Container big>
+            <Description isLoading={isSubmitting} />
+          </Container>
+        </>
+      ),
+    }),
+    [isSubmitting]
+  );
+
+  const secondStep = useMemo(
+    () => ({
+      title: i18n.STEP_TWO_TITLE,
+      children: (
+        <Container>
+          <Connector isLoading={isSubmitting} />
+        </Container>
+      ),
+    }),
+    [isSubmitting]
+  );
+
+  const allSteps = useMemo(() => [firstStep, secondStep], [firstStep, secondStep]);
+
+  return (
+    <>
+      {isSubmitting && <MySpinner data-test-subj="create-case-loading-spinner" size="xl" />}
+      {withSteps ? (
+        <EuiSteps
+          headingElement="h2"
+          steps={allSteps}
+          data-test-subj={'case-creation-form-steps'}
+        />
+      ) : (
+        <>
+          {firstStep.children}
+          {secondStep.children}
+        </>
+      )}
+    </>
+  );
+});
+
+CreateCaseForm.displayName = 'CreateCaseForm';
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/form_context.tsx b/x-pack/plugins/security_solution/public/cases/components/create/form_context.tsx
new file mode 100644
index 0000000000000..e11e508b60ebf
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/form_context.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback, useEffect } from 'react';
+
+import { schema, FormProps } from './schema';
+import { Form, useForm } from '../../../shared_imports';
+import {
+  getConnectorById,
+  getNoneConnector,
+  normalizeActionConnector,
+} from '../configure_cases/utils';
+import { usePostCase } from '../../containers/use_post_case';
+import { useConnectors } from '../../containers/configure/use_connectors';
+import { Case } from '../../containers/types';
+
+const initialCaseValue: FormProps = {
+  description: '',
+  tags: [],
+  title: '',
+  connectorId: 'none',
+  fields: null,
+};
+
+interface Props {
+  onSuccess?: (theCase: Case) => void;
+}
+
+export const FormContext: React.FC<Props> = ({ children, onSuccess }) => {
+  const { connectors } = useConnectors();
+  const { caseData, postCase } = usePostCase();
+
+  const submitCase = useCallback(
+    async ({ connectorId: dataConnectorId, fields, ...dataWithoutConnectorId }, isValid) => {
+      if (isValid) {
+        const caseConnector = getConnectorById(dataConnectorId, connectors);
+        const connectorToUpdate = caseConnector
+          ? normalizeActionConnector(caseConnector, fields)
+          : getNoneConnector();
+
+        await postCase({ ...dataWithoutConnectorId, connector: connectorToUpdate });
+      }
+    },
+    [postCase, connectors]
+  );
+
+  const { form } = useForm<FormProps>({
+    defaultValue: initialCaseValue,
+    options: { stripEmptyFields: false },
+    schema,
+    onSubmit: submitCase,
+  });
+
+  useEffect(() => {
+    if (caseData && onSuccess) {
+      onSuccess(caseData);
+    }
+  }, [caseData, onSuccess]);
+
+  return <Form form={form}>{children}</Form>;
+};
+
+FormContext.displayName = 'FormContext';
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/index.test.tsx
index 7902c7065d9a3..29073e7774158 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/index.test.tsx
@@ -5,71 +5,40 @@
  */
 
 import React from 'react';
-import { mount } from 'enzyme';
-import { Create } from '.';
+import { mount, ReactWrapper } from 'enzyme';
+import { act, waitFor } from '@testing-library/react';
+import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 import { TestProviders } from '../../../common/mock';
-import { getFormMock } from '../__mock__/form';
-import { Router, routeData, mockHistory, mockLocation } from '../__mock__/router';
 
-import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
 import { usePostCase } from '../../containers/use_post_case';
 import { useGetTags } from '../../containers/use_get_tags';
-
-import { useForm } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form';
-import { useFormData } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data';
-
-import { waitFor } from '@testing-library/react';
 import { useConnectors } from '../../containers/configure/use_connectors';
 import { connectorsMock } from '../../containers/configure/mock';
 import { ConnectorTypes } from '../../../../../case/common/api/connectors';
+import { Router, routeData, mockHistory, mockLocation } from '../__mock__/router';
+import { useGetIncidentTypes } from '../settings/resilient/use_get_incident_types';
+import { useGetSeverity } from '../settings/resilient/use_get_severity';
+import { useGetIssueTypes } from '../settings/jira/use_get_issue_types';
+import { useGetFieldsByIssueType } from '../settings/jira/use_get_fields_by_issue_type';
+import { Create } from '.';
 
-jest.mock('@elastic/eui', () => {
-  const original = jest.requireActual('@elastic/eui');
-  return {
-    ...original,
-    // eslint-disable-next-line react/display-name
-    EuiFieldText: () => <input />,
-  };
-});
-jest.mock('../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline');
 jest.mock('../../containers/use_post_case');
-
-jest.mock(
-  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form'
-);
-
-jest.mock(
-  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data'
-);
-
 jest.mock('../../containers/use_get_tags');
 jest.mock('../../containers/configure/use_connectors');
-jest.mock(
-  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider',
-  () => ({
-    FormDataProvider: ({ children }: { children: ({ tags }: { tags: string[] }) => void }) =>
-      children({ tags: ['rad', 'dude'] }),
-  })
-);
-const useConnectorsMock = useConnectors as jest.Mock;
-const useFormMock = useForm as jest.Mock;
-const useFormDataMock = useFormData as jest.Mock;
+jest.mock('../settings/resilient/use_get_incident_types');
+jest.mock('../settings/resilient/use_get_severity');
+jest.mock('../settings/jira/use_get_issue_types');
+jest.mock('../settings/jira/use_get_fields_by_issue_type');
+jest.mock('../settings/jira/use_get_single_issue');
+jest.mock('../settings/jira/use_get_issues');
 
-const useInsertTimelineMock = useInsertTimeline as jest.Mock;
+const useConnectorsMock = useConnectors as jest.Mock;
 const usePostCaseMock = usePostCase as jest.Mock;
-
+const useGetIncidentTypesMock = useGetIncidentTypes as jest.Mock;
+const useGetSeverityMock = useGetSeverity as jest.Mock;
+const useGetIssueTypesMock = useGetIssueTypes as jest.Mock;
+const useGetFieldsByIssueTypeMock = useGetFieldsByIssueType as jest.Mock;
 const postCase = jest.fn();
-const handleCursorChange = jest.fn();
-const handleOnTimelineChange = jest.fn();
-
-const defaultInsertTimeline = {
-  cursorPosition: {
-    start: 0,
-    end: 0,
-  },
-  handleCursorChange,
-  handleOnTimelineChange,
-};
 
 const sampleTags = ['coke', 'pepsi'];
 const sampleData = {
@@ -83,27 +52,117 @@ const sampleData = {
     type: ConnectorTypes.none,
   },
 };
+
 const defaultPostCase = {
   isLoading: false,
   isError: false,
   caseData: null,
   postCase,
 };
+
 const sampleConnectorData = { loading: false, connectors: [] };
+
+const useGetIncidentTypesResponse = {
+  isLoading: false,
+  incidentTypes: [
+    {
+      id: 19,
+      name: 'Malware',
+    },
+    {
+      id: 21,
+      name: 'Denial of Service',
+    },
+  ],
+};
+
+const useGetSeverityResponse = {
+  isLoading: false,
+  severity: [
+    {
+      id: 4,
+      name: 'Low',
+    },
+    {
+      id: 5,
+      name: 'Medium',
+    },
+    {
+      id: 6,
+      name: 'High',
+    },
+  ],
+};
+
+const useGetIssueTypesResponse = {
+  isLoading: false,
+  issueTypes: [
+    {
+      id: '10006',
+      name: 'Task',
+    },
+    {
+      id: '10007',
+      name: 'Bug',
+    },
+  ],
+};
+
+const useGetFieldsByIssueTypeResponse = {
+  isLoading: false,
+  fields: {
+    summary: { allowedValues: [], defaultValue: {} },
+    labels: { allowedValues: [], defaultValue: {} },
+    description: { allowedValues: [], defaultValue: {} },
+    priority: {
+      allowedValues: [
+        {
+          name: 'Medium',
+          id: '3',
+        },
+        {
+          name: 'Low',
+          id: '2',
+        },
+      ],
+      defaultValue: { name: 'Medium', id: '3' },
+    },
+  },
+};
+
+const fillForm = async (wrapper: ReactWrapper) => {
+  await act(async () => {
+    wrapper
+      .find(`[data-test-subj="caseTitle"] input`)
+      .first()
+      .simulate('change', { target: { value: sampleData.title } });
+  });
+
+  await act(async () => {
+    wrapper
+      .find(`[data-test-subj="caseDescription"] textarea`)
+      .first()
+      .simulate('change', { target: { value: sampleData.description } });
+  });
+
+  await waitFor(() => {
+    ((wrapper.find(EuiComboBox).props() as unknown) as {
+      onChange: (a: EuiComboBoxOptionOption[]) => void;
+    }).onChange(sampleTags.map((tag) => ({ label: tag })));
+  });
+};
+
 describe('Create case', () => {
   const fetchTags = jest.fn();
-  const formHookMock = getFormMock(sampleData);
   beforeEach(() => {
     jest.resetAllMocks();
-    useInsertTimelineMock.mockImplementation(() => defaultInsertTimeline);
     usePostCaseMock.mockImplementation(() => defaultPostCase);
-    useFormMock.mockImplementation(() => ({ form: formHookMock }));
-    useFormDataMock.mockImplementation(() => [
-      {
-        description: sampleData.description,
-      },
-    ]);
     useConnectorsMock.mockReturnValue(sampleConnectorData);
+    useGetIncidentTypesMock.mockReturnValue(useGetIncidentTypesResponse);
+    useGetSeverityMock.mockReturnValue(useGetSeverityResponse);
+    useGetIssueTypesMock.mockReturnValue(useGetIssueTypesResponse);
+    useGetFieldsByIssueTypeMock.mockReturnValue(useGetFieldsByIssueTypeResponse);
+
     jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocation);
     (useGetTags as jest.Mock).mockImplementation(() => ({
       tags: sampleTags,
@@ -112,7 +171,32 @@ describe('Create case', () => {
   });
 
   describe('Step 1 - Case Fields', () => {
+    it('it renders', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <Create />
+          </Router>
+        </TestProviders>
+      );
+
+      expect(wrapper.find(`[data-test-subj="caseTitle"]`).first().exists()).toBeTruthy();
+      expect(wrapper.find(`[data-test-subj="caseDescription"]`).first().exists()).toBeTruthy();
+      expect(wrapper.find(`[data-test-subj="caseTags"]`).first().exists()).toBeTruthy();
+      expect(wrapper.find(`[data-test-subj="caseConnectors"]`).first().exists()).toBeTruthy();
+      expect(wrapper.find(`[data-test-subj="create-case-submit"]`).first().exists()).toBeTruthy();
+      expect(wrapper.find(`[data-test-subj="create-case-cancel"]`).first().exists()).toBeTruthy();
+      expect(
+        wrapper.find(`[data-test-subj="case-creation-form-steps"]`).first().exists()
+      ).toBeTruthy();
+    });
+
     it('should post case on submit click', async () => {
+      useConnectorsMock.mockReturnValue({
+        ...sampleConnectorData,
+        connectors: connectorsMock,
+      });
+
       const wrapper = mount(
         <TestProviders>
           <Router history={mockHistory}>
@@ -120,7 +204,13 @@ describe('Create case', () => {
           </Router>
         </TestProviders>
       );
-      wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+
+      await fillForm(wrapper);
+      wrapper.update();
+
+      await act(async () => {
+        wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+      });
       await waitFor(() => expect(postCase).toBeCalledWith(sampleData));
     });
 
@@ -132,15 +222,18 @@ describe('Create case', () => {
           </Router>
         </TestProviders>
       );
+
       wrapper.find(`[data-test-subj="create-case-cancel"]`).first().simulate('click');
       await waitFor(() => expect(mockHistory.push).toHaveBeenCalledWith('/'));
     });
+
     it('should redirect to new case when caseData is there', async () => {
-      const sampleId = '777777';
+      const sampleId = 'case-id';
       usePostCaseMock.mockImplementation(() => ({
         ...defaultPostCase,
         caseData: { id: sampleId },
       }));
+
       mount(
         <TestProviders>
           <Router history={mockHistory}>
@@ -148,11 +241,11 @@ describe('Create case', () => {
           </Router>
         </TestProviders>
       );
-      await waitFor(() => expect(mockHistory.push).toHaveBeenNthCalledWith(1, '/777777'));
+
+      await waitFor(() => expect(mockHistory.push).toHaveBeenNthCalledWith(1, '/case-id'));
     });
 
     it('should render spinner when loading', async () => {
-      usePostCaseMock.mockImplementation(() => ({ ...defaultPostCase, isLoading: true }));
       const wrapper = mount(
         <TestProviders>
           <Router history={mockHistory}>
@@ -160,11 +253,87 @@ describe('Create case', () => {
           </Router>
         </TestProviders>
       );
+
+      await fillForm(wrapper);
+      await act(async () => {
+        await wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+        wrapper.update();
+        expect(
+          wrapper.find(`[data-test-subj="create-case-loading-spinner"]`).exists()
+        ).toBeTruthy();
+      });
+    });
+  });
+
+  describe('Step 2 - Connector Fields', () => {
+    it(`it should submit a Jira connector`, async () => {
+      useConnectorsMock.mockReturnValue({
+        ...sampleConnectorData,
+        connectors: connectorsMock,
+      });
+
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <Create />
+          </Router>
+        </TestProviders>
+      );
+
+      await fillForm(wrapper);
+      await waitFor(() => {
+        expect(wrapper.find(`[data-test-subj="connector-settings-jira"]`).exists()).toBeFalsy();
+        wrapper.find('button[data-test-subj="dropdown-connectors"]').simulate('click');
+        wrapper.find(`button[data-test-subj="dropdown-connector-jira-1"]`).simulate('click');
+        wrapper.update();
+      });
+
+      await waitFor(() => {
+        wrapper.update();
+        expect(wrapper.find(`[data-test-subj="connector-settings-jira"]`).exists()).toBeTruthy();
+      });
+
+      act(() => {
+        wrapper
+          .find('select[data-test-subj="issueTypeSelect"]')
+          .first()
+          .simulate('change', {
+            target: { value: '10007' },
+          });
+      });
+
+      act(() => {
+        wrapper
+          .find('select[data-test-subj="prioritySelect"]')
+          .first()
+          .simulate('change', {
+            target: { value: '2' },
+          });
+      });
+
+      await act(async () => {
+        wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+      });
+
       await waitFor(() =>
-        expect(wrapper.find(`[data-test-subj="create-case-loading-spinner"]`).exists()).toBeTruthy()
+        expect(postCase).toBeCalledWith({
+          ...sampleData,
+          connector: {
+            id: 'jira-1',
+            name: 'Jira',
+            type: '.jira',
+            fields: { issueType: '10007', parent: null, priority: '2' },
+          },
+        })
       );
     });
-    it('Tag options render with new tags added', async () => {
+
+    it(`it should submit a resilient connector`, async () => {
+      useConnectorsMock.mockReturnValue({
+        ...sampleConnectorData,
+        connectors: connectorsMock,
+      });
+
       const wrapper = mount(
         <TestProviders>
           <Router history={mockHistory}>
@@ -172,63 +341,109 @@ describe('Create case', () => {
           </Router>
         </TestProviders>
       );
-      await waitFor(() =>
+
+      await fillForm(wrapper);
+      await waitFor(() => {
         expect(
-          wrapper
-            .find(`[data-test-subj="caseTags"] [data-test-subj="input"]`)
-            .first()
-            .prop('options')
-        ).toEqual([{ label: 'coke' }, { label: 'pepsi' }, { label: 'rad' }, { label: 'dude' }])
+          wrapper.find(`[data-test-subj="connector-settings-resilient"]`).exists()
+        ).toBeFalsy();
+        wrapper.find('button[data-test-subj="dropdown-connectors"]').simulate('click');
+        wrapper.find(`button[data-test-subj="dropdown-connector-resilient-2"]`).simulate('click');
+        wrapper.update();
+      });
+
+      await waitFor(() => {
+        wrapper.update();
+        expect(
+          wrapper.find(`[data-test-subj="connector-settings-resilient"]`).exists()
+        ).toBeTruthy();
+      });
+
+      act(() => {
+        ((wrapper.find(EuiComboBox).at(1).props() as unknown) as {
+          onChange: (a: EuiComboBoxOptionOption[]) => void;
+        }).onChange([{ value: '19', label: 'Denial of Service' }]);
+      });
+
+      act(() => {
+        wrapper
+          .find('select[data-test-subj="severitySelect"]')
+          .first()
+          .simulate('change', {
+            target: { value: '4' },
+          });
+      });
+
+      await act(async () => {
+        wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+      });
+
+      await waitFor(() =>
+        expect(postCase).toBeCalledWith({
+          ...sampleData,
+          connector: {
+            id: 'resilient-2',
+            name: 'My Connector 2',
+            type: '.resilient',
+            fields: { incidentTypes: ['19'], severityCode: '4' },
+          },
+        })
       );
     });
-  });
 
-  // FAILED ES PROMOTION: https://github.com/elastic/kibana/issues/84145
-  describe.skip('Step 2 - Connector Fields', () => {
-    const connectorTypes = [
-      {
-        label: 'Jira',
-        testId: 'jira-1',
-        dataTestSubj: 'connector-settings-jira',
-      },
-      {
-        label: 'Resilient',
-        testId: 'resilient-2',
-        dataTestSubj: 'connector-settings-resilient',
-      },
-      {
-        label: 'ServiceNow',
-        testId: 'servicenow-1',
-        dataTestSubj: 'connector-settings-sn',
-      },
-    ];
-    connectorTypes.forEach(({ label, testId, dataTestSubj }) => {
-      it(`should change from none to ${label} connector fields`, async () => {
-        useConnectorsMock.mockReturnValue({
-          ...sampleConnectorData,
-          connectors: connectorsMock,
-        });
+    it(`it should submit a servicenow connector`, async () => {
+      useConnectorsMock.mockReturnValue({
+        ...sampleConnectorData,
+        connectors: connectorsMock,
+      });
 
-        const wrapper = mount(
-          <TestProviders>
-            <Router history={mockHistory}>
-              <Create />
-            </Router>
-          </TestProviders>
-        );
-
-        await waitFor(() => {
-          expect(wrapper.find(`[data-test-subj="${dataTestSubj}"]`).exists()).toBeFalsy();
-          wrapper.find('button[data-test-subj="dropdown-connectors"]').simulate('click');
-          wrapper.find(`button[data-test-subj="dropdown-connector-${testId}"]`).simulate('click');
-          wrapper.update();
-        });
+      const wrapper = mount(
+        <TestProviders>
+          <Router history={mockHistory}>
+            <Create />
+          </Router>
+        </TestProviders>
+      );
+
+      await fillForm(wrapper);
+      await waitFor(() => {
+        expect(wrapper.find(`[data-test-subj="connector-settings-sn"]`).exists()).toBeFalsy();
+        wrapper.find('button[data-test-subj="dropdown-connectors"]').simulate('click');
+        wrapper.find(`button[data-test-subj="dropdown-connector-servicenow-1"]`).simulate('click');
+        wrapper.update();
+      });
+
+      await waitFor(() => {
+        wrapper.update();
+        expect(wrapper.find(`[data-test-subj="connector-settings-sn"]`).exists()).toBeTruthy();
+      });
 
-        await waitFor(() => {
-          wrapper.update();
-          expect(wrapper.find(`[data-test-subj="${dataTestSubj}"]`).exists()).toBeTruthy();
+      ['severitySelect', 'urgencySelect', 'impactSelect'].forEach((subj) => {
+        act(() => {
+          wrapper
+            .find(`select[data-test-subj="${subj}"]`)
+            .first()
+            .simulate('change', {
+              target: { value: '2' },
+            });
         });
       });
+
+      await act(async () => {
+        wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+      });
+
+      await waitFor(() =>
+        expect(postCase).toBeCalledWith({
+          ...sampleData,
+          connector: {
+            id: 'servicenow-1',
+            name: 'My Connector',
+            type: '.servicenow',
+            fields: { impact: '2', severity: '2', urgency: '2' },
+          },
+        })
+      );
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
index 42633c5d2ccf8..5c50c37723083 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
@@ -3,319 +3,81 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useCallback, useEffect, useMemo, useState } from 'react';
-import {
-  EuiButton,
-  EuiButtonEmpty,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiLoadingSpinner,
-  EuiPanel,
-  EuiSteps,
-} from '@elastic/eui';
-import styled, { css } from 'styled-components';
+
+import React, { useCallback } from 'react';
+import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiPanel } from '@elastic/eui';
+import styled from 'styled-components';
 import { useHistory } from 'react-router-dom';
-import { isEqual } from 'lodash/fp';
 
-import {
-  Field,
-  Form,
-  FormDataProvider,
-  getUseField,
-  UseField,
-  useForm,
-  useFormData,
-} from '../../../shared_imports';
-import { usePostCase } from '../../containers/use_post_case';
-import { schema, FormProps } from './schema';
-import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
-import { MarkdownEditorForm } from '../../../common/components/markdown_editor/eui_form';
-import { useGetTags } from '../../containers/use_get_tags';
+import { Field, getUseField, useFormContext } from '../../../shared_imports';
 import { getCaseDetailsUrl } from '../../../common/components/link_to';
-import { useTimelineClick } from '../../../common/utils/timeline/use_timeline_click';
-import { SettingFieldsForm } from '../settings/fields_form';
-import { useConnectors } from '../../containers/configure/use_connectors';
-import { ConnectorSelector } from '../connector_selector/form';
-import { useCaseConfigure } from '../../containers/configure/use_configure';
-import {
-  normalizeCaseConnector,
-  getConnectorById,
-  getNoneConnector,
-  normalizeActionConnector,
-} from '../configure_cases/utils';
-import { ActionConnector } from '../../containers/types';
-import { ConnectorFields } from '../../../../../case/common/api/connectors';
 import * as i18n from './translations';
+import { CreateCaseForm } from './form';
+import { FormContext } from './form_context';
+import { useInsertTimeline } from '../use_insert_timeline';
+import { fieldName as descriptionFieldName } from './description';
+import { SubmitCaseButton } from './submit_button';
 
 export const CommonUseField = getUseField({ component: Field });
 
-interface ContainerProps {
-  big?: boolean;
-}
-
-const Container = styled.div.attrs((props) => props)<ContainerProps>`
-  ${({ big, theme }) => css`
-    margin-top: ${big ? theme.eui.euiSizeXL : theme.eui.euiSize};
+const Container = styled.div`
+  ${({ theme }) => `
+    margin-top: ${theme.eui.euiSize};
   `}
 `;
 
-const MySpinner = styled(EuiLoadingSpinner)`
-  position: absolute;
-  top: 50%;
-  left: 50%;
-  z-index: 99;
-`;
-
-const initialCaseValue: FormProps = {
-  description: '',
-  tags: [],
-  title: '',
-  connectorId: 'none',
+const InsertTimeline = () => {
+  const { setFieldValue, getFormData } = useFormContext();
+  const formData = getFormData();
+  const onTimelineAttached = useCallback(
+    (newValue: string) => setFieldValue(descriptionFieldName, newValue),
+    [setFieldValue]
+  );
+  useInsertTimeline(formData[descriptionFieldName] ?? '', onTimelineAttached);
+  return null;
 };
 
 export const Create = React.memo(() => {
   const history = useHistory();
-  const { caseData, isLoading, postCase } = usePostCase();
-  const { loading: isLoadingConnectors, connectors } = useConnectors();
-  const { connector: configureConnector, loading: isLoadingCaseConfigure } = useCaseConfigure();
-  const { tags: tagOptions } = useGetTags();
-
-  const [connector, setConnector] = useState<ActionConnector | null>(null);
-  const [options, setOptions] = useState(
-    tagOptions.map((label) => ({
-      label,
-    }))
-  );
-
-  // This values uses useEffect to update, not useMemo,
-  // because we need to setState on it from the jsx
-  useEffect(
-    () =>
-      setOptions(
-        tagOptions.map((label) => ({
-          label,
-        }))
-      ),
-    [tagOptions]
-  );
-
-  const [fields, setFields] = useState<ConnectorFields>(null);
-
-  const { form } = useForm<FormProps>({
-    defaultValue: initialCaseValue,
-    options: { stripEmptyFields: false },
-    schema,
-  });
-  const currentConnectorId = useMemo(
-    () =>
-      !isLoadingCaseConfigure
-        ? normalizeCaseConnector(connectors, configureConnector)?.id ?? 'none'
-        : null,
-    [configureConnector, connectors, isLoadingCaseConfigure]
-  );
-  const { submit, setFieldValue } = form;
-  const [{ description }] = useFormData<{
-    description: string;
-  }>({
-    form,
-    watch: ['description'],
-  });
-  const onChangeConnector = useCallback(
-    (newConnectorId) => {
-      if (connector == null || connector.id !== newConnectorId) {
-        setConnector(getConnectorById(newConnectorId, connectors) ?? null);
-        // Reset setting fields when changing connector
-        setFields(null);
-      }
+  const onSuccess = useCallback(
+    ({ id }) => {
+      history.push(getCaseDetailsUrl({ id }));
     },
-    [connector, connectors]
+    [history]
   );
 
-  const onDescriptionChange = useCallback((newValue) => setFieldValue('description', newValue), [
-    setFieldValue,
-  ]);
-
-  const { handleCursorChange } = useInsertTimeline(description, onDescriptionChange);
-
-  const handleTimelineClick = useTimelineClick();
-
-  const onSubmit = useCallback(async () => {
-    const { isValid, data } = await submit();
-    if (isValid) {
-      const { connectorId: dataConnectorId, ...dataWithoutConnectorId } = data;
-      const caseConnector = getConnectorById(dataConnectorId, connectors);
-      const connectorToUpdate = caseConnector
-        ? normalizeActionConnector(caseConnector, fields)
-        : getNoneConnector();
-
-      await postCase({ ...dataWithoutConnectorId, connector: connectorToUpdate });
-    }
-  }, [submit, postCase, fields, connectors]);
-
   const handleSetIsCancel = useCallback(() => {
     history.push('/');
   }, [history]);
 
-  const firstStep = useMemo(
-    () => ({
-      title: i18n.STEP_ONE_TITLE,
-      children: (
-        <>
-          <CommonUseField
-            path="title"
-            componentProps={{
-              idAria: 'caseTitle',
-              'data-test-subj': 'caseTitle',
-              euiFieldProps: {
-                fullWidth: false,
-                disabled: isLoading,
-              },
-            }}
-          />
-          <Container>
-            <CommonUseField
-              path="tags"
-              componentProps={{
-                idAria: 'caseTags',
-                'data-test-subj': 'caseTags',
-                euiFieldProps: {
-                  fullWidth: true,
-                  placeholder: '',
-                  disabled: isLoading,
-                  options,
-                  noSuggestions: false,
-                },
-              }}
-            />
-            <FormDataProvider pathsToWatch="tags">
-              {({ tags: anotherTags }) => {
-                const current: string[] = options.map((opt) => opt.label);
-                const newOptions = anotherTags.reduce((acc: string[], item: string) => {
-                  if (!acc.includes(item)) {
-                    return [...acc, item];
-                  }
-                  return acc;
-                }, current);
-                if (!isEqual(current, newOptions)) {
-                  setOptions(
-                    newOptions.map((label: string) => ({
-                      label,
-                    }))
-                  );
-                }
-                return null;
-              }}
-            </FormDataProvider>
-          </Container>
-          <Container big>
-            <UseField
-              path={'description'}
-              component={MarkdownEditorForm}
-              componentProps={{
-                dataTestSubj: 'caseDescription',
-                idAria: 'caseDescription',
-                isDisabled: isLoading,
-                onClickTimeline: handleTimelineClick,
-                onCursorPositionUpdate: handleCursorChange,
-              }}
-            />
-          </Container>
-        </>
-      ),
-    }),
-    [isLoading, options, handleCursorChange, handleTimelineClick]
-  );
-
-  const secondStep = useMemo(
-    () => ({
-      title: i18n.STEP_TWO_TITLE,
-      children: (
-        <EuiFlexGroup>
-          <EuiFlexItem>
-            <Container>
-              <UseField
-                path="connectorId"
-                component={ConnectorSelector}
-                componentProps={{
-                  connectors,
-                  dataTestSubj: 'caseConnectors',
-                  defaultValue: currentConnectorId,
-                  disabled: isLoadingConnectors,
-                  idAria: 'caseConnectors',
-                  isLoading,
-                }}
-                onChange={onChangeConnector}
-              />
-            </Container>
-          </EuiFlexItem>
-          <EuiFlexItem>
-            <Container>
-              <SettingFieldsForm
-                connector={connector}
-                fields={fields}
-                isEdit={true}
-                onChange={setFields}
-              />
-            </Container>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      ),
-    }),
-    [
-      connector,
-      connectors,
-      currentConnectorId,
-      fields,
-      isLoading,
-      isLoadingConnectors,
-      onChangeConnector,
-    ]
-  );
-
-  const allSteps = useMemo(() => [firstStep, secondStep], [firstStep, secondStep]);
-
-  if (caseData != null && caseData.id) {
-    history.push(getCaseDetailsUrl({ id: caseData.id }));
-    return null;
-  }
-
   return (
     <EuiPanel>
-      {isLoading && <MySpinner data-test-subj="create-case-loading-spinner" size="xl" />}
-      <Form form={form}>
-        <EuiSteps headingElement="h2" steps={allSteps} />
-      </Form>
-      <Container>
-        <EuiFlexGroup
-          alignItems="center"
-          justifyContent="flexEnd"
-          gutterSize="xs"
-          responsive={false}
-        >
-          <EuiFlexItem grow={false}>
-            <EuiButtonEmpty
-              data-test-subj="create-case-cancel"
-              size="s"
-              onClick={handleSetIsCancel}
-              iconType="cross"
-            >
-              {i18n.CANCEL}
-            </EuiButtonEmpty>
-          </EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            <EuiButton
-              data-test-subj="create-case-submit"
-              fill
-              iconType="plusInCircle"
-              isDisabled={isLoading}
-              isLoading={isLoading}
-              onClick={onSubmit}
-            >
-              {i18n.CREATE_CASE}
-            </EuiButton>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </Container>
+      <FormContext onSuccess={onSuccess}>
+        <CreateCaseForm />
+        <Container>
+          <EuiFlexGroup
+            alignItems="center"
+            justifyContent="flexEnd"
+            gutterSize="xs"
+            responsive={false}
+          >
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty
+                data-test-subj="create-case-cancel"
+                size="s"
+                onClick={handleSetIsCancel}
+                iconType="cross"
+              >
+                {i18n.CANCEL}
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <SubmitCaseButton />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </Container>
+        <InsertTimeline />
+      </FormContext>
     </EuiPanel>
   );
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/optional_field_label/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/optional_field_label/index.test.tsx
new file mode 100644
index 0000000000000..3bbdb1eafd47c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/optional_field_label/index.test.tsx
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { mount } from 'enzyme';
+
+import { OptionalFieldLabel } from '.';
+
+describe('OptionalFieldLabel', () => {
+  it('it renders correctly', async () => {
+    const wrapper = mount(OptionalFieldLabel);
+    expect(wrapper.find('[data-test-subj="form-optional-field-label"]').first().text()).toBe(
+      'Optional'
+    );
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/optional_field_label/index.tsx b/x-pack/plugins/security_solution/public/cases/components/create/optional_field_label/index.tsx
index b86198e09ceac..4a491eac35d90 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/optional_field_label/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/optional_field_label/index.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import * as i18n from '../../../translations';
 
 export const OptionalFieldLabel = (
-  <EuiText color="subdued" size="xs">
+  <EuiText color="subdued" size="xs" data-test-subj="form-optional-field-label">
     {i18n.OPTIONAL}
   </EuiText>
 );
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/schema.tsx b/x-pack/plugins/security_solution/public/cases/components/create/schema.tsx
index 5abac04d6ef37..a336860121c94 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/schema.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/schema.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CasePostRequest } from '../../../../../case/common/api';
+import { CasePostRequest, ConnectorTypeFields } from '../../../../../case/common/api';
 import { FIELD_TYPES, fieldValidators, FormSchema } from '../../../shared_imports';
 import * as i18n from '../../translations';
 
@@ -18,7 +18,10 @@ export const schemaTags = {
   labelAppend: OptionalFieldLabel,
 };
 
-export type FormProps = Omit<CasePostRequest, 'connector'> & { connectorId: string };
+export type FormProps = Omit<CasePostRequest, 'connector'> & {
+  connectorId: string;
+  fields: ConnectorTypeFields['fields'];
+};
 
 export const schema: FormSchema<FormProps> = {
   title: {
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/submit_button.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/submit_button.test.tsx
new file mode 100644
index 0000000000000..c8f6ebc05582f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/submit_button.test.tsx
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { act, waitFor } from '@testing-library/react';
+
+import { useForm, Form } from '../../../shared_imports';
+import { SubmitCaseButton } from './submit_button';
+
+describe('SubmitCaseButton', () => {
+  const onSubmit = jest.fn();
+
+  const MockHookWrapperComponent: React.FC = ({ children }) => {
+    const { form } = useForm<{ title: string }>({
+      defaultValue: { title: 'My title' },
+      onSubmit,
+    });
+
+    return <Form form={form}>{children}</Form>;
+  };
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
+  it('it renders', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <SubmitCaseButton />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find(`[data-test-subj="create-case-submit"]`).exists()).toBeTruthy();
+  });
+
+  it('it submits', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <SubmitCaseButton />
+      </MockHookWrapperComponent>
+    );
+
+    await act(async () => {
+      wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+    });
+
+    await waitFor(() => expect(onSubmit).toBeCalled());
+  });
+
+  it('it disables when submitting', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <SubmitCaseButton />
+      </MockHookWrapperComponent>
+    );
+
+    await waitFor(() => {
+      wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+      expect(
+        wrapper.find(`[data-test-subj="create-case-submit"]`).first().prop('isDisabled')
+      ).toBeTruthy();
+    });
+  });
+
+  it('it is loading when submitting', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <SubmitCaseButton />
+      </MockHookWrapperComponent>
+    );
+
+    await waitFor(() => {
+      wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
+      expect(
+        wrapper.find(`[data-test-subj="create-case-submit"]`).first().prop('isLoading')
+      ).toBeTruthy();
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/submit_button.tsx b/x-pack/plugins/security_solution/public/cases/components/create/submit_button.tsx
new file mode 100644
index 0000000000000..8cffce290ff11
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/submit_button.tsx
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { EuiButton } from '@elastic/eui';
+
+import { useFormContext } from '../../../shared_imports';
+import * as i18n from './translations';
+
+const SubmitCaseButtonComponent: React.FC = () => {
+  const { submit, isSubmitting } = useFormContext();
+
+  return (
+    <EuiButton
+      data-test-subj="create-case-submit"
+      fill
+      iconType="plusInCircle"
+      isDisabled={isSubmitting}
+      isLoading={isSubmitting}
+      onClick={submit}
+    >
+      {i18n.CREATE_CASE}
+    </EuiButton>
+  );
+};
+
+export const SubmitCaseButton = memo(SubmitCaseButtonComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/tags.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/tags.test.tsx
new file mode 100644
index 0000000000000..c06ac011a035b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/tags.test.tsx
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
+import { waitFor } from '@testing-library/react';
+
+import { useForm, Form, FormHook, FIELD_TYPES } from '../../../shared_imports';
+import { useGetTags } from '../../containers/use_get_tags';
+import { Tags } from './tags';
+
+jest.mock('../../containers/use_get_tags');
+const useGetTagsMock = useGetTags as jest.Mock;
+
+describe('Tags', () => {
+  let globalForm: FormHook;
+
+  const MockHookWrapperComponent: React.FC = ({ children }) => {
+    const { form } = useForm<{ tags: string[] }>({
+      defaultValue: { tags: [] },
+      schema: {
+        tags: { type: FIELD_TYPES.COMBO_BOX },
+      },
+    });
+
+    globalForm = form;
+
+    return <Form form={form}>{children}</Form>;
+  };
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    useGetTagsMock.mockReturnValue({ tags: ['test'] });
+  });
+
+  it('it renders', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Tags isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    await waitFor(() => {
+      expect(wrapper.find(`[data-test-subj="caseTags"]`).exists()).toBeTruthy();
+    });
+  });
+
+  it('it disables the input when loading', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Tags isLoading={true} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find(EuiComboBox).prop('disabled')).toBeTruthy();
+  });
+
+  it('it changes the tags', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Tags isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    await waitFor(() => {
+      ((wrapper.find(EuiComboBox).props() as unknown) as {
+        onChange: (a: EuiComboBoxOptionOption[]) => void;
+      }).onChange(['test', 'case'].map((tag) => ({ label: tag })));
+    });
+
+    expect(globalForm.getFormData()).toEqual({ tags: ['test', 'case'] });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/tags.tsx b/x-pack/plugins/security_solution/public/cases/components/create/tags.tsx
new file mode 100644
index 0000000000000..8a7b4a6e5f760
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/tags.tsx
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useMemo } from 'react';
+
+import { Field, getUseField } from '../../../shared_imports';
+import { useGetTags } from '../../containers/use_get_tags';
+
+const CommonUseField = getUseField({ component: Field });
+
+interface Props {
+  isLoading: boolean;
+}
+
+const TagsComponent: React.FC<Props> = ({ isLoading }) => {
+  const { tags: tagOptions, isLoading: isLoadingTags } = useGetTags();
+  const options = useMemo(
+    () =>
+      tagOptions.map((label) => ({
+        label,
+      })),
+    [tagOptions]
+  );
+
+  return (
+    <CommonUseField
+      path="tags"
+      componentProps={{
+        idAria: 'caseTags',
+        'data-test-subj': 'caseTags',
+        euiFieldProps: {
+          fullWidth: true,
+          placeholder: '',
+          disabled: isLoading || isLoadingTags,
+          options,
+          noSuggestions: false,
+        },
+      }}
+    />
+  );
+};
+
+TagsComponent.displayName = 'TagsComponent';
+
+export const Tags = memo(TagsComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/title.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/title.test.tsx
new file mode 100644
index 0000000000000..54a4e665a56e5
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/title.test.tsx
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { act } from '@testing-library/react';
+
+import { useForm, Form, FormHook } from '../../../shared_imports';
+import { Title } from './title';
+
+describe('Title', () => {
+  let globalForm: FormHook;
+
+  const MockHookWrapperComponent: React.FC = ({ children }) => {
+    const { form } = useForm<{ title: string }>({
+      defaultValue: { title: 'My title' },
+    });
+
+    globalForm = form;
+
+    return <Form form={form}>{children}</Form>;
+  };
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
+  it('it renders', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Title isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find(`[data-test-subj="caseTitle"]`).exists()).toBeTruthy();
+  });
+
+  it('it disables the input when loading', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Title isLoading={true} />
+      </MockHookWrapperComponent>
+    );
+
+    expect(wrapper.find(`[data-test-subj="caseTitle"] input`).prop('disabled')).toBeTruthy();
+  });
+
+  it('it changes the title', async () => {
+    const wrapper = mount(
+      <MockHookWrapperComponent>
+        <Title isLoading={false} />
+      </MockHookWrapperComponent>
+    );
+
+    await act(async () => {
+      wrapper
+        .find(`[data-test-subj="caseTitle"] input`)
+        .first()
+        .simulate('change', { target: { value: 'My new title' } });
+    });
+
+    expect(globalForm.getFormData()).toEqual({ title: 'My new title' });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/title.tsx b/x-pack/plugins/security_solution/public/cases/components/create/title.tsx
new file mode 100644
index 0000000000000..2daeb9b738e23
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/create/title.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { Field, getUseField } from '../../../shared_imports';
+
+const CommonUseField = getUseField({ component: Field });
+
+interface Props {
+  isLoading: boolean;
+}
+
+const TitleComponent: React.FC<Props> = ({ isLoading }) => (
+  <CommonUseField
+    path="title"
+    componentProps={{
+      idAria: 'caseTitle',
+      'data-test-subj': 'caseTitle',
+      euiFieldProps: {
+        fullWidth: true,
+        disabled: isLoading,
+      },
+    }}
+  />
+);
+
+TitleComponent.displayName = 'TitleComponent';
+
+export const Title = memo(TitleComponent);
diff --git a/x-pack/plugins/security_solution/public/cases/components/settings/card.tsx b/x-pack/plugins/security_solution/public/cases/components/settings/card.tsx
index 344ca88f5ab37..f5be9740bc4f1 100644
--- a/x-pack/plugins/security_solution/public/cases/components/settings/card.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/settings/card.tsx
@@ -8,7 +8,7 @@ import React, { memo, useMemo } from 'react';
 import { EuiCard, EuiIcon, EuiLoadingSpinner } from '@elastic/eui';
 import styled from 'styled-components';
 
-import { connectorsConfiguration } from '../../../common/lib/connectors/config';
+import { connectorsConfiguration } from '../connectors';
 import { ConnectorTypes } from '../../../../../case/common/api/connectors';
 
 interface ConnectorCardProps {
diff --git a/x-pack/plugins/security_solution/public/cases/components/settings/fields_form.tsx b/x-pack/plugins/security_solution/public/cases/components/settings/fields_form.tsx
index 87536b62747e8..79ae87355b5fb 100644
--- a/x-pack/plugins/security_solution/public/cases/components/settings/fields_form.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/settings/fields_form.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { memo, Suspense, useCallback } from 'react';
+import React, { memo, Suspense } from 'react';
 import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
 
 import { CaseSettingsConnector, SettingFieldsProps } from './types';
@@ -18,13 +18,6 @@ interface Props extends Omit<SettingFieldsProps<ConnectorTypeFields['fields']>,
 const SettingFieldsFormComponent: React.FC<Props> = ({ connector, isEdit, onChange, fields }) => {
   const { caseSettingsRegistry } = getCaseSettings();
 
-  const onFieldsChange = useCallback(
-    (newFields) => {
-      onChange(newFields);
-    },
-    [onChange]
-  );
-
   if (connector == null || connector.actionTypeId == null || connector.actionTypeId === '.none') {
     return null;
   }
@@ -45,12 +38,14 @@ const SettingFieldsFormComponent: React.FC<Props> = ({ connector, isEdit, onChan
             </EuiFlexGroup>
           }
         >
-          <FieldsComponent
-            isEdit={isEdit}
-            fields={fields}
-            connector={connector}
-            onChange={onFieldsChange}
-          />
+          <div data-test-subj={'connector-settings'}>
+            <FieldsComponent
+              isEdit={isEdit}
+              fields={fields}
+              connector={connector}
+              onChange={onChange}
+            />
+          </div>
         </Suspense>
       ) : null}
     </>
diff --git a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
index a04450b3c4198..83afa4c4f5ed3 100644
--- a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
@@ -18,13 +18,14 @@ import {
 import styled, { css } from 'styled-components';
 import { isEqual } from 'lodash/fp';
 import * as i18n from './translations';
-import { Form, FormDataProvider, useForm } from '../../../shared_imports';
+import { Form, FormDataProvider, useForm, getUseField, Field } from '../../../shared_imports';
 import { schema } from './schema';
-import { CommonUseField } from '../create';
 import { useGetTags } from '../../containers/use_get_tags';
 
 import { Tags } from './tags';
 
+const CommonUseField = getUseField({ component: Field });
+
 interface TagListProps {
   disabled?: boolean;
   isLoading: boolean;
diff --git a/x-pack/plugins/security_solution/public/cases/components/use_all_cases_modal/all_cases_modal.tsx b/x-pack/plugins/security_solution/public/cases/components/use_all_cases_modal/all_cases_modal.tsx
index 7a12f9211e969..b5885b330a822 100644
--- a/x-pack/plugins/security_solution/public/cases/components/use_all_cases_modal/all_cases_modal.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/use_all_cases_modal/all_cases_modal.tsx
@@ -22,10 +22,7 @@ export interface AllCasesModalProps {
   onRowClick: (id?: string) => void;
 }
 
-const AllCasesModalComponent: React.FC<AllCasesModalProps> = ({
-  onCloseCaseModal,
-  onRowClick,
-}: AllCasesModalProps) => {
+const AllCasesModalComponent: React.FC<AllCasesModalProps> = ({ onCloseCaseModal, onRowClick }) => {
   const userPermissions = useGetUserSavedObjectPermissions();
   const userCanCrud = userPermissions?.crud ?? false;
   return (
diff --git a/x-pack/plugins/security_solution/public/cases/components/use_create_case_modal/create_case_modal.tsx b/x-pack/plugins/security_solution/public/cases/components/use_create_case_modal/create_case_modal.tsx
new file mode 100644
index 0000000000000..68446fc5b3171
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/use_create_case_modal/create_case_modal.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useCallback } from 'react';
+import styled from 'styled-components';
+import {
+  EuiModal,
+  EuiModalBody,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiOverlayMask,
+} from '@elastic/eui';
+
+import { FormContext } from '../create/form_context';
+import { CreateCaseForm } from '../create/form';
+import { SubmitCaseButton } from '../create/submit_button';
+import { Case } from '../../containers/types';
+import * as i18n from '../../translations';
+
+export interface CreateCaseModalProps {
+  onCloseCaseModal: () => void;
+  onCaseCreated: (theCase: Case) => void;
+}
+
+const Container = styled.div`
+  ${({ theme }) => `
+    margin-top: ${theme.eui.euiSize};
+    text-align: right;
+  `}
+`;
+
+const CreateModalComponent: React.FC<CreateCaseModalProps> = ({
+  onCloseCaseModal,
+  onCaseCreated,
+}) => {
+  const onSuccess = useCallback(
+    (theCase) => {
+      onCaseCreated(theCase);
+      onCloseCaseModal();
+    },
+    [onCaseCreated, onCloseCaseModal]
+  );
+
+  return (
+    <EuiOverlayMask data-test-subj="all-cases-modal">
+      <EuiModal onClose={onCloseCaseModal}>
+        <EuiModalHeader>
+          <EuiModalHeaderTitle>{i18n.CREATE_TITLE}</EuiModalHeaderTitle>
+        </EuiModalHeader>
+        <EuiModalBody>
+          <FormContext onSuccess={onSuccess}>
+            <CreateCaseForm withSteps={false} />
+            <Container>
+              <SubmitCaseButton />
+            </Container>
+          </FormContext>
+        </EuiModalBody>
+      </EuiModal>
+    </EuiOverlayMask>
+  );
+};
+
+export const CreateCaseModal = memo(CreateModalComponent);
+
+CreateCaseModal.displayName = 'CreateCaseModal';
diff --git a/x-pack/plugins/security_solution/public/cases/components/use_create_case_modal/index.tsx b/x-pack/plugins/security_solution/public/cases/components/use_create_case_modal/index.tsx
new file mode 100644
index 0000000000000..f07be3cc60821
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/use_create_case_modal/index.tsx
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, useCallback, useMemo } from 'react';
+import { Case } from '../../containers/types';
+import { CreateCaseModal } from './create_case_modal';
+
+interface Props {
+  onCaseCreated: (theCase: Case) => void;
+}
+export interface UseAllCasesModalReturnedValues {
+  Modal: React.FC;
+  isModalOpen: boolean;
+  closeModal: () => void;
+  openModal: () => void;
+}
+
+export const useCreateCaseModal = ({ onCaseCreated }: Props) => {
+  const [isModalOpen, setIsModalOpen] = useState<boolean>(false);
+  const closeModal = useCallback(() => setIsModalOpen(false), []);
+  const openModal = useCallback(() => setIsModalOpen(true), []);
+
+  const Modal: React.FC = useCallback(
+    () =>
+      isModalOpen ? (
+        <CreateCaseModal onCloseCaseModal={closeModal} onCaseCreated={onCaseCreated} />
+      ) : null,
+    [closeModal, isModalOpen, onCaseCreated]
+  );
+
+  const state = useMemo(
+    () => ({
+      Modal,
+      isModalOpen,
+      closeModal,
+      openModal,
+    }),
+    [isModalOpen, closeModal, openModal, Modal]
+  );
+
+  return state;
+};
diff --git a/x-pack/plugins/security_solution/public/cases/components/use_insert_timeline/index.tsx b/x-pack/plugins/security_solution/public/cases/components/use_insert_timeline/index.tsx
new file mode 100644
index 0000000000000..c44193dc363a4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/cases/components/use_insert_timeline/index.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useCallback, useEffect } from 'react';
+import { useDispatch } from 'react-redux';
+import { isEmpty } from 'lodash/fp';
+
+import { getTimelineUrl, useFormatUrl } from '../../../common/components/link_to';
+import { useShallowEqualSelector } from '../../../common/hooks/use_selector';
+import { timelineSelectors, timelineActions } from '../../../timelines/store/timeline';
+import { SecurityPageName } from '../../../app/types';
+import { setInsertTimeline } from '../../../timelines/store/timeline/actions';
+
+interface UseInsertTimelineReturn {
+  handleOnTimelineChange: (title: string, id: string | null, graphEventId?: string) => void;
+}
+
+export const useInsertTimeline = (
+  value: string,
+  onChange: (newValue: string) => void
+): UseInsertTimelineReturn => {
+  const dispatch = useDispatch();
+  const { formatUrl } = useFormatUrl(SecurityPageName.timelines);
+
+  const insertTimeline = useShallowEqualSelector(timelineSelectors.selectInsertTimeline);
+
+  const handleOnTimelineChange = useCallback(
+    (title: string, id: string | null, graphEventId?: string) => {
+      const url = formatUrl(getTimelineUrl(id ?? '', graphEventId), {
+        absolute: true,
+        skipSearch: true,
+      });
+
+      let newValue = `[${title}](${url})`;
+      // Leave a space between the previous value and the timeline url if the value is not empty.
+      if (!isEmpty(value)) {
+        newValue = `${value} ${newValue}`;
+      }
+
+      onChange(newValue);
+    },
+    [value, onChange, formatUrl]
+  );
+
+  useEffect(() => {
+    if (insertTimeline != null && value != null) {
+      dispatch(timelineActions.showTimeline({ id: insertTimeline.timelineId, show: false }));
+      handleOnTimelineChange(
+        insertTimeline.timelineTitle,
+        insertTimeline.timelineSavedObjectId,
+        insertTimeline.graphEventId
+      );
+      dispatch(setInsertTimeline(null));
+    }
+  }, [insertTimeline, dispatch, handleOnTimelineChange, value]);
+
+  return {
+    handleOnTimelineChange,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/case/translations.ts b/x-pack/plugins/security_solution/public/common/lib/connectors/case/translations.ts
deleted file mode 100644
index a39e04acc1bf3..0000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/case/translations.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const CASE_CONNECTOR_DESC = i18n.translate(
-  'xpack.securitySolution.case.components.case.selectMessageText',
-  {
-    defaultMessage: 'Create or update a case.',
-  }
-);
-
-export const CASE_CONNECTOR_TITLE = i18n.translate(
-  'xpack.securitySolution.case.components.case.actionTypeTitle',
-  {
-    defaultMessage: 'Cases',
-  }
-);
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index f97bec65d269a..b81be3249953e 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -59,7 +59,7 @@ import {
   IndexFieldsStrategyResponse,
 } from '../common/search_strategy/index_fields';
 import { SecurityAppStore } from './common/store/store';
-import { getCaseConnectorUI } from './common/lib/connectors';
+import { getCaseConnectorUI } from './cases/components/connectors';
 import { licenseService } from './common/hooks/use_license';
 import { LazyEndpointPolicyEditExtension } from './management/pages/policy/view/ingest_manager_integration/lazy_endpoint_policy_edit_extension';
 import { LazyEndpointPolicyCreateExtension } from './management/pages/policy/view/ingest_manager_integration/lazy_endpoint_policy_create_extension';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
deleted file mode 100644
index 6a65819a764eb..0000000000000
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { useCallback, useState, useEffect } from 'react';
-import { useDispatch } from 'react-redux';
-
-import { useShallowEqualSelector } from '../../../../common/hooks/use_selector';
-import { SecurityPageName } from '../../../../../common/constants';
-import { getTimelineUrl, useFormatUrl } from '../../../../common/components/link_to';
-import { CursorPosition } from '../../../../common/components/markdown_editor';
-import { timelineActions, timelineSelectors } from '../../../../timelines/store/timeline';
-import { setInsertTimeline } from '../../../store/timeline/actions';
-
-export const useInsertTimeline = (value: string, onChange: (newValue: string) => void) => {
-  const dispatch = useDispatch();
-  const { formatUrl } = useFormatUrl(SecurityPageName.timelines);
-  const [cursorPosition, setCursorPosition] = useState<CursorPosition>({
-    start: 0,
-    end: 0,
-  });
-
-  const insertTimeline = useShallowEqualSelector(timelineSelectors.selectInsertTimeline);
-
-  const handleOnTimelineChange = useCallback(
-    (title: string, id: string | null, graphEventId?: string) => {
-      const url = formatUrl(getTimelineUrl(id ?? '', graphEventId), {
-        absolute: true,
-        skipSearch: true,
-      });
-
-      const newValue: string = [
-        value.slice(0, cursorPosition.start),
-        cursorPosition.start === cursorPosition.end
-          ? `[${title}](${url})`
-          : `[${value.slice(cursorPosition.start, cursorPosition.end)}](${url})`,
-        value.slice(cursorPosition.end),
-      ].join('');
-
-      onChange(newValue);
-    },
-    [value, onChange, cursorPosition, formatUrl]
-  );
-
-  const handleCursorChange = useCallback((cp: CursorPosition) => {
-    setCursorPosition(cp);
-  }, []);
-
-  // insertTimeline selector is defined to attached a timeline to a case outside of the case page.
-  // FYI, if you are in the case page we only use handleOnTimelineChange to attach a timeline to a case.
-  useEffect(() => {
-    if (insertTimeline != null && value != null) {
-      dispatch(timelineActions.showTimeline({ id: insertTimeline.timelineId, show: false }));
-      handleOnTimelineChange(
-        insertTimeline.timelineTitle,
-        insertTimeline.timelineSavedObjectId,
-        insertTimeline.graphEventId
-      );
-      dispatch(setInsertTimeline(null));
-    }
-  }, [insertTimeline, dispatch, handleOnTimelineChange, value]);
-
-  return {
-    cursorPosition,
-    handleCursorChange,
-    handleOnTimelineChange,
-  };
-};

From 00a5b60779844880762af433f2ec83976ee572b3 Mon Sep 17 00:00:00 2001
From: Constance <constancecchen@users.noreply.github.com>
Date: Tue, 1 Dec 2020 14:59:27 -0800
Subject: [PATCH 22/28] Attempt to more granularly separate App Search vs
 Workplace Search vs shared GitHub notifications (#84713)

---
 .github/CODEOWNERS | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 516de74378cbc..0993876f98a6a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -262,8 +262,31 @@ x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json @elastic/kib
 
 # Enterprise Search
 # Shared
-/x-pack/plugins/enterprise_search/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/* @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/common/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/public/* @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/public/applications/* @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/public/applications/enterprise_search/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/public/applications/shared/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/public/applications/__mocks__/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/server/* @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/server/lib/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/server/__mocks__/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/server/collectors/enterprise_search/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/server/collectors/lib/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/server/routes/enterprise_search/ @elastic/enterprise-search-frontend
+/x-pack/plugins/enterprise_search/server/saved_objects/enterprise_search/ @elastic/enterprise-search-frontend
 /x-pack/test/functional_enterprise_search/ @elastic/enterprise-search-frontend
+# App Search
+/x-pack/plugins/enterprise_search/public/applications/app_search/ @elastic/app-search-frontend
+/x-pack/plugins/enterprise_search/server/routes/app_search/ @elastic/app-search-frontend
+/x-pack/plugins/enterprise_search/server/collectors/app_search/ @elastic/app-search-frontend
+/x-pack/plugins/enterprise_search/server/saved_objects/app_search/ @elastic/app-search-frontend
+# Workplace Search
+/x-pack/plugins/enterprise_search/public/applications/workplace_search/ @elastic/workplace-search-frontend
+/x-pack/plugins/enterprise_search/server/routes/workplace_search/ @elastic/workplace-search-frontend
+/x-pack/plugins/enterprise_search/server/collectors/workplace_search/ @elastic/workplace-search-frontend
+/x-pack/plugins/enterprise_search/server/saved_objects/workplace_search/ @elastic/workplace-search-frontend
 
 # Elasticsearch UI
 /src/plugins/dev_tools/ @elastic/es-ui

From 2c084b796facc19818eeb38301f36f79e506d299 Mon Sep 17 00:00:00 2001
From: Daniil <daniil_suleiman@epam.com>
Date: Wed, 2 Dec 2020 11:02:31 +0300
Subject: [PATCH 23/28] [Input Control] Custom renderer (#84423)

* Create custom renderer

* Reduce initial bundle size

* Fix tests

* Add unit test

* Remove injectI18n usage

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../input_control_fn.test.ts.snap             |   2 +-
 .../public/__snapshots__/to_ast.test.ts.snap  |  18 +
 .../public/components/editor/_index.scss      |   1 -
 ...ontrol_editor.scss => control_editor.scss} |   0
 .../components/editor/control_editor.tsx      |   2 +
 .../components/editor/controls_tab.test.tsx   |  18 +-
 .../public/components/editor/controls_tab.tsx |  68 +-
 .../public/components/editor/index.tsx        |  34 +
 .../components/editor/options_tab.test.tsx    |   6 +-
 .../public/components/editor/options_tab.tsx  |  18 +-
 .../input_control_vis.test.tsx.snap           | 610 +++++++++---------
 .../public/components/vis/_index.scss         |   1 -
 .../public/components/vis/_vis.scss           |   5 -
 .../components/vis/input_control_vis.scss     |  13 +
 .../components/vis/input_control_vis.tsx      |  10 +-
 .../input_control_vis/public/index.scss       |   9 -
 src/plugins/input_control_vis/public/index.ts |   2 -
 .../public/input_control_fn.ts                |  19 +-
 .../public/input_control_vis_renderer.tsx     |  51 ++
 .../public/input_control_vis_type.ts          |  14 +-
 .../input_control_vis/public/plugin.ts        |   2 +
 .../input_control_vis/public/to_ast.test.ts   |  54 ++
 .../input_control_vis/public/to_ast.ts        |  36 ++
 src/plugins/input_control_vis/public/types.ts |  27 +
 .../public/vis_controller.tsx                 |  65 +-
 .../__snapshots__/build_pipeline.test.ts.snap |   2 -
 .../public/legacy/build_pipeline.test.ts      |   9 -
 .../public/legacy/build_pipeline.ts           |   3 -
 28 files changed, 663 insertions(+), 436 deletions(-)
 create mode 100644 src/plugins/input_control_vis/public/__snapshots__/to_ast.test.ts.snap
 delete mode 100644 src/plugins/input_control_vis/public/components/editor/_index.scss
 rename src/plugins/input_control_vis/public/components/editor/{_control_editor.scss => control_editor.scss} (100%)
 create mode 100644 src/plugins/input_control_vis/public/components/editor/index.tsx
 delete mode 100644 src/plugins/input_control_vis/public/components/vis/_index.scss
 delete mode 100644 src/plugins/input_control_vis/public/components/vis/_vis.scss
 create mode 100644 src/plugins/input_control_vis/public/components/vis/input_control_vis.scss
 delete mode 100644 src/plugins/input_control_vis/public/index.scss
 create mode 100644 src/plugins/input_control_vis/public/input_control_vis_renderer.tsx
 create mode 100644 src/plugins/input_control_vis/public/to_ast.test.ts
 create mode 100644 src/plugins/input_control_vis/public/to_ast.ts
 create mode 100644 src/plugins/input_control_vis/public/types.ts

diff --git a/src/plugins/input_control_vis/public/__snapshots__/input_control_fn.test.ts.snap b/src/plugins/input_control_vis/public/__snapshots__/input_control_fn.test.ts.snap
index 35349b4719676..696b74d040e0c 100644
--- a/src/plugins/input_control_vis/public/__snapshots__/input_control_fn.test.ts.snap
+++ b/src/plugins/input_control_vis/public/__snapshots__/input_control_fn.test.ts.snap
@@ -2,7 +2,7 @@
 
 exports[`interpreter/functions#input_control_vis returns an object with the correct structure 1`] = `
 Object {
-  "as": "visualization",
+  "as": "input_control_vis",
   "type": "render",
   "value": Object {
     "visConfig": Object {
diff --git a/src/plugins/input_control_vis/public/__snapshots__/to_ast.test.ts.snap b/src/plugins/input_control_vis/public/__snapshots__/to_ast.test.ts.snap
new file mode 100644
index 0000000000000..edd44d8dd0337
--- /dev/null
+++ b/src/plugins/input_control_vis/public/__snapshots__/to_ast.test.ts.snap
@@ -0,0 +1,18 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`input_control_vis toExpressionAst should build an expression based on vis.params 1`] = `
+Object {
+  "chain": Array [
+    Object {
+      "arguments": Object {
+        "visConfig": Array [
+          "{\\"controls\\":[{\\"id\\":\\"1536977437774\\",\\"fieldName\\":\\"manufacturer.keyword\\",\\"parent\\":\\"\\",\\"label\\":\\"Manufacturer\\",\\"type\\":\\"list\\",\\"options\\":{\\"type\\":\\"terms\\",\\"multiselect\\":true,\\"dynamicOptions\\":true,\\"size\\":5,\\"order\\":\\"desc\\"},\\"indexPattern\\":\\"ff959d40-b880-11e8-a6d9-e546fe2bba5f\\"}],\\"updateFiltersOnChange\\":false,\\"useTimeFilter\\":true,\\"pinFilters\\":false}",
+        ],
+      },
+      "function": "input_control_vis",
+      "type": "function",
+    },
+  ],
+  "type": "expression",
+}
+`;
diff --git a/src/plugins/input_control_vis/public/components/editor/_index.scss b/src/plugins/input_control_vis/public/components/editor/_index.scss
deleted file mode 100644
index 9af8f8d6e8222..0000000000000
--- a/src/plugins/input_control_vis/public/components/editor/_index.scss
+++ /dev/null
@@ -1 +0,0 @@
-@import './control_editor';
diff --git a/src/plugins/input_control_vis/public/components/editor/_control_editor.scss b/src/plugins/input_control_vis/public/components/editor/control_editor.scss
similarity index 100%
rename from src/plugins/input_control_vis/public/components/editor/_control_editor.scss
rename to src/plugins/input_control_vis/public/components/editor/control_editor.scss
diff --git a/src/plugins/input_control_vis/public/components/editor/control_editor.tsx b/src/plugins/input_control_vis/public/components/editor/control_editor.tsx
index aa473095aaf3f..109237f8db4ec 100644
--- a/src/plugins/input_control_vis/public/components/editor/control_editor.tsx
+++ b/src/plugins/input_control_vis/public/components/editor/control_editor.tsx
@@ -36,6 +36,8 @@ import { getTitle, ControlParams, CONTROL_TYPES, ControlParamsOptions } from '..
 import { IIndexPattern } from '../../../../data/public';
 import { InputControlVisDependencies } from '../../plugin';
 
+import './control_editor.scss';
+
 interface ControlEditorUiProps {
   controlIndex: number;
   controlParams: ControlParams;
diff --git a/src/plugins/input_control_vis/public/components/editor/controls_tab.test.tsx b/src/plugins/input_control_vis/public/components/editor/controls_tab.test.tsx
index a85f98c7b89ba..c05dec8fccbe1 100644
--- a/src/plugins/input_control_vis/public/components/editor/controls_tab.test.tsx
+++ b/src/plugins/input_control_vis/public/components/editor/controls_tab.test.tsx
@@ -21,16 +21,16 @@ import React from 'react';
 import { shallowWithIntl, mountWithIntl } from '@kbn/test/jest';
 import { findTestSubject } from '@elastic/eui/lib/test';
 import { getDepsMock, getIndexPatternMock } from '../../test_utils';
-import { ControlsTab, ControlsTabUiProps } from './controls_tab';
+import ControlsTab, { ControlsTabProps } from './controls_tab';
 import { Vis } from '../../../../visualizations/public';
 
 const indexPatternsMock = {
   get: getIndexPatternMock,
 };
-let props: ControlsTabUiProps;
+let props: ControlsTabProps;
 
 beforeEach(() => {
-  props = {
+  props = ({
     deps: getDepsMock(),
     vis: ({
       API: {
@@ -78,18 +78,18 @@ beforeEach(() => {
     },
     setValue: jest.fn(),
     intl: null as any,
-  };
+  } as unknown) as ControlsTabProps;
 });
 
 test('renders ControlsTab', () => {
-  const component = shallowWithIntl(<ControlsTab.WrappedComponent {...props} />);
+  const component = shallowWithIntl(<ControlsTab {...props} />);
 
   expect(component).toMatchSnapshot();
 });
 
 describe('behavior', () => {
   test('add control button', () => {
-    const component = mountWithIntl(<ControlsTab.WrappedComponent {...props} />);
+    const component = mountWithIntl(<ControlsTab {...props} />);
 
     findTestSubject(component, 'inputControlEditorAddBtn').simulate('click');
 
@@ -102,7 +102,7 @@ describe('behavior', () => {
   });
 
   test('remove control button', () => {
-    const component = mountWithIntl(<ControlsTab.WrappedComponent {...props} />);
+    const component = mountWithIntl(<ControlsTab {...props} />);
     findTestSubject(component, 'inputControlEditorRemoveControl0').simulate('click');
     const expectedParams = [
       'controls',
@@ -125,7 +125,7 @@ describe('behavior', () => {
   });
 
   test('move down control button', () => {
-    const component = mountWithIntl(<ControlsTab.WrappedComponent {...props} />);
+    const component = mountWithIntl(<ControlsTab {...props} />);
     findTestSubject(component, 'inputControlEditorMoveDownControl0').simulate('click');
     const expectedParams = [
       'controls',
@@ -162,7 +162,7 @@ describe('behavior', () => {
   });
 
   test('move up control button', () => {
-    const component = mountWithIntl(<ControlsTab.WrappedComponent {...props} />);
+    const component = mountWithIntl(<ControlsTab {...props} />);
     findTestSubject(component, 'inputControlEditorMoveUpControl1').simulate('click');
     const expectedParams = [
       'controls',
diff --git a/src/plugins/input_control_vis/public/components/editor/controls_tab.tsx b/src/plugins/input_control_vis/public/components/editor/controls_tab.tsx
index a9f04a86f8d03..0e622e08c529f 100644
--- a/src/plugins/input_control_vis/public/components/editor/controls_tab.tsx
+++ b/src/plugins/input_control_vis/public/components/editor/controls_tab.tsx
@@ -18,7 +18,8 @@
  */
 
 import React, { PureComponent } from 'react';
-import { injectI18n, FormattedMessage, InjectedIntlProps } from '@kbn/i18n/react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
 
 import {
   EuiButton,
@@ -44,22 +45,17 @@ import {
 } from '../../editor_utils';
 import { getLineageMap, getParentCandidates } from '../../lineage';
 import { InputControlVisDependencies } from '../../plugin';
+import { InputControlVisParams } from '../../types';
 
 interface ControlsTabUiState {
   type: CONTROL_TYPES;
 }
 
-interface ControlsTabUiParams {
-  controls: ControlParams[];
-}
-type ControlsTabUiInjectedProps = InjectedIntlProps &
-  Pick<VisOptionsProps<ControlsTabUiParams>, 'vis' | 'stateParams' | 'setValue'> & {
-    deps: InputControlVisDependencies;
-  };
+export type ControlsTabProps = VisOptionsProps<InputControlVisParams> & {
+  deps: InputControlVisDependencies;
+};
 
-export type ControlsTabUiProps = ControlsTabUiInjectedProps;
-
-class ControlsTabUi extends PureComponent<ControlsTabUiProps, ControlsTabUiState> {
+class ControlsTab extends PureComponent<ControlsTabProps, ControlsTabUiState> {
   state = {
     type: CONTROL_TYPES.LIST,
   };
@@ -161,8 +157,6 @@ class ControlsTabUi extends PureComponent<ControlsTabUiProps, ControlsTabUiState
   }
 
   render() {
-    const { intl } = this.props;
-
     return (
       <div>
         {this.renderControls()}
@@ -176,25 +170,31 @@ class ControlsTabUi extends PureComponent<ControlsTabUiProps, ControlsTabUiState
                   options={[
                     {
                       value: CONTROL_TYPES.RANGE,
-                      text: intl.formatMessage({
-                        id: 'inputControl.editor.controlsTab.select.rangeDropDownOptionLabel',
-                        defaultMessage: 'Range slider',
-                      }),
+                      text: i18n.translate(
+                        'inputControl.editor.controlsTab.select.rangeDropDownOptionLabel',
+                        {
+                          defaultMessage: 'Range slider',
+                        }
+                      ),
                     },
                     {
                       value: CONTROL_TYPES.LIST,
-                      text: intl.formatMessage({
-                        id: 'inputControl.editor.controlsTab.select.listDropDownOptionLabel',
-                        defaultMessage: 'Options list',
-                      }),
+                      text: i18n.translate(
+                        'inputControl.editor.controlsTab.select.listDropDownOptionLabel',
+                        {
+                          defaultMessage: 'Options list',
+                        }
+                      ),
                     },
                   ]}
                   value={this.state.type}
                   onChange={(event) => this.setState({ type: event.target.value as CONTROL_TYPES })}
-                  aria-label={intl.formatMessage({
-                    id: 'inputControl.editor.controlsTab.select.controlTypeAriaLabel',
-                    defaultMessage: 'Select control type',
-                  })}
+                  aria-label={i18n.translate(
+                    'inputControl.editor.controlsTab.select.controlTypeAriaLabel',
+                    {
+                      defaultMessage: 'Select control type',
+                    }
+                  )}
                 />
               </EuiFormRow>
             </EuiFlexItem>
@@ -205,10 +205,12 @@ class ControlsTabUi extends PureComponent<ControlsTabUiProps, ControlsTabUiState
                   onClick={this.handleAddControl}
                   iconType="plusInCircle"
                   data-test-subj="inputControlEditorAddBtn"
-                  aria-label={intl.formatMessage({
-                    id: 'inputControl.editor.controlsTab.select.addControlAriaLabel',
-                    defaultMessage: 'Add control',
-                  })}
+                  aria-label={i18n.translate(
+                    'inputControl.editor.controlsTab.select.addControlAriaLabel',
+                    {
+                      defaultMessage: 'Add control',
+                    }
+                  )}
                 >
                   <FormattedMessage
                     id="inputControl.editor.controlsTab.addButtonLabel"
@@ -224,8 +226,6 @@ class ControlsTabUi extends PureComponent<ControlsTabUiProps, ControlsTabUiState
   }
 }
 
-export const ControlsTab = injectI18n(ControlsTabUi);
-
-export const getControlsTab = (deps: InputControlVisDependencies) => (
-  props: Omit<ControlsTabUiProps, 'core'>
-) => <ControlsTab {...props} deps={deps} />;
+// default export required for React.Lazy
+// eslint-disable-next-line import/no-default-export
+export { ControlsTab as default };
diff --git a/src/plugins/input_control_vis/public/components/editor/index.tsx b/src/plugins/input_control_vis/public/components/editor/index.tsx
new file mode 100644
index 0000000000000..11b3c2ea4ee8a
--- /dev/null
+++ b/src/plugins/input_control_vis/public/components/editor/index.tsx
@@ -0,0 +1,34 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React, { lazy } from 'react';
+import { VisOptionsProps } from 'src/plugins/vis_default_editor/public';
+import { InputControlVisDependencies } from '../../plugin';
+import { InputControlVisParams } from '../../types';
+
+const ControlsTab = lazy(() => import('./controls_tab'));
+const OptionsTab = lazy(() => import('./options_tab'));
+
+export const getControlsTab = (deps: InputControlVisDependencies) => (
+  props: VisOptionsProps<InputControlVisParams>
+) => <ControlsTab {...props} deps={deps} />;
+
+export const OptionsTabLazy = (props: VisOptionsProps<InputControlVisParams>) => (
+  <OptionsTab {...props} />
+);
diff --git a/src/plugins/input_control_vis/public/components/editor/options_tab.test.tsx b/src/plugins/input_control_vis/public/components/editor/options_tab.test.tsx
index 0f126e915a68c..0970d1cd3c298 100644
--- a/src/plugins/input_control_vis/public/components/editor/options_tab.test.tsx
+++ b/src/plugins/input_control_vis/public/components/editor/options_tab.test.tsx
@@ -22,13 +22,13 @@ import { shallow } from 'enzyme';
 import { mountWithIntl } from '@kbn/test/jest';
 
 import { Vis } from '../../../../visualizations/public';
-import { OptionsTab, OptionsTabProps } from './options_tab';
+import OptionsTab, { OptionsTabProps } from './options_tab';
 
 describe('OptionsTab', () => {
   let props: OptionsTabProps;
 
   beforeEach(() => {
-    props = {
+    props = ({
       vis: {} as Vis,
       stateParams: {
         updateFiltersOnChange: false,
@@ -36,7 +36,7 @@ describe('OptionsTab', () => {
         pinFilters: false,
       },
       setValue: jest.fn(),
-    };
+    } as unknown) as OptionsTabProps;
   });
 
   it('should renders OptionsTab', () => {
diff --git a/src/plugins/input_control_vis/public/components/editor/options_tab.tsx b/src/plugins/input_control_vis/public/components/editor/options_tab.tsx
index cdff6cabad8ba..306d1141e75bd 100644
--- a/src/plugins/input_control_vis/public/components/editor/options_tab.tsx
+++ b/src/plugins/input_control_vis/public/components/editor/options_tab.tsx
@@ -24,20 +24,11 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiSwitchEvent } from '@elastic/eui';
 
 import { VisOptionsProps } from 'src/plugins/vis_default_editor/public';
+import { InputControlVisParams } from '../../types';
 
-interface OptionsTabParams {
-  updateFiltersOnChange: boolean;
-  useTimeFilter: boolean;
-  pinFilters: boolean;
-}
-type OptionsTabInjectedProps = Pick<
-  VisOptionsProps<OptionsTabParams>,
-  'vis' | 'setValue' | 'stateParams'
->;
-
-export type OptionsTabProps = OptionsTabInjectedProps;
+export type OptionsTabProps = VisOptionsProps<InputControlVisParams>;
 
-export class OptionsTab extends PureComponent<OptionsTabProps> {
+class OptionsTab extends PureComponent<OptionsTabProps> {
   handleUpdateFiltersChange = (event: EuiSwitchEvent) => {
     this.props.setValue('updateFiltersOnChange', event.target.checked);
   };
@@ -98,3 +89,6 @@ export class OptionsTab extends PureComponent<OptionsTabProps> {
     );
   }
 }
+// default export required for React.Lazy
+// eslint-disable-next-line import/no-default-export
+export { OptionsTab as default };
diff --git a/src/plugins/input_control_vis/public/components/vis/__snapshots__/input_control_vis.test.tsx.snap b/src/plugins/input_control_vis/public/components/vis/__snapshots__/input_control_vis.test.tsx.snap
index 5a76967c71fbb..5e1f25993616b 100644
--- a/src/plugins/input_control_vis/public/components/vis/__snapshots__/input_control_vis.test.tsx.snap
+++ b/src/plugins/input_control_vis/public/components/vis/__snapshots__/input_control_vis.test.tsx.snap
@@ -2,355 +2,371 @@
 
 exports[`Apply and Cancel change btns enabled when there are changes 1`] = `
 <div
-  className="icvContainer"
+  className="icvContainer__wrapper"
 >
-  <EuiFlexGroup
-    wrap={true}
+  <div
+    className="icvContainer"
   >
-    <EuiFlexItem
-      data-test-subj="inputControlItem"
-      key="mock-list-control"
-      style={
-        Object {
-          "minWidth": "250px",
-        }
-      }
+    <EuiFlexGroup
+      wrap={true}
     >
-      <InjectIntl(ListControlUi)
-        controlIndex={0}
-        fetchOptions={[Function]}
-        formatOptionLabel={[Function]}
-        id="mock-list-control"
-        label="list control"
-        multiselect={true}
-        options={
-          Array [
-            "choice1",
-            "choice2",
-          ]
+      <EuiFlexItem
+        data-test-subj="inputControlItem"
+        key="mock-list-control"
+        style={
+          Object {
+            "minWidth": "250px",
+          }
         }
-        selectedOptions={Array []}
-        stageFilter={[Function]}
-      />
-    </EuiFlexItem>
-  </EuiFlexGroup>
-  <EuiFlexGroup
-    wrap={true}
-  >
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiButton
-        data-test-subj="inputControlSubmitBtn"
-        disabled={false}
-        fill={true}
-        onClick={[Function]}
       >
-        <FormattedMessage
-          defaultMessage="Apply changes"
-          id="inputControl.vis.inputControlVis.applyChangesButtonLabel"
-          values={Object {}}
+        <InjectIntl(ListControlUi)
+          controlIndex={0}
+          fetchOptions={[Function]}
+          formatOptionLabel={[Function]}
+          id="mock-list-control"
+          label="list control"
+          multiselect={true}
+          options={
+            Array [
+              "choice1",
+              "choice2",
+            ]
+          }
+          selectedOptions={Array []}
+          stageFilter={[Function]}
         />
-      </EuiButton>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
+      </EuiFlexItem>
+    </EuiFlexGroup>
+    <EuiFlexGroup
+      wrap={true}
     >
-      <EuiButtonEmpty
-        data-test-subj="inputControlCancelBtn"
-        disabled={false}
-        onClick={[Function]}
+      <EuiFlexItem
+        grow={false}
       >
-        <FormattedMessage
-          defaultMessage="Cancel changes"
-          id="inputControl.vis.inputControlVis.cancelChangesButtonLabel"
-          values={Object {}}
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiButtonEmpty
-        data-test-subj="inputControlClearBtn"
-        disabled={true}
-        onClick={[Function]}
+        <EuiButton
+          data-test-subj="inputControlSubmitBtn"
+          disabled={false}
+          fill={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Apply changes"
+            id="inputControl.vis.inputControlVis.applyChangesButtonLabel"
+            values={Object {}}
+          />
+        </EuiButton>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
       >
-        <FormattedMessage
-          defaultMessage="Clear form"
-          id="inputControl.vis.inputControlVis.clearFormButtonLabel"
-          values={Object {}}
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-  </EuiFlexGroup>
+        <EuiButtonEmpty
+          data-test-subj="inputControlCancelBtn"
+          disabled={false}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Cancel changes"
+            id="inputControl.vis.inputControlVis.cancelChangesButtonLabel"
+            values={Object {}}
+          />
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
+      >
+        <EuiButtonEmpty
+          data-test-subj="inputControlClearBtn"
+          disabled={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Clear form"
+            id="inputControl.vis.inputControlVis.clearFormButtonLabel"
+            values={Object {}}
+          />
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  </div>
 </div>
 `;
 
 exports[`Clear btns enabled when there are values 1`] = `
 <div
-  className="icvContainer"
+  className="icvContainer__wrapper"
 >
-  <EuiFlexGroup
-    wrap={true}
+  <div
+    className="icvContainer"
   >
-    <EuiFlexItem
-      data-test-subj="inputControlItem"
-      key="mock-list-control"
-      style={
-        Object {
-          "minWidth": "250px",
-        }
-      }
+    <EuiFlexGroup
+      wrap={true}
     >
-      <InjectIntl(ListControlUi)
-        controlIndex={0}
-        fetchOptions={[Function]}
-        formatOptionLabel={[Function]}
-        id="mock-list-control"
-        label="list control"
-        multiselect={true}
-        options={
-          Array [
-            "choice1",
-            "choice2",
-          ]
+      <EuiFlexItem
+        data-test-subj="inputControlItem"
+        key="mock-list-control"
+        style={
+          Object {
+            "minWidth": "250px",
+          }
         }
-        selectedOptions={Array []}
-        stageFilter={[Function]}
-      />
-    </EuiFlexItem>
-  </EuiFlexGroup>
-  <EuiFlexGroup
-    wrap={true}
-  >
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiButton
-        data-test-subj="inputControlSubmitBtn"
-        disabled={true}
-        fill={true}
-        onClick={[Function]}
       >
-        <FormattedMessage
-          defaultMessage="Apply changes"
-          id="inputControl.vis.inputControlVis.applyChangesButtonLabel"
-          values={Object {}}
+        <InjectIntl(ListControlUi)
+          controlIndex={0}
+          fetchOptions={[Function]}
+          formatOptionLabel={[Function]}
+          id="mock-list-control"
+          label="list control"
+          multiselect={true}
+          options={
+            Array [
+              "choice1",
+              "choice2",
+            ]
+          }
+          selectedOptions={Array []}
+          stageFilter={[Function]}
         />
-      </EuiButton>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
+      </EuiFlexItem>
+    </EuiFlexGroup>
+    <EuiFlexGroup
+      wrap={true}
     >
-      <EuiButtonEmpty
-        data-test-subj="inputControlCancelBtn"
-        disabled={true}
-        onClick={[Function]}
+      <EuiFlexItem
+        grow={false}
       >
-        <FormattedMessage
-          defaultMessage="Cancel changes"
-          id="inputControl.vis.inputControlVis.cancelChangesButtonLabel"
-          values={Object {}}
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiButtonEmpty
-        data-test-subj="inputControlClearBtn"
-        disabled={false}
-        onClick={[Function]}
+        <EuiButton
+          data-test-subj="inputControlSubmitBtn"
+          disabled={true}
+          fill={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Apply changes"
+            id="inputControl.vis.inputControlVis.applyChangesButtonLabel"
+            values={Object {}}
+          />
+        </EuiButton>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
       >
-        <FormattedMessage
-          defaultMessage="Clear form"
-          id="inputControl.vis.inputControlVis.clearFormButtonLabel"
-          values={Object {}}
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-  </EuiFlexGroup>
+        <EuiButtonEmpty
+          data-test-subj="inputControlCancelBtn"
+          disabled={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Cancel changes"
+            id="inputControl.vis.inputControlVis.cancelChangesButtonLabel"
+            values={Object {}}
+          />
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
+      >
+        <EuiButtonEmpty
+          data-test-subj="inputControlClearBtn"
+          disabled={false}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Clear form"
+            id="inputControl.vis.inputControlVis.clearFormButtonLabel"
+            values={Object {}}
+          />
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  </div>
 </div>
 `;
 
 exports[`Renders list control 1`] = `
 <div
-  className="icvContainer"
+  className="icvContainer__wrapper"
 >
-  <EuiFlexGroup
-    wrap={true}
+  <div
+    className="icvContainer"
   >
-    <EuiFlexItem
-      data-test-subj="inputControlItem"
-      key="mock-list-control"
-      style={
-        Object {
-          "minWidth": "250px",
-        }
-      }
+    <EuiFlexGroup
+      wrap={true}
     >
-      <InjectIntl(ListControlUi)
-        controlIndex={0}
-        fetchOptions={[Function]}
-        formatOptionLabel={[Function]}
-        id="mock-list-control"
-        label="list control"
-        multiselect={true}
-        options={
-          Array [
-            "choice1",
-            "choice2",
-          ]
+      <EuiFlexItem
+        data-test-subj="inputControlItem"
+        key="mock-list-control"
+        style={
+          Object {
+            "minWidth": "250px",
+          }
         }
-        selectedOptions={Array []}
-        stageFilter={[Function]}
-      />
-    </EuiFlexItem>
-  </EuiFlexGroup>
-  <EuiFlexGroup
-    wrap={true}
-  >
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiButton
-        data-test-subj="inputControlSubmitBtn"
-        disabled={true}
-        fill={true}
-        onClick={[Function]}
       >
-        <FormattedMessage
-          defaultMessage="Apply changes"
-          id="inputControl.vis.inputControlVis.applyChangesButtonLabel"
-          values={Object {}}
+        <InjectIntl(ListControlUi)
+          controlIndex={0}
+          fetchOptions={[Function]}
+          formatOptionLabel={[Function]}
+          id="mock-list-control"
+          label="list control"
+          multiselect={true}
+          options={
+            Array [
+              "choice1",
+              "choice2",
+            ]
+          }
+          selectedOptions={Array []}
+          stageFilter={[Function]}
         />
-      </EuiButton>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
+      </EuiFlexItem>
+    </EuiFlexGroup>
+    <EuiFlexGroup
+      wrap={true}
     >
-      <EuiButtonEmpty
-        data-test-subj="inputControlCancelBtn"
-        disabled={true}
-        onClick={[Function]}
+      <EuiFlexItem
+        grow={false}
       >
-        <FormattedMessage
-          defaultMessage="Cancel changes"
-          id="inputControl.vis.inputControlVis.cancelChangesButtonLabel"
-          values={Object {}}
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiButtonEmpty
-        data-test-subj="inputControlClearBtn"
-        disabled={true}
-        onClick={[Function]}
+        <EuiButton
+          data-test-subj="inputControlSubmitBtn"
+          disabled={true}
+          fill={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Apply changes"
+            id="inputControl.vis.inputControlVis.applyChangesButtonLabel"
+            values={Object {}}
+          />
+        </EuiButton>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
       >
-        <FormattedMessage
-          defaultMessage="Clear form"
-          id="inputControl.vis.inputControlVis.clearFormButtonLabel"
-          values={Object {}}
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-  </EuiFlexGroup>
+        <EuiButtonEmpty
+          data-test-subj="inputControlCancelBtn"
+          disabled={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Cancel changes"
+            id="inputControl.vis.inputControlVis.cancelChangesButtonLabel"
+            values={Object {}}
+          />
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
+      >
+        <EuiButtonEmpty
+          data-test-subj="inputControlClearBtn"
+          disabled={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Clear form"
+            id="inputControl.vis.inputControlVis.clearFormButtonLabel"
+            values={Object {}}
+          />
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  </div>
 </div>
 `;
 
 exports[`Renders range control 1`] = `
 <div
-  className="icvContainer"
+  className="icvContainer__wrapper"
 >
-  <EuiFlexGroup
-    wrap={true}
+  <div
+    className="icvContainer"
   >
-    <EuiFlexItem
-      data-test-subj="inputControlItem"
-      key="mock-range-control"
-      style={
-        Object {
-          "minWidth": "250px",
-        }
-      }
+    <EuiFlexGroup
+      wrap={true}
     >
-      <RangeControl
-        control={
+      <EuiFlexItem
+        data-test-subj="inputControlItem"
+        key="mock-range-control"
+        style={
           Object {
-            "format": [Function],
-            "id": "mock-range-control",
-            "isEnabled": [Function],
-            "label": "range control",
-            "max": 100,
-            "min": 0,
-            "options": Object {
-              "decimalPlaces": 0,
-              "step": 1,
-            },
-            "type": "range",
-            "value": Object {
-              "max": 0,
-              "min": 0,
-            },
+            "minWidth": "250px",
           }
         }
-        controlIndex={0}
-        stageFilter={[Function]}
-      />
-    </EuiFlexItem>
-  </EuiFlexGroup>
-  <EuiFlexGroup
-    wrap={true}
-  >
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiButton
-        data-test-subj="inputControlSubmitBtn"
-        disabled={true}
-        fill={true}
-        onClick={[Function]}
       >
-        <FormattedMessage
-          defaultMessage="Apply changes"
-          id="inputControl.vis.inputControlVis.applyChangesButtonLabel"
-          values={Object {}}
+        <RangeControl
+          control={
+            Object {
+              "format": [Function],
+              "id": "mock-range-control",
+              "isEnabled": [Function],
+              "label": "range control",
+              "max": 100,
+              "min": 0,
+              "options": Object {
+                "decimalPlaces": 0,
+                "step": 1,
+              },
+              "type": "range",
+              "value": Object {
+                "max": 0,
+                "min": 0,
+              },
+            }
+          }
+          controlIndex={0}
+          stageFilter={[Function]}
         />
-      </EuiButton>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
+      </EuiFlexItem>
+    </EuiFlexGroup>
+    <EuiFlexGroup
+      wrap={true}
     >
-      <EuiButtonEmpty
-        data-test-subj="inputControlCancelBtn"
-        disabled={true}
-        onClick={[Function]}
+      <EuiFlexItem
+        grow={false}
       >
-        <FormattedMessage
-          defaultMessage="Cancel changes"
-          id="inputControl.vis.inputControlVis.cancelChangesButtonLabel"
-          values={Object {}}
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiButtonEmpty
-        data-test-subj="inputControlClearBtn"
-        disabled={true}
-        onClick={[Function]}
+        <EuiButton
+          data-test-subj="inputControlSubmitBtn"
+          disabled={true}
+          fill={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Apply changes"
+            id="inputControl.vis.inputControlVis.applyChangesButtonLabel"
+            values={Object {}}
+          />
+        </EuiButton>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
       >
-        <FormattedMessage
-          defaultMessage="Clear form"
-          id="inputControl.vis.inputControlVis.clearFormButtonLabel"
-          values={Object {}}
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-  </EuiFlexGroup>
+        <EuiButtonEmpty
+          data-test-subj="inputControlCancelBtn"
+          disabled={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Cancel changes"
+            id="inputControl.vis.inputControlVis.cancelChangesButtonLabel"
+            values={Object {}}
+          />
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+      <EuiFlexItem
+        grow={false}
+      >
+        <EuiButtonEmpty
+          data-test-subj="inputControlClearBtn"
+          disabled={true}
+          onClick={[Function]}
+        >
+          <FormattedMessage
+            defaultMessage="Clear form"
+            id="inputControl.vis.inputControlVis.clearFormButtonLabel"
+            values={Object {}}
+          />
+        </EuiButtonEmpty>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  </div>
 </div>
 `;
diff --git a/src/plugins/input_control_vis/public/components/vis/_index.scss b/src/plugins/input_control_vis/public/components/vis/_index.scss
deleted file mode 100644
index a428a7c1782e3..0000000000000
--- a/src/plugins/input_control_vis/public/components/vis/_index.scss
+++ /dev/null
@@ -1 +0,0 @@
-@import './vis';
diff --git a/src/plugins/input_control_vis/public/components/vis/_vis.scss b/src/plugins/input_control_vis/public/components/vis/_vis.scss
deleted file mode 100644
index d42c2c5f263c7..0000000000000
--- a/src/plugins/input_control_vis/public/components/vis/_vis.scss
+++ /dev/null
@@ -1,5 +0,0 @@
-.icvContainer {
-  width: 100%;
-  margin: 0 $euiSizeXS;
-  padding: $euiSizeS;
-}
diff --git a/src/plugins/input_control_vis/public/components/vis/input_control_vis.scss b/src/plugins/input_control_vis/public/components/vis/input_control_vis.scss
new file mode 100644
index 0000000000000..322573446f762
--- /dev/null
+++ b/src/plugins/input_control_vis/public/components/vis/input_control_vis.scss
@@ -0,0 +1,13 @@
+.icvContainer__wrapper {
+  @include euiScrollBar;
+  min-height: 0;
+  flex: 1 1 0;
+  display: flex;
+  overflow: auto;
+}
+
+.icvContainer {
+  width: 100%;
+  margin: 0 $euiSizeXS;
+  padding: $euiSizeS;
+}
diff --git a/src/plugins/input_control_vis/public/components/vis/input_control_vis.tsx b/src/plugins/input_control_vis/public/components/vis/input_control_vis.tsx
index 95edb4a35bc22..058f39cb8a6d4 100644
--- a/src/plugins/input_control_vis/public/components/vis/input_control_vis.tsx
+++ b/src/plugins/input_control_vis/public/components/vis/input_control_vis.tsx
@@ -26,6 +26,8 @@ import { RangeControl } from '../../control/range_control_factory';
 import { ListControl as ListControlComponent } from './list_control';
 import { RangeControl as RangeControlComponent } from './range_control';
 
+import './input_control_vis.scss';
+
 function isListControl(control: RangeControl | ListControl): control is ListControl {
   return control.type === CONTROL_TYPES.LIST;
 }
@@ -165,9 +167,11 @@ export class InputControlVis extends Component<InputControlVisProps> {
     }
 
     return (
-      <div className="icvContainer">
-        <EuiFlexGroup wrap>{this.renderControls()}</EuiFlexGroup>
-        {stagingButtons}
+      <div className="icvContainer__wrapper">
+        <div className="icvContainer">
+          <EuiFlexGroup wrap>{this.renderControls()}</EuiFlexGroup>
+          {stagingButtons}
+        </div>
       </div>
     );
   }
diff --git a/src/plugins/input_control_vis/public/index.scss b/src/plugins/input_control_vis/public/index.scss
deleted file mode 100644
index 42fded23d7761..0000000000000
--- a/src/plugins/input_control_vis/public/index.scss
+++ /dev/null
@@ -1,9 +0,0 @@
-// Prefix all styles with "icv" to avoid conflicts.
-// Examples
-//   icvChart
-//   icvChart__legend
-//   icvChart__legend--small
-//   icvChart__legend-isLoading
-
-@import './components/editor/index';
-@import './components/vis/index';
diff --git a/src/plugins/input_control_vis/public/index.ts b/src/plugins/input_control_vis/public/index.ts
index 8edd3fd9996c3..b6fee12f6d9cb 100644
--- a/src/plugins/input_control_vis/public/index.ts
+++ b/src/plugins/input_control_vis/public/index.ts
@@ -17,8 +17,6 @@
  * under the License.
  */
 
-import './index.scss';
-
 import { PluginInitializerContext } from '../../../core/public';
 import { InputControlVisPlugin as Plugin } from './plugin';
 
diff --git a/src/plugins/input_control_vis/public/input_control_fn.ts b/src/plugins/input_control_vis/public/input_control_fn.ts
index 1664555b916b6..46fba66264bcb 100644
--- a/src/plugins/input_control_vis/public/input_control_fn.ts
+++ b/src/plugins/input_control_vis/public/input_control_fn.ts
@@ -20,24 +20,25 @@
 import { i18n } from '@kbn/i18n';
 
 import { ExpressionFunctionDefinition, Datatable, Render } from '../../expressions/public';
+import { InputControlVisParams } from './types';
 
 interface Arguments {
   visConfig: string;
 }
 
-type VisParams = Required<Arguments>;
-
-interface RenderValue {
+export interface InputControlRenderValue {
   visType: 'input_control_vis';
-  visConfig: VisParams;
+  visConfig: InputControlVisParams;
 }
 
-export const createInputControlVisFn = (): ExpressionFunctionDefinition<
+export type InputControlExpressionFunctionDefinition = ExpressionFunctionDefinition<
   'input_control_vis',
   Datatable,
   Arguments,
-  Render<RenderValue>
-> => ({
+  Render<InputControlRenderValue>
+>;
+
+export const createInputControlVisFn = (): InputControlExpressionFunctionDefinition => ({
   name: 'input_control_vis',
   type: 'render',
   inputTypes: [],
@@ -52,10 +53,10 @@ export const createInputControlVisFn = (): ExpressionFunctionDefinition<
     },
   },
   fn(input, args) {
-    const params = JSON.parse(args.visConfig);
+    const params: InputControlVisParams = JSON.parse(args.visConfig);
     return {
       type: 'render',
-      as: 'visualization',
+      as: 'input_control_vis',
       value: {
         visType: 'input_control_vis',
         visConfig: params,
diff --git a/src/plugins/input_control_vis/public/input_control_vis_renderer.tsx b/src/plugins/input_control_vis/public/input_control_vis_renderer.tsx
new file mode 100644
index 0000000000000..6431ed6ebed1e
--- /dev/null
+++ b/src/plugins/input_control_vis/public/input_control_vis_renderer.tsx
@@ -0,0 +1,51 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ExpressionRenderDefinition } from 'src/plugins/expressions';
+import { InputControlVisDependencies } from './plugin';
+import { InputControlRenderValue } from './input_control_fn';
+import type { InputControlVisControllerType } from './vis_controller';
+
+const inputControlVisRegistry = new Map<HTMLElement, InputControlVisControllerType>();
+
+export const getInputControlVisRenderer: (
+  deps: InputControlVisDependencies
+) => ExpressionRenderDefinition<InputControlRenderValue> = (deps) => ({
+  name: 'input_control_vis',
+  reuseDomNode: true,
+  render: async (domNode, { visConfig }, handlers) => {
+    let registeredController = inputControlVisRegistry.get(domNode);
+
+    if (!registeredController) {
+      const { createInputControlVisController } = await import('./vis_controller');
+
+      const Controller = createInputControlVisController(deps, handlers);
+      registeredController = new Controller(domNode);
+      inputControlVisRegistry.set(domNode, registeredController);
+
+      handlers.onDestroy(() => {
+        registeredController?.destroy();
+        inputControlVisRegistry.delete(domNode);
+      });
+    }
+
+    await registeredController.render(visConfig);
+    handlers.done();
+  },
+});
diff --git a/src/plugins/input_control_vis/public/input_control_vis_type.ts b/src/plugins/input_control_vis/public/input_control_vis_type.ts
index 6e33e18c1603b..686327a1ba774 100644
--- a/src/plugins/input_control_vis/public/input_control_vis_type.ts
+++ b/src/plugins/input_control_vis/public/input_control_vis_type.ts
@@ -19,15 +19,14 @@
 
 import { i18n } from '@kbn/i18n';
 import { VisGroups, BaseVisTypeOptions } from '../../visualizations/public';
-import { createInputControlVisController } from './vis_controller';
-import { getControlsTab } from './components/editor/controls_tab';
-import { OptionsTab } from './components/editor/options_tab';
+import { getControlsTab, OptionsTabLazy } from './components/editor';
 import { InputControlVisDependencies } from './plugin';
+import { toExpressionAst } from './to_ast';
+import { InputControlVisParams } from './types';
 
 export function createInputControlVisTypeDefinition(
   deps: InputControlVisDependencies
-): BaseVisTypeOptions {
-  const InputControlVisController = createInputControlVisController(deps);
+): BaseVisTypeOptions<InputControlVisParams> {
   const ControlsTab = getControlsTab(deps);
 
   return {
@@ -41,7 +40,6 @@ export function createInputControlVisTypeDefinition(
       defaultMessage: 'Add dropdown menus and range sliders to your dashboard.',
     }),
     stage: 'experimental',
-    visualization: InputControlVisController,
     visConfig: {
       defaults: {
         controls: [],
@@ -64,12 +62,12 @@ export function createInputControlVisTypeDefinition(
           title: i18n.translate('inputControl.register.tabs.optionsTitle', {
             defaultMessage: 'Options',
           }),
-          editor: OptionsTab,
+          editor: OptionsTabLazy,
         },
       ],
     },
     inspectorAdapters: {},
     requestHandler: 'none',
-    responseHandler: 'none',
+    toExpressionAst,
   };
 }
diff --git a/src/plugins/input_control_vis/public/plugin.ts b/src/plugins/input_control_vis/public/plugin.ts
index 2c93a529c25b1..afaaa27d74c82 100644
--- a/src/plugins/input_control_vis/public/plugin.ts
+++ b/src/plugins/input_control_vis/public/plugin.ts
@@ -22,6 +22,7 @@ import { DataPublicPluginSetup, DataPublicPluginStart } from 'src/plugins/data/p
 import { Plugin as ExpressionsPublicPlugin } from '../../expressions/public';
 import { VisualizationsSetup, VisualizationsStart } from '../../visualizations/public';
 import { createInputControlVisFn } from './input_control_fn';
+import { getInputControlVisRenderer } from './input_control_vis_renderer';
 import { createInputControlVisTypeDefinition } from './input_control_vis_type';
 
 type InputControlVisCoreSetup = CoreSetup<InputControlVisPluginStartDependencies, void>;
@@ -76,6 +77,7 @@ export class InputControlVisPlugin implements Plugin<void, void> {
     };
 
     expressions.registerFunction(createInputControlVisFn);
+    expressions.registerRenderer(getInputControlVisRenderer(visualizationDependencies));
     visualizations.createBaseVisualization(
       createInputControlVisTypeDefinition(visualizationDependencies)
     );
diff --git a/src/plugins/input_control_vis/public/to_ast.test.ts b/src/plugins/input_control_vis/public/to_ast.test.ts
new file mode 100644
index 0000000000000..fbeb78ee93a1e
--- /dev/null
+++ b/src/plugins/input_control_vis/public/to_ast.test.ts
@@ -0,0 +1,54 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Vis } from '../../visualizations/public';
+import { InputControlVisParams } from './types';
+import { toExpressionAst } from './to_ast';
+
+describe('input_control_vis toExpressionAst', () => {
+  const vis = {
+    params: {
+      controls: [
+        {
+          id: '1536977437774',
+          fieldName: 'manufacturer.keyword',
+          parent: '',
+          label: 'Manufacturer',
+          type: 'list',
+          options: {
+            type: 'terms',
+            multiselect: true,
+            dynamicOptions: true,
+            size: 5,
+            order: 'desc',
+          },
+          indexPattern: 'ff959d40-b880-11e8-a6d9-e546fe2bba5f',
+        },
+      ],
+      updateFiltersOnChange: false,
+      useTimeFilter: true,
+      pinFilters: false,
+    },
+  } as Vis<InputControlVisParams>;
+
+  it('should build an expression based on vis.params', () => {
+    const expression = toExpressionAst(vis);
+    expect(expression).toMatchSnapshot();
+  });
+});
diff --git a/src/plugins/input_control_vis/public/to_ast.ts b/src/plugins/input_control_vis/public/to_ast.ts
new file mode 100644
index 0000000000000..93c0b4a87cfe6
--- /dev/null
+++ b/src/plugins/input_control_vis/public/to_ast.ts
@@ -0,0 +1,36 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { buildExpression, buildExpressionFunction } from '../../expressions/public';
+import { Vis } from '../../visualizations/public';
+import { InputControlExpressionFunctionDefinition } from './input_control_fn';
+import { InputControlVisParams } from './types';
+
+export const toExpressionAst = (vis: Vis<InputControlVisParams>) => {
+  const inputControl = buildExpressionFunction<InputControlExpressionFunctionDefinition>(
+    'input_control_vis',
+    {
+      visConfig: JSON.stringify(vis.params),
+    }
+  );
+
+  const ast = buildExpression([inputControl]);
+
+  return ast.toAst();
+};
diff --git a/src/plugins/input_control_vis/public/types.ts b/src/plugins/input_control_vis/public/types.ts
new file mode 100644
index 0000000000000..2898ab49590ed
--- /dev/null
+++ b/src/plugins/input_control_vis/public/types.ts
@@ -0,0 +1,27 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ControlParams } from './editor_utils';
+
+export interface InputControlVisParams {
+  controls: ControlParams[];
+  pinFilters: boolean;
+  updateFiltersOnChange: boolean;
+  useTimeFilter: boolean;
+}
diff --git a/src/plugins/input_control_vis/public/vis_controller.tsx b/src/plugins/input_control_vis/public/vis_controller.tsx
index 6f35e17866120..8e762a38671e9 100644
--- a/src/plugins/input_control_vis/public/vis_controller.tsx
+++ b/src/plugins/input_control_vis/public/vis_controller.tsx
@@ -20,20 +20,29 @@
 import React from 'react';
 import { isEqual } from 'lodash';
 import { render, unmountComponentAtNode } from 'react-dom';
-
 import { Subscription } from 'rxjs';
+
 import { I18nStart } from 'kibana/public';
+import { IInterpreterRenderHandlers } from 'src/plugins/expressions';
+import { VisualizationContainer } from '../../visualizations/public';
+import { FilterManager, Filter } from '../../data/public';
+
 import { InputControlVis } from './components/vis/input_control_vis';
 import { getControlFactory } from './control/control_factory';
 import { getLineageMap } from './lineage';
-import { ControlParams } from './editor_utils';
 import { RangeControl } from './control/range_control_factory';
 import { ListControl } from './control/list_control_factory';
 import { InputControlVisDependencies } from './plugin';
-import { FilterManager, Filter } from '../../data/public';
-import { VisParams, ExprVis } from '../../visualizations/public';
+import { InputControlVisParams } from './types';
 
-export const createInputControlVisController = (deps: InputControlVisDependencies) => {
+export type InputControlVisControllerType = InstanceType<
+  ReturnType<typeof createInputControlVisController>
+>;
+
+export const createInputControlVisController = (
+  deps: InputControlVisDependencies,
+  handlers: IInterpreterRenderHandlers
+) => {
   return class InputControlVisController {
     private I18nContext?: I18nStart['Context'];
     private _isLoaded = false;
@@ -43,9 +52,9 @@ export const createInputControlVisController = (deps: InputControlVisDependencie
     filterManager: FilterManager;
     updateSubsciption: any;
     timeFilterSubscription: Subscription;
-    visParams?: VisParams;
+    visParams?: InputControlVisParams;
 
-    constructor(public el: Element, public vis: ExprVis) {
+    constructor(public el: Element) {
       this.controls = [];
 
       this.queryBarUpdateHandler = this.updateControlsFromKbn.bind(this);
@@ -63,7 +72,7 @@ export const createInputControlVisController = (deps: InputControlVisDependencie
         });
     }
 
-    async render(visData: any, visParams: VisParams) {
+    async render(visParams: InputControlVisParams) {
       if (!this.I18nContext) {
         const [{ i18n }] = await deps.core.getStartServices();
         this.I18nContext = i18n.Context;
@@ -71,7 +80,7 @@ export const createInputControlVisController = (deps: InputControlVisDependencie
       if (!this._isLoaded || !isEqual(visParams, this.visParams)) {
         this.visParams = visParams;
         this.controls = [];
-        this.controls = await this.initControls();
+        this.controls = await this.initControls(visParams);
         this._isLoaded = true;
       }
       this.drawVis();
@@ -91,34 +100,34 @@ export const createInputControlVisController = (deps: InputControlVisDependencie
 
       render(
         <this.I18nContext>
-          <InputControlVis
-            updateFiltersOnChange={this.visParams?.updateFiltersOnChange}
-            controls={this.controls}
-            stageFilter={this.stageFilter}
-            submitFilters={this.submitFilters}
-            resetControls={this.updateControlsFromKbn}
-            clearControls={this.clearControls}
-            hasChanges={this.hasChanges}
-            hasValues={this.hasValues}
-            refreshControl={this.refreshControl}
-          />
+          <VisualizationContainer handlers={handlers}>
+            <InputControlVis
+              updateFiltersOnChange={this.visParams?.updateFiltersOnChange}
+              controls={this.controls}
+              stageFilter={this.stageFilter}
+              submitFilters={this.submitFilters}
+              resetControls={this.updateControlsFromKbn}
+              clearControls={this.clearControls}
+              hasChanges={this.hasChanges}
+              hasValues={this.hasValues}
+              refreshControl={this.refreshControl}
+            />
+          </VisualizationContainer>
         </this.I18nContext>,
         this.el
       );
     };
 
-    async initControls() {
-      const controlParamsList = (this.visParams?.controls as ControlParams[])?.filter(
-        (controlParams) => {
-          // ignore controls that do not have indexPattern or field
-          return controlParams.indexPattern && controlParams.fieldName;
-        }
-      );
+    async initControls(visParams: InputControlVisParams) {
+      const controlParamsList = visParams.controls.filter((controlParams) => {
+        // ignore controls that do not have indexPattern or field
+        return controlParams.indexPattern && controlParams.fieldName;
+      });
 
       const controlFactoryPromises = controlParamsList.map((controlParams) => {
         const factory = getControlFactory(controlParams);
 
-        return factory(controlParams, this.visParams?.useTimeFilter, deps);
+        return factory(controlParams, visParams.useTimeFilter, deps);
       });
       const controls = await Promise.all<RangeControl | ListControl>(controlFactoryPromises);
 
diff --git a/src/plugins/visualizations/public/legacy/__snapshots__/build_pipeline.test.ts.snap b/src/plugins/visualizations/public/legacy/__snapshots__/build_pipeline.test.ts.snap
index 03a355c604c4d..3ff0c83961e2a 100644
--- a/src/plugins/visualizations/public/legacy/__snapshots__/build_pipeline.test.ts.snap
+++ b/src/plugins/visualizations/public/legacy/__snapshots__/build_pipeline.test.ts.snap
@@ -2,8 +2,6 @@
 
 exports[`visualize loader pipeline helpers: build pipeline buildPipeline calls toExpression on vis_type if it exists 1`] = `"kibana | kibana_context | test"`;
 
-exports[`visualize loader pipeline helpers: build pipeline buildPipelineVisFunction handles input_control_vis function 1`] = `"input_control_vis visConfig='{\\"some\\":\\"nested\\",\\"data\\":{\\"here\\":true}}' "`;
-
 exports[`visualize loader pipeline helpers: build pipeline buildPipelineVisFunction handles region_map function with buckets 1`] = `"regionmap visConfig='{\\"metric\\":{\\"accessor\\":0,\\"label\\":\\"\\",\\"format\\":{},\\"params\\":{},\\"aggType\\":\\"\\"},\\"bucket\\":1}' "`;
 
 exports[`visualize loader pipeline helpers: build pipeline buildPipelineVisFunction handles region_map function without buckets 1`] = `"regionmap visConfig='{\\"metric\\":{\\"accessor\\":0,\\"label\\":\\"\\",\\"format\\":{},\\"params\\":{},\\"aggType\\":\\"\\"}}' "`;
diff --git a/src/plugins/visualizations/public/legacy/build_pipeline.test.ts b/src/plugins/visualizations/public/legacy/build_pipeline.test.ts
index 653542bd8837d..57c58a99f09ea 100644
--- a/src/plugins/visualizations/public/legacy/build_pipeline.test.ts
+++ b/src/plugins/visualizations/public/legacy/build_pipeline.test.ts
@@ -92,15 +92,6 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
       uiState = {};
     });
 
-    it('handles input_control_vis function', () => {
-      const params = {
-        some: 'nested',
-        data: { here: true },
-      };
-      const actual = buildPipelineVisFunction.input_control_vis(params, schemasDef, uiState);
-      expect(actual).toMatchSnapshot();
-    });
-
     describe('handles region_map function', () => {
       it('without buckets', () => {
         const params = { metric: {} };
diff --git a/src/plugins/visualizations/public/legacy/build_pipeline.ts b/src/plugins/visualizations/public/legacy/build_pipeline.ts
index 0c244876ca6a3..29f6ec9b069a7 100644
--- a/src/plugins/visualizations/public/legacy/build_pipeline.ts
+++ b/src/plugins/visualizations/public/legacy/build_pipeline.ts
@@ -219,9 +219,6 @@ export const prepareDimension = (variable: string, data: any) => {
 };
 
 export const buildPipelineVisFunction: BuildPipelineVisFunction = {
-  input_control_vis: (params) => {
-    return `input_control_vis ${prepareJson('visConfig', params)}`;
-  },
   region_map: (params, schemas) => {
     const visConfig = {
       ...params,

From b454f2a1c2f9388be752eda826d470d698d0c094 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 2 Dec 2020 09:26:22 +0100
Subject: [PATCH 24/28] migrate away from rest_total_hits_as_int (#84508)

---
 x-pack/plugins/graph/public/angular/graph_client_workspace.js | 2 +-
 x-pack/plugins/graph/server/routes/search.ts                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/graph/public/angular/graph_client_workspace.js b/x-pack/plugins/graph/public/angular/graph_client_workspace.js
index 5cc06bad4c423..785e221b79865 100644
--- a/x-pack/plugins/graph/public/angular/graph_client_workspace.js
+++ b/x-pack/plugins/graph/public/angular/graph_client_workspace.js
@@ -1187,7 +1187,7 @@ function GraphWorkspace(options) {
 
     // Search for connections between the selected nodes.
     searcher(self.options.indexName, searchReq, function (data) {
-      const numDocsMatched = data.hits.total;
+      const numDocsMatched = data.hits.total.value;
       const buckets = data.aggregations.matrix.buckets;
       const vertices = nodesForLinking.map(function (existingNode) {
         return {
diff --git a/x-pack/plugins/graph/server/routes/search.ts b/x-pack/plugins/graph/server/routes/search.ts
index 1bd2861687281..7d05f9ab6888c 100644
--- a/x-pack/plugins/graph/server/routes/search.ts
+++ b/x-pack/plugins/graph/server/routes/search.ts
@@ -47,7 +47,7 @@ export function registerSearchRoute({
                 await esClient.asCurrentUser.search({
                   index: request.body.index,
                   body: request.body.body,
-                  rest_total_hits_as_int: true,
+                  track_total_hits: true,
                   ignore_throttled: !includeFrozen,
                 })
               ).body,

From 717a66fc6c41b484bd61071cc183313f3c0c3802 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?=
 <alejandro.haro@elastic.co>
Date: Wed, 2 Dec 2020 09:26:45 +0100
Subject: [PATCH 25/28] TelemetryCollectionManager: Use X-Pack strategy as an
 OSS overwrite (#84477)

---
 src/plugins/telemetry/server/fetcher.ts       |   2 -
 src/plugins/telemetry/server/index.ts         |   1 -
 src/plugins/telemetry/server/plugin.ts        |  15 +-
 .../telemetry_collection/get_local_stats.ts   |   2 +-
 .../server/telemetry_collection/index.ts      |   1 -
 .../register_collection.ts                    |  14 +-
 .../server/index.ts                           |   2 -
 .../server/plugin.ts                          | 157 +++++++-----------
 .../server/types.ts                           |  74 ++-------
 .../apis/telemetry/telemetry_local.js         |   2 +
 .../telemetry_collection/get_licenses.ts      |   2 +-
 .../common/index.ts                           |   8 -
 .../server/index.ts                           |   7 +-
 .../server/plugin.ts                          |  26 +--
 .../get_stats_with_xpack.test.ts.snap         |   6 +
 .../telemetry_collection/get_license.test.ts  |  82 +++++++++
 .../telemetry_collection/get_license.ts       |  45 +++--
 .../get_stats_with_xpack.ts                   |  23 ++-
 .../server/telemetry_collection/index.ts      |   1 +
 .../apis/telemetry/telemetry_local.js         |   3 +
 20 files changed, 218 insertions(+), 255 deletions(-)
 delete mode 100644 x-pack/plugins/telemetry_collection_xpack/common/index.ts
 create mode 100644 x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.test.ts
 rename src/plugins/telemetry/server/telemetry_collection/get_local_license.ts => x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.ts (50%)

diff --git a/src/plugins/telemetry/server/fetcher.ts b/src/plugins/telemetry/server/fetcher.ts
index a3649f51577ac..820f2c7c4c4af 100644
--- a/src/plugins/telemetry/server/fetcher.ts
+++ b/src/plugins/telemetry/server/fetcher.ts
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-import moment from 'moment';
 import { Observable, Subscription, timer } from 'rxjs';
 import { take } from 'rxjs/operators';
 // @ts-ignore
@@ -213,7 +212,6 @@ export class FetcherTask {
   private async fetchTelemetry() {
     return await this.telemetryCollectionManager!.getStats({
       unencrypted: false,
-      timestamp: moment().valueOf(),
     });
   }
 
diff --git a/src/plugins/telemetry/server/index.ts b/src/plugins/telemetry/server/index.ts
index e9887456e2f36..326c87a75b0ea 100644
--- a/src/plugins/telemetry/server/index.ts
+++ b/src/plugins/telemetry/server/index.ts
@@ -44,7 +44,6 @@ export const plugin = (initializerContext: PluginInitializerContext<TelemetryCon
 export { constants };
 export {
   getClusterUuids,
-  getLocalLicense,
   getLocalStats,
   TelemetryLocalStats,
   DATA_TELEMETRY_ID,
diff --git a/src/plugins/telemetry/server/plugin.ts b/src/plugins/telemetry/server/plugin.ts
index 037f97fb63ac6..f40c38b2cbbd0 100644
--- a/src/plugins/telemetry/server/plugin.ts
+++ b/src/plugins/telemetry/server/plugin.ts
@@ -33,9 +33,7 @@ import {
   SavedObjectsClient,
   Plugin,
   Logger,
-  IClusterClient,
   UiSettingsServiceStart,
-  SavedObjectsServiceStart,
 } from '../../../core/server';
 import { registerRoutes } from './routes';
 import { registerCollection } from './telemetry_collection';
@@ -88,8 +86,6 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
    */
   private readonly oldUiSettingsHandled$ = new AsyncSubject();
   private savedObjectsClient?: ISavedObjectsRepository;
-  private elasticsearchClient?: IClusterClient;
-  private savedObjectsService?: SavedObjectsServiceStart;
 
   constructor(initializerContext: PluginInitializerContext<TelemetryConfigType>) {
     this.logger = initializerContext.logger.get();
@@ -109,12 +105,7 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
     const currentKibanaVersion = this.currentKibanaVersion;
     const config$ = this.config$;
     const isDev = this.isDev;
-    registerCollection(
-      telemetryCollectionManager,
-      elasticsearch.legacy.client,
-      () => this.elasticsearchClient,
-      () => this.savedObjectsService
-    );
+    registerCollection(telemetryCollectionManager);
     const router = http.createRouter();
 
     registerRoutes({
@@ -138,11 +129,9 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
   }
 
   public start(core: CoreStart, { telemetryCollectionManager }: TelemetryPluginsDepsStart) {
-    const { savedObjects, uiSettings, elasticsearch } = core;
+    const { savedObjects, uiSettings } = core;
     const savedObjectsInternalRepository = savedObjects.createInternalRepository();
     this.savedObjectsClient = savedObjectsInternalRepository;
-    this.elasticsearchClient = elasticsearch.client;
-    this.savedObjectsService = savedObjects;
 
     // Not catching nor awaiting these promises because they should never reject
     this.handleOldUiSettings(uiSettings);
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
index a3666683a05a1..12245ce62305e 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
@@ -66,7 +66,7 @@ export type TelemetryLocalStats = ReturnType<typeof handleLocalStats>;
  * @param {Object} config contains the usageCollection, callCluster (deprecated), the esClient and Saved Objects client scoped to the request or the internal repository, and the kibana request
  * @param {Object} StatsCollectionContext contains logger and version (string)
  */
-export const getLocalStats: StatsGetter<{}, TelemetryLocalStats> = async (
+export const getLocalStats: StatsGetter<TelemetryLocalStats> = async (
   clustersDetails,
   config,
   context
diff --git a/src/plugins/telemetry/server/telemetry_collection/index.ts b/src/plugins/telemetry/server/telemetry_collection/index.ts
index 40cbf0e4caa1d..77894091f6133 100644
--- a/src/plugins/telemetry/server/telemetry_collection/index.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/index.ts
@@ -24,6 +24,5 @@ export {
   buildDataTelemetryPayload,
 } from './get_data_telemetry';
 export { getLocalStats, TelemetryLocalStats } from './get_local_stats';
-export { getLocalLicense } from './get_local_license';
 export { getClusterUuids } from './get_cluster_stats';
 export { registerCollection } from './register_collection';
diff --git a/src/plugins/telemetry/server/telemetry_collection/register_collection.ts b/src/plugins/telemetry/server/telemetry_collection/register_collection.ts
index 27ca5ae746512..fac315b01493e 100644
--- a/src/plugins/telemetry/server/telemetry_collection/register_collection.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/register_collection.ts
@@ -36,27 +36,17 @@
  * under the License.
  */
 
-import { ILegacyClusterClient, SavedObjectsServiceStart } from 'kibana/server';
 import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
-import { IClusterClient } from '../../../../../src/core/server';
 import { getLocalStats } from './get_local_stats';
 import { getClusterUuids } from './get_cluster_stats';
-import { getLocalLicense } from './get_local_license';
 
 export function registerCollection(
-  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup,
-  esCluster: ILegacyClusterClient,
-  esClientGetter: () => IClusterClient | undefined,
-  soServiceGetter: () => SavedObjectsServiceStart | undefined
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup
 ) {
-  telemetryCollectionManager.setCollection({
-    esCluster,
-    esClientGetter,
-    soServiceGetter,
+  telemetryCollectionManager.setCollectionStrategy({
     title: 'local',
     priority: 0,
     statsGetter: getLocalStats,
     clusterDetailsGetter: getClusterUuids,
-    licenseGetter: getLocalLicense,
   });
 }
diff --git a/src/plugins/telemetry_collection_manager/server/index.ts b/src/plugins/telemetry_collection_manager/server/index.ts
index 36ab64731fe58..de2080059c80b 100644
--- a/src/plugins/telemetry_collection_manager/server/index.ts
+++ b/src/plugins/telemetry_collection_manager/server/index.ts
@@ -30,13 +30,11 @@ export function plugin(initializerContext: PluginInitializerContext) {
 export {
   TelemetryCollectionManagerPluginSetup,
   TelemetryCollectionManagerPluginStart,
-  ESLicense,
   StatsCollectionConfig,
   StatsGetter,
   StatsGetterConfig,
   StatsCollectionContext,
   ClusterDetails,
   ClusterDetailsGetter,
-  LicenseGetter,
   UsageStatsPayload,
 } from './types';
diff --git a/src/plugins/telemetry_collection_manager/server/plugin.ts b/src/plugins/telemetry_collection_manager/server/plugin.ts
index bc33e9fbc82c5..a135f4b115b21 100644
--- a/src/plugins/telemetry_collection_manager/server/plugin.ts
+++ b/src/plugins/telemetry_collection_manager/server/plugin.ts
@@ -26,14 +26,15 @@ import {
   Logger,
   IClusterClient,
   SavedObjectsServiceStart,
-} from '../../../core/server';
+  ILegacyClusterClient,
+} from 'src/core/server';
 
 import {
   TelemetryCollectionManagerPluginSetup,
   TelemetryCollectionManagerPluginStart,
   BasicStatsPayload,
-  CollectionConfig,
-  Collection,
+  CollectionStrategyConfig,
+  CollectionStrategy,
   StatsGetterConfig,
   StatsCollectionConfig,
   UsageStatsPayload,
@@ -49,9 +50,12 @@ interface TelemetryCollectionPluginsDepsSetup {
 export class TelemetryCollectionManagerPlugin
   implements Plugin<TelemetryCollectionManagerPluginSetup, TelemetryCollectionManagerPluginStart> {
   private readonly logger: Logger;
-  private readonly collections: Array<Collection<any>> = [];
+  private collectionStrategy: CollectionStrategy<any> | undefined;
   private usageGetterMethodPriority = -1;
   private usageCollection?: UsageCollectionSetup;
+  private legacyElasticsearchClient?: ILegacyClusterClient;
+  private elasticsearchClient?: IClusterClient;
+  private savedObjectsService?: SavedObjectsServiceStart;
   private readonly isDistributable: boolean;
   private readonly version: string;
 
@@ -65,7 +69,7 @@ export class TelemetryCollectionManagerPlugin
     this.usageCollection = usageCollection;
 
     return {
-      setCollection: this.setCollection.bind(this),
+      setCollectionStrategy: this.setCollectionStrategy.bind(this),
       getOptInStats: this.getOptInStats.bind(this),
       getStats: this.getStats.bind(this),
       areAllCollectorsReady: this.areAllCollectorsReady.bind(this),
@@ -73,8 +77,11 @@ export class TelemetryCollectionManagerPlugin
   }
 
   public start(core: CoreStart) {
+    this.legacyElasticsearchClient = core.elasticsearch.legacy.client; // TODO: Remove when all the collectors have migrated
+    this.elasticsearchClient = core.elasticsearch.client;
+    this.savedObjectsService = core.savedObjects;
+
     return {
-      setCollection: this.setCollection.bind(this),
       getOptInStats: this.getOptInStats.bind(this),
       getStats: this.getStats.bind(this),
       areAllCollectorsReady: this.areAllCollectorsReady.bind(this),
@@ -83,19 +90,10 @@ export class TelemetryCollectionManagerPlugin
 
   public stop() {}
 
-  private setCollection<CustomContext extends Record<string, any>, T extends BasicStatsPayload>(
-    collectionConfig: CollectionConfig<CustomContext, T>
+  private setCollectionStrategy<T extends BasicStatsPayload>(
+    collectionConfig: CollectionStrategyConfig<T>
   ) {
-    const {
-      title,
-      priority,
-      esCluster,
-      esClientGetter,
-      soServiceGetter,
-      statsGetter,
-      clusterDetailsGetter,
-      licenseGetter,
-    } = collectionConfig;
+    const { title, priority, statsGetter, clusterDetailsGetter } = collectionConfig;
 
     if (typeof priority !== 'number') {
       throw new Error('priority must be set.');
@@ -108,78 +106,58 @@ export class TelemetryCollectionManagerPlugin
       if (!statsGetter) {
         throw Error('Stats getter method not set.');
       }
-      if (!esCluster) {
-        throw Error('esCluster name must be set for the getCluster method.');
-      }
-      if (!esClientGetter) {
-        throw Error('esClientGetter method not set.');
-      }
-      if (!soServiceGetter) {
-        throw Error('soServiceGetter method not set.');
-      }
       if (!clusterDetailsGetter) {
         throw Error('Cluster UUIds method is not set.');
       }
-      if (!licenseGetter) {
-        throw Error('License getter method not set.');
-      }
 
-      this.collections.unshift({
-        licenseGetter,
-        statsGetter,
-        clusterDetailsGetter,
-        esCluster,
-        title,
-        esClientGetter,
-        soServiceGetter,
-      });
+      this.logger.debug(`Setting ${title} as the telemetry collection strategy`);
+
+      // Overwrite the collection strategy
+      this.collectionStrategy = collectionConfig;
       this.usageGetterMethodPriority = priority;
     }
   }
 
+  /**
+   * Returns the context to provide to the Collection Strategies.
+   * It may return undefined if the ES and SO clients are not initialised yet.
+   * @param config {@link StatsGetterConfig}
+   * @param usageCollection {@link UsageCollectionSetup}
+   * @private
+   */
   private getStatsCollectionConfig(
     config: StatsGetterConfig,
-    collection: Collection,
-    collectionEsClient: IClusterClient,
-    collectionSoService: SavedObjectsServiceStart,
     usageCollection: UsageCollectionSetup
-  ): StatsCollectionConfig {
-    const { request } = config;
-
+  ): StatsCollectionConfig | undefined {
     const callCluster = config.unencrypted
-      ? collection.esCluster.asScoped(request).callAsCurrentUser
-      : collection.esCluster.callAsInternalUser;
+      ? this.legacyElasticsearchClient?.asScoped(config.request).callAsCurrentUser
+      : this.legacyElasticsearchClient?.callAsInternalUser;
     // Scope the new elasticsearch Client appropriately and pass to the stats collection config
     const esClient = config.unencrypted
-      ? collectionEsClient.asScoped(config.request).asCurrentUser
-      : collectionEsClient.asInternalUser;
+      ? this.elasticsearchClient?.asScoped(config.request).asCurrentUser
+      : this.elasticsearchClient?.asInternalUser;
     // Scope the saved objects client appropriately and pass to the stats collection config
     const soClient = config.unencrypted
-      ? collectionSoService.getScopedClient(config.request)
-      : collectionSoService.createInternalRepository();
+      ? this.savedObjectsService?.getScopedClient(config.request)
+      : this.savedObjectsService?.createInternalRepository();
     // Provide the kibanaRequest so opted-in plugins can scope their custom clients only if the request is not encrypted
-    const kibanaRequest = config.unencrypted ? request : void 0;
+    const kibanaRequest = config.unencrypted ? config.request : void 0;
 
-    return { callCluster, usageCollection, esClient, soClient, kibanaRequest };
+    if (callCluster && esClient && soClient) {
+      return { callCluster, usageCollection, esClient, soClient, kibanaRequest };
+    }
   }
 
   private async getOptInStats(optInStatus: boolean, config: StatsGetterConfig) {
     if (!this.usageCollection) {
       return [];
     }
-    for (const collection of this.collections) {
-      // first fetch the client and make sure it's not undefined.
-      const collectionEsClient = collection.esClientGetter();
-      const collectionSoService = collection.soServiceGetter();
-      if (collectionEsClient !== undefined && collectionSoService !== undefined) {
-        const statsCollectionConfig = this.getStatsCollectionConfig(
-          config,
-          collection,
-          collectionEsClient,
-          collectionSoService,
-          this.usageCollection
-        );
 
+    const collection = this.collectionStrategy;
+    if (collection) {
+      // Build the context (clients and others) to send to the CollectionStrategies
+      const statsCollectionConfig = this.getStatsCollectionConfig(config, this.usageCollection);
+      if (statsCollectionConfig) {
         try {
           const optInStats = await this.getOptInStatsForCollection(
             collection,
@@ -194,8 +172,9 @@ export class TelemetryCollectionManagerPlugin
             return encryptTelemetry(optInStats, { useProdKey: this.isDistributable });
           }
         } catch (err) {
-          this.logger.debug(`Failed to collect any opt in stats with registered collections.`);
-          // swallow error to try next collection;
+          this.logger.debug(
+            `Failed to collect any opt in stats with collection ${collection.title}.`
+          );
         }
       }
     }
@@ -203,19 +182,18 @@ export class TelemetryCollectionManagerPlugin
     return [];
   }
 
-  private areAllCollectorsReady = async () => {
+  private async areAllCollectorsReady() {
     return await this.usageCollection?.areAllCollectorsReady();
-  };
+  }
 
   private getOptInStatsForCollection = async (
-    collection: Collection,
+    collection: CollectionStrategy,
     optInStatus: boolean,
     statsCollectionConfig: StatsCollectionConfig
   ) => {
     const context: StatsCollectionContext = {
       logger: this.logger.get(collection.title),
       version: this.version,
-      ...collection.customContext,
     };
 
     const clustersDetails = await collection.clusterDetailsGetter(statsCollectionConfig, context);
@@ -229,17 +207,11 @@ export class TelemetryCollectionManagerPlugin
     if (!this.usageCollection) {
       return [];
     }
-    for (const collection of this.collections) {
-      const collectionEsClient = collection.esClientGetter();
-      const collectionSavedObjectsService = collection.soServiceGetter();
-      if (collectionEsClient !== undefined && collectionSavedObjectsService !== undefined) {
-        const statsCollectionConfig = this.getStatsCollectionConfig(
-          config,
-          collection,
-          collectionEsClient,
-          collectionSavedObjectsService,
-          this.usageCollection
-        );
+    const collection = this.collectionStrategy;
+    if (collection) {
+      // Build the context (clients and others) to send to the CollectionStrategies
+      const statsCollectionConfig = this.getStatsCollectionConfig(config, this.usageCollection);
+      if (statsCollectionConfig) {
         try {
           const usageData = await this.getUsageForCollection(collection, statsCollectionConfig);
           if (usageData.length) {
@@ -256,7 +228,6 @@ export class TelemetryCollectionManagerPlugin
           this.logger.debug(
             `Failed to collect any usage with registered collection ${collection.title}.`
           );
-          // swallow error to try next collection;
         }
       }
     }
@@ -265,34 +236,24 @@ export class TelemetryCollectionManagerPlugin
   }
 
   private async getUsageForCollection(
-    collection: Collection,
+    collection: CollectionStrategy,
     statsCollectionConfig: StatsCollectionConfig
   ): Promise<UsageStatsPayload[]> {
     const context: StatsCollectionContext = {
       logger: this.logger.get(collection.title),
       version: this.version,
-      ...collection.customContext,
     };
 
     const clustersDetails = await collection.clusterDetailsGetter(statsCollectionConfig, context);
 
     if (clustersDetails.length === 0) {
-      // don't bother doing a further lookup, try next collection.
+      // don't bother doing a further lookup.
       return [];
     }
 
-    const [stats, licenses] = await Promise.all([
-      collection.statsGetter(clustersDetails, statsCollectionConfig, context),
-      collection.licenseGetter(clustersDetails, statsCollectionConfig, context),
-    ]);
+    const stats = await collection.statsGetter(clustersDetails, statsCollectionConfig, context);
 
-    return stats.map((stat) => {
-      const license = licenses[stat.cluster_uuid];
-      return {
-        collectionSource: collection.title,
-        ...(license ? { license } : {}),
-        ...stat,
-      };
-    });
+    // Add the `collectionSource` to the resulting payload
+    return stats.map((stat) => ({ collectionSource: collection.title, ...stat }));
   }
 }
diff --git a/src/plugins/telemetry_collection_manager/server/types.ts b/src/plugins/telemetry_collection_manager/server/types.ts
index a6cf1a9e5aaf9..05641d5064593 100644
--- a/src/plugins/telemetry_collection_manager/server/types.ts
+++ b/src/plugins/telemetry_collection_manager/server/types.ts
@@ -19,21 +19,18 @@
 
 import {
   LegacyAPICaller,
+  ElasticsearchClient,
   Logger,
   KibanaRequest,
-  ILegacyClusterClient,
-  IClusterClient,
-  SavedObjectsServiceStart,
   SavedObjectsClientContract,
   ISavedObjectsRepository,
-} from 'kibana/server';
+} from 'src/core/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { ElasticsearchClient } from '../../../../src/core/server';
 import { TelemetryCollectionManagerPlugin } from './plugin';
 
 export interface TelemetryCollectionManagerPluginSetup {
-  setCollection: <CustomContext extends Record<string, any>, T extends BasicStatsPayload>(
-    collectionConfig: CollectionConfig<CustomContext, T>
+  setCollectionStrategy: <T extends BasicStatsPayload>(
+    collectionConfig: CollectionStrategyConfig<T>
   ) => void;
   getOptInStats: TelemetryCollectionManagerPlugin['getOptInStats'];
   getStats: TelemetryCollectionManagerPlugin['getStats'];
@@ -41,9 +38,6 @@ export interface TelemetryCollectionManagerPluginSetup {
 }
 
 export interface TelemetryCollectionManagerPluginStart {
-  setCollection: <CustomContext extends Record<string, any>, T extends BasicStatsPayload>(
-    collectionConfig: CollectionConfig<CustomContext, T>
-  ) => void;
   getOptInStats: TelemetryCollectionManagerPlugin['getOptInStats'];
   getStats: TelemetryCollectionManagerPlugin['getStats'];
   areAllCollectorsReady: TelemetryCollectionManagerPlugin['areAllCollectorsReady'];
@@ -91,74 +85,34 @@ export interface BasicStatsPayload {
 }
 
 export interface UsageStatsPayload extends BasicStatsPayload {
-  license?: ESLicense;
   collectionSource: string;
 }
 
-// From https://www.elastic.co/guide/en/elasticsearch/reference/current/get-license.html
-export interface ESLicense {
-  status: string;
-  uid: string;
-  type: string;
-  issue_date: string;
-  issue_date_in_millis: number;
-  expiry_date: string;
-  expirty_date_in_millis: number;
-  max_nodes: number;
-  issued_to: string;
-  issuer: string;
-  start_date_in_millis: number;
-}
-
 export interface StatsCollectionContext {
   logger: Logger | Console;
   version: string;
 }
 
 export type StatsGetterConfig = UnencryptedStatsGetterConfig | EncryptedStatsGetterConfig;
-export type ClusterDetailsGetter<CustomContext extends Record<string, any> = {}> = (
+export type ClusterDetailsGetter = (
   config: StatsCollectionConfig,
-  context: StatsCollectionContext & CustomContext
+  context: StatsCollectionContext
 ) => Promise<ClusterDetails[]>;
-export type StatsGetter<
-  CustomContext extends Record<string, any> = {},
-  T extends BasicStatsPayload = BasicStatsPayload
-> = (
+export type StatsGetter<T extends BasicStatsPayload = BasicStatsPayload> = (
   clustersDetails: ClusterDetails[],
   config: StatsCollectionConfig,
-  context: StatsCollectionContext & CustomContext
+  context: StatsCollectionContext
 ) => Promise<T[]>;
-export type LicenseGetter<CustomContext extends Record<string, any> = {}> = (
-  clustersDetails: ClusterDetails[],
-  config: StatsCollectionConfig,
-  context: StatsCollectionContext & CustomContext
-) => Promise<{ [clusterUuid: string]: ESLicense | undefined }>;
 
-export interface CollectionConfig<
-  CustomContext extends Record<string, any> = {},
-  T extends BasicStatsPayload = BasicStatsPayload
-> {
+export interface CollectionStrategyConfig<T extends BasicStatsPayload = BasicStatsPayload> {
   title: string;
   priority: number;
-  esCluster: ILegacyClusterClient;
-  esClientGetter: () => IClusterClient | undefined; // --> by now we know that the client getter will return the IClusterClient but we assure that through a code check
-  soServiceGetter: () => SavedObjectsServiceStart | undefined; // --> by now we know that the service getter will return the SavedObjectsServiceStart but we assure that through a code check
-  statsGetter: StatsGetter<CustomContext, T>;
-  clusterDetailsGetter: ClusterDetailsGetter<CustomContext>;
-  licenseGetter: LicenseGetter<CustomContext>;
-  customContext?: CustomContext;
+  statsGetter: StatsGetter<T>;
+  clusterDetailsGetter: ClusterDetailsGetter;
 }
 
-export interface Collection<
-  CustomContext extends Record<string, any> = {},
-  T extends BasicStatsPayload = BasicStatsPayload
-> {
-  customContext?: CustomContext;
-  statsGetter: StatsGetter<CustomContext, T>;
-  licenseGetter: LicenseGetter<CustomContext>;
-  clusterDetailsGetter: ClusterDetailsGetter<CustomContext>;
-  esCluster: ILegacyClusterClient;
-  esClientGetter: () => IClusterClient | undefined; // the collection could still return undefined for the es client getter.
-  soServiceGetter: () => SavedObjectsServiceStart | undefined; // the collection could still return undefined for the Saved Objects Service getter.
+export interface CollectionStrategy<T extends BasicStatsPayload = BasicStatsPayload> {
+  statsGetter: StatsGetter<T>;
+  clusterDetailsGetter: ClusterDetailsGetter;
   title: string;
 }
diff --git a/test/api_integration/apis/telemetry/telemetry_local.js b/test/api_integration/apis/telemetry/telemetry_local.js
index b3d34d5910fc3..a025a65779e9c 100644
--- a/test/api_integration/apis/telemetry/telemetry_local.js
+++ b/test/api_integration/apis/telemetry/telemetry_local.js
@@ -62,6 +62,8 @@ export default function ({ getService }) {
       expect(body.length).to.be(1);
       const stats = body[0];
       expect(stats.collection).to.be('local');
+      expect(stats.collectionSource).to.be('local');
+      expect(stats.license).to.be.undefined; // OSS cannot get the license
       expect(stats.stack_stats.kibana.count).to.be.a('number');
       expect(stats.stack_stats.kibana.indices).to.be.a('number');
       expect(stats.stack_stats.kibana.os.platforms[0].platform).to.be.a('string');
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
index 7b1b877c51278..792389485164d 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
@@ -5,8 +5,8 @@
  */
 
 import { SearchResponse } from 'elasticsearch';
-import { ESLicense } from 'src/plugins/telemetry_collection_manager/server';
 import { LegacyAPICaller } from 'kibana/server';
+import { ESLicense } from '../../../telemetry_collection_xpack/server';
 import { INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
 
 /**
diff --git a/x-pack/plugins/telemetry_collection_xpack/common/index.ts b/x-pack/plugins/telemetry_collection_xpack/common/index.ts
deleted file mode 100644
index 2b08ebe2e7bbf..0000000000000
--- a/x-pack/plugins/telemetry_collection_xpack/common/index.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const PLUGIN_ID = 'telemetryCollectionXpack';
-export const PLUGIN_NAME = 'telemetry_collection_xpack';
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/index.ts b/x-pack/plugins/telemetry_collection_xpack/server/index.ts
index 249d16c331c39..de39089fe0e03 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/index.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/index.ts
@@ -4,12 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PluginInitializerContext } from 'kibana/server';
 import { TelemetryCollectionXpackPlugin } from './plugin';
 
+export { ESLicense } from './telemetry_collection';
+
 //  This exports static code and TypeScript types,
 //  as well as, Kibana Platform `plugin()` initializer.
 
-export function plugin(initializerContext: PluginInitializerContext) {
-  return new TelemetryCollectionXpackPlugin(initializerContext);
+export function plugin() {
+  return new TelemetryCollectionXpackPlugin();
 }
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/plugin.ts b/x-pack/plugins/telemetry_collection_xpack/server/plugin.ts
index 524b4c5616c73..e6d72f5813163 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/plugin.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/plugin.ts
@@ -4,16 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  PluginInitializerContext,
-  CoreSetup,
-  CoreStart,
-  Plugin,
-  IClusterClient,
-  SavedObjectsServiceStart,
-} from 'kibana/server';
+import { CoreSetup, CoreStart, Plugin } from 'src/core/server';
 import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
-import { getClusterUuids, getLocalLicense } from '../../../../src/plugins/telemetry/server';
+import { getClusterUuids } from '../../../../src/plugins/telemetry/server';
 import { getStatsWithXpack } from './telemetry_collection';
 
 interface TelemetryCollectionXpackDepsSetup {
@@ -21,25 +14,16 @@ interface TelemetryCollectionXpackDepsSetup {
 }
 
 export class TelemetryCollectionXpackPlugin implements Plugin {
-  private elasticsearchClient?: IClusterClient;
-  private savedObjectsService?: SavedObjectsServiceStart;
-  constructor(initializerContext: PluginInitializerContext) {}
+  constructor() {}
 
   public setup(core: CoreSetup, { telemetryCollectionManager }: TelemetryCollectionXpackDepsSetup) {
-    telemetryCollectionManager.setCollection({
-      esCluster: core.elasticsearch.legacy.client,
-      esClientGetter: () => this.elasticsearchClient,
-      soServiceGetter: () => this.savedObjectsService,
+    telemetryCollectionManager.setCollectionStrategy({
       title: 'local_xpack',
       priority: 1,
       statsGetter: getStatsWithXpack,
       clusterDetailsGetter: getClusterUuids,
-      licenseGetter: getLocalLicense,
     });
   }
 
-  public start(core: CoreStart) {
-    this.elasticsearchClient = core.elasticsearch.client;
-    this.savedObjectsService = core.savedObjects;
-  }
+  public start(core: CoreStart) {}
 }
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/__snapshots__/get_stats_with_xpack.test.ts.snap b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/__snapshots__/get_stats_with_xpack.test.ts.snap
index b68186c0c343d..836b5276615ef 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/__snapshots__/get_stats_with_xpack.test.ts.snap
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/__snapshots__/get_stats_with_xpack.test.ts.snap
@@ -104,6 +104,9 @@ Object {
   },
   "cluster_uuid": "test",
   "collection": "local",
+  "license": Object {
+    "type": "basic",
+  },
   "stack_stats": Object {
     "data": Array [],
     "kibana": Object {
@@ -183,6 +186,9 @@ Object {
   },
   "cluster_uuid": "test",
   "collection": "local",
+  "license": Object {
+    "type": "basic",
+  },
   "stack_stats": Object {
     "data": Array [],
     "kibana": Object {
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.test.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.test.ts
new file mode 100644
index 0000000000000..c5c6832aa84ac
--- /dev/null
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.test.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { elasticsearchServiceMock } from 'src/core/server/mocks';
+import { getLicenseFromLocalOrMaster } from './get_license';
+
+describe('getLicenseFromLocalOrMaster', () => {
+  test('return an undefined license if it fails to get the license on the first attempt and it does not have a cached license yet', async () => {
+    const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+    // The local fetch fails
+    esClient.license.get.mockRejectedValue(new Error('Something went terribly wrong'));
+
+    const license = await getLicenseFromLocalOrMaster(esClient);
+
+    expect(license).toBeUndefined();
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: true, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledTimes(1);
+  });
+
+  test('returns the license it fetches from Elasticsearch', async () => {
+    const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+    // The local fetch succeeds
+    esClient.license.get.mockResolvedValue({ body: { license: { type: 'basic' } } } as any);
+
+    const license = await getLicenseFromLocalOrMaster(esClient);
+
+    expect(license).toStrictEqual({ type: 'basic' });
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: true, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledTimes(1);
+  });
+
+  test('after the first successful attempt, if the local request fails, it will try with the master request (failed case)', async () => {
+    const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+    const error = new Error('Something went terribly wrong');
+    // The requests fail with an error
+    esClient.license.get.mockRejectedValue(error);
+
+    await expect(getLicenseFromLocalOrMaster(esClient)).rejects.toStrictEqual(error);
+
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: true, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: false, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledTimes(2);
+  });
+
+  test('after the first successful attempt, if the local request fails, it will try with the master request (success case)', async () => {
+    const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+    // The local fetch fails
+    esClient.license.get.mockRejectedValueOnce(new Error('Something went terribly wrong'));
+    // The master fetch succeeds
+    esClient.license.get.mockResolvedValue({ body: { license: { type: 'basic' } } } as any);
+
+    const license = await getLicenseFromLocalOrMaster(esClient);
+
+    expect(license).toStrictEqual({ type: 'basic' });
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: true, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: false, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledTimes(2);
+  });
+
+  test('after the first successful attempt, if the local request fails, it will try with the master request (clearing cached license)', async () => {
+    const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+    // The requests fail with 400
+    esClient.license.get.mockRejectedValue({ statusCode: 400 });
+
+    // First attempt goes through 2 requests: local and master
+    const license = await getLicenseFromLocalOrMaster(esClient);
+
+    expect(license).toBeUndefined();
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: true, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: false, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledTimes(2);
+
+    // Now the cached license is cleared, next request only goes for local and gives up when failed
+    esClient.license.get.mockClear();
+    await expect(getLicenseFromLocalOrMaster(esClient)).resolves.toBeUndefined();
+    expect(esClient.license.get).toHaveBeenCalledWith({ local: true, accept_enterprise: true });
+    expect(esClient.license.get).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/src/plugins/telemetry/server/telemetry_collection/get_local_license.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.ts
similarity index 50%
rename from src/plugins/telemetry/server/telemetry_collection/get_local_license.ts
rename to x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.ts
index 879416cda62fc..9ffbf5d1bf6d7 100644
--- a/src/plugins/telemetry/server/telemetry_collection/get_local_license.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_license.ts
@@ -1,29 +1,30 @@
 /*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESLicense, LicenseGetter } from 'src/plugins/telemetry_collection_manager/server';
 import { ElasticsearchClient } from 'src/core/server';
 
+// From https://www.elastic.co/guide/en/elasticsearch/reference/current/get-license.html
+export interface ESLicense {
+  status: string;
+  uid: string;
+  type: string;
+  issue_date: string;
+  issue_date_in_millis: number;
+  expiry_date: string;
+  expirty_date_in_millis: number;
+  max_nodes: number;
+  issued_to: string;
+  issuer: string;
+  start_date_in_millis: number;
+}
+
 let cachedLicense: ESLicense | undefined;
 
 async function fetchLicense(esClient: ElasticsearchClient, local: boolean) {
-  const { body } = await esClient.license.get({
+  const { body } = await esClient.license.get<{ license: ESLicense }>({
     local,
     // For versions >= 7.6 and < 8.0, this flag is needed otherwise 'platinum' is returned for 'enterprise' license.
     accept_enterprise: true,
@@ -39,7 +40,7 @@ async function fetchLicense(esClient: ElasticsearchClient, local: boolean) {
  *
  * In OSS we'll get a 400 response using the new elasticsearch client.
  */
-async function getLicenseFromLocalOrMaster(esClient: ElasticsearchClient) {
+export async function getLicenseFromLocalOrMaster(esClient: ElasticsearchClient) {
   // Fetching the local license is cheaper than getting it from the master node and good enough
   const { license } = await fetchLicense(esClient, true).catch(async (err) => {
     if (cachedLicense) {
@@ -64,9 +65,3 @@ async function getLicenseFromLocalOrMaster(esClient: ElasticsearchClient) {
   }
   return license;
 }
-
-export const getLocalLicense: LicenseGetter = async (clustersDetails, { esClient }) => {
-  const license = await getLicenseFromLocalOrMaster(esClient);
-  // It should be called only with 1 cluster element in the clustersDetails array, but doing reduce just in case.
-  return clustersDetails.reduce((acc, { clusterUuid }) => ({ ...acc, [clusterUuid]: license }), {});
-};
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
index c0e55274b08df..bf1e7c3aaae17 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
@@ -4,33 +4,42 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { StatsGetter } from 'src/plugins/telemetry_collection_manager/server';
 import { TelemetryLocalStats, getLocalStats } from '../../../../../src/plugins/telemetry/server';
-import { StatsGetter } from '../../../../../src/plugins/telemetry_collection_manager/server';
 import { getXPackUsage } from './get_xpack';
+import { ESLicense, getLicenseFromLocalOrMaster } from './get_license';
 
 export type TelemetryAggregatedStats = TelemetryLocalStats & {
   stack_stats: { xpack?: object };
+  license?: ESLicense;
 };
 
-export const getStatsWithXpack: StatsGetter<{}, TelemetryAggregatedStats> = async function (
+export const getStatsWithXpack: StatsGetter<TelemetryAggregatedStats> = async function (
   clustersDetails,
   config,
   context
 ) {
   const { esClient } = config;
-  const clustersLocalStats = await getLocalStats(clustersDetails, config, context);
-  const xpack = await getXPackUsage(esClient).catch(() => undefined); // We want to still report something (and do not lose the license) even when this method fails.
+  const [clustersLocalStats, license, xpack] = await Promise.all([
+    getLocalStats(clustersDetails, config, context),
+    getLicenseFromLocalOrMaster(esClient),
+    getXPackUsage(esClient).catch(() => undefined), // We want to still report something (and do not lose the license) even when this method fails.
+  ]);
 
   return clustersLocalStats
     .map((localStats) => {
+      const localStatsWithLicense: TelemetryAggregatedStats = {
+        ...localStats,
+        ...(license && { license }),
+      };
       if (xpack) {
         return {
-          ...localStats,
-          stack_stats: { ...localStats.stack_stats, xpack },
+          ...localStatsWithLicense,
+          stack_stats: { ...localStatsWithLicense.stack_stats, xpack },
         };
       }
 
-      return localStats;
+      return localStatsWithLicense;
     })
     .reduce((acc, stats) => {
       // Concatenate the telemetry reported via monitoring as additional payloads instead of reporting it inside of stack_stats.kibana.plugins.monitoringTelemetry
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/index.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/index.ts
index 553f8dc0c4188..bcd011ae750a6 100644
--- a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/index.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/index.ts
@@ -4,4 +4,5 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export { ESLicense } from './get_license';
 export { getStatsWithXpack } from './get_stats_with_xpack';
diff --git a/x-pack/test/api_integration/apis/telemetry/telemetry_local.js b/x-pack/test/api_integration/apis/telemetry/telemetry_local.js
index 6a5a7db4d2560..e7014ff92d9b9 100644
--- a/x-pack/test/api_integration/apis/telemetry/telemetry_local.js
+++ b/x-pack/test/api_integration/apis/telemetry/telemetry_local.js
@@ -55,6 +55,9 @@ export default function ({ getService }) {
       const stats = body[0];
 
       expect(stats.collection).to.be('local');
+      expect(stats.collectionSource).to.be('local_xpack');
+
+      // License should exist in X-Pack
       expect(stats.license.issuer).to.be.a('string');
       expect(stats.license.status).to.be('active');
 

From 8981d0e9e23d96592a7ceaddfba735639aa620a5 Mon Sep 17 00:00:00 2001
From: Aleh Zasypkin <aleh.zasypkin@gmail.com>
Date: Wed, 2 Dec 2020 09:32:49 +0100
Subject: [PATCH 26/28] Make it possible to use Kibana anonymous authentication
 provider with ES anonymous access. (#84074)

---
 .../providers/anonymous.test.ts               | 74 +++++++++++++------
 .../authentication/providers/anonymous.ts     | 51 ++++++++++---
 x-pack/plugins/security/server/config.test.ts | 54 ++++++++++++--
 x-pack/plugins/security/server/config.ts      |  1 +
 .../anonymous_es_anonymous.config.ts          | 40 ++++++++++
 .../tests/anonymous/login.ts                  | 28 ++++---
 6 files changed, 200 insertions(+), 48 deletions(-)
 create mode 100644 x-pack/test/security_api_integration/anonymous_es_anonymous.config.ts

diff --git a/x-pack/plugins/security/server/authentication/providers/anonymous.test.ts b/x-pack/plugins/security/server/authentication/providers/anonymous.test.ts
index c296cb9c8e94d..9674181e18750 100644
--- a/x-pack/plugins/security/server/authentication/providers/anonymous.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/anonymous.test.ts
@@ -29,32 +29,48 @@ function expectAuthenticateCall(
   expect(mockScopedClusterClient.callAsCurrentUser).toHaveBeenCalledWith('shield.authenticate');
 }
 
+enum CredentialsType {
+  Basic = 'Basic',
+  ApiKey = 'ApiKey',
+  None = 'ES native anonymous',
+}
+
 describe('AnonymousAuthenticationProvider', () => {
   const user = mockAuthenticatedUser({
     authentication_provider: { type: 'anonymous', name: 'anonymous1' },
   });
 
-  for (const useBasicCredentials of [true, false]) {
-    describe(`with ${useBasicCredentials ? '`Basic`' : '`ApiKey`'} credentials`, () => {
+  for (const credentialsType of [
+    CredentialsType.Basic,
+    CredentialsType.ApiKey,
+    CredentialsType.None,
+  ]) {
+    describe(`with ${credentialsType} credentials`, () => {
       let provider: AnonymousAuthenticationProvider;
       let mockOptions: ReturnType<typeof mockAuthenticationProviderOptions>;
       let authorization: string;
       beforeEach(() => {
         mockOptions = mockAuthenticationProviderOptions({ name: 'anonymous1' });
 
-        provider = useBasicCredentials
-          ? new AnonymousAuthenticationProvider(mockOptions, {
-              credentials: { username: 'user', password: 'pass' },
-            })
-          : new AnonymousAuthenticationProvider(mockOptions, {
-              credentials: { apiKey: 'some-apiKey' },
-            });
-        authorization = useBasicCredentials
-          ? new HTTPAuthorizationHeader(
+        let credentials;
+        switch (credentialsType) {
+          case CredentialsType.Basic:
+            credentials = { username: 'user', password: 'pass' };
+            authorization = new HTTPAuthorizationHeader(
               'Basic',
               new BasicHTTPAuthorizationHeaderCredentials('user', 'pass').toString()
-            ).toString()
-          : new HTTPAuthorizationHeader('ApiKey', 'some-apiKey').toString();
+            ).toString();
+            break;
+          case CredentialsType.ApiKey:
+            credentials = { apiKey: 'some-apiKey' };
+            authorization = new HTTPAuthorizationHeader('ApiKey', 'some-apiKey').toString();
+            break;
+          default:
+            credentials = 'elasticsearch_anonymous_user' as 'elasticsearch_anonymous_user';
+            break;
+        }
+
+        provider = new AnonymousAuthenticationProvider(mockOptions, { credentials });
       });
 
       describe('`login` method', () => {
@@ -111,23 +127,29 @@ describe('AnonymousAuthenticationProvider', () => {
         });
 
         it('does not handle authentication via `authorization` header.', async () => {
-          const request = httpServerMock.createKibanaRequest({ headers: { authorization } });
+          const originalAuthorizationHeader = 'Basic credentials';
+          const request = httpServerMock.createKibanaRequest({
+            headers: { authorization: originalAuthorizationHeader },
+          });
           await expect(provider.authenticate(request)).resolves.toEqual(
             AuthenticationResult.notHandled()
           );
 
           expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
-          expect(request.headers.authorization).toBe(authorization);
+          expect(request.headers.authorization).toBe(originalAuthorizationHeader);
         });
 
         it('does not handle authentication via `authorization` header even if state exists.', async () => {
-          const request = httpServerMock.createKibanaRequest({ headers: { authorization } });
+          const originalAuthorizationHeader = 'Basic credentials';
+          const request = httpServerMock.createKibanaRequest({
+            headers: { authorization: originalAuthorizationHeader },
+          });
           await expect(provider.authenticate(request, {})).resolves.toEqual(
             AuthenticationResult.notHandled()
           );
 
           expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
-          expect(request.headers.authorization).toBe(authorization);
+          expect(request.headers.authorization).toBe(originalAuthorizationHeader);
         });
 
         it('succeeds for non-AJAX requests if state is available.', async () => {
@@ -191,7 +213,7 @@ describe('AnonymousAuthenticationProvider', () => {
           expect(request.headers).not.toHaveProperty('authorization');
         });
 
-        if (!useBasicCredentials) {
+        if (credentialsType === CredentialsType.ApiKey) {
           it('properly handles extended format for the ApiKey credentials', async () => {
             provider = new AnonymousAuthenticationProvider(mockOptions, {
               credentials: { apiKey: { id: 'some-id', key: 'some-key' } },
@@ -237,9 +259,19 @@ describe('AnonymousAuthenticationProvider', () => {
       });
 
       it('`getHTTPAuthenticationScheme` method', () => {
-        expect(provider.getHTTPAuthenticationScheme()).toBe(
-          useBasicCredentials ? 'basic' : 'apikey'
-        );
+        let expectedAuthenticationScheme;
+        switch (credentialsType) {
+          case CredentialsType.Basic:
+            expectedAuthenticationScheme = 'basic';
+            break;
+          case CredentialsType.ApiKey:
+            expectedAuthenticationScheme = 'apikey';
+            break;
+          default:
+            expectedAuthenticationScheme = null;
+            break;
+        }
+        expect(provider.getHTTPAuthenticationScheme()).toBe(expectedAuthenticationScheme);
       });
     });
   }
diff --git a/x-pack/plugins/security/server/authentication/providers/anonymous.ts b/x-pack/plugins/security/server/authentication/providers/anonymous.ts
index 6f02cce371a41..6d62d3a909e55 100644
--- a/x-pack/plugins/security/server/authentication/providers/anonymous.ts
+++ b/x-pack/plugins/security/server/authentication/providers/anonymous.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { KibanaRequest } from '../../../../../../src/core/server';
+import { KibanaRequest, LegacyElasticsearchErrorHelpers } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { canRedirectRequest } from '../can_redirect_request';
 import { DeauthenticationResult } from '../deauthentication_result';
@@ -29,6 +29,11 @@ interface APIKeyCredentials {
   apiKey: { id: string; key: string } | string;
 }
 
+/**
+ * Credentials that imply authentication based on the Elasticsearch native anonymous user.
+ */
+type ElasticsearchAnonymousUserCredentials = 'elasticsearch_anonymous_user';
+
 /**
  * Checks whether current request can initiate a new session.
  * @param request Request instance.
@@ -44,7 +49,10 @@ function canStartNewSession(request: KibanaRequest) {
  * @param credentials
  */
 function isAPIKeyCredentials(
-  credentials: UsernameAndPasswordCredentials | APIKeyCredentials
+  credentials:
+    | ElasticsearchAnonymousUserCredentials
+    | APIKeyCredentials
+    | UsernameAndPasswordCredentials
 ): credentials is APIKeyCredentials {
   return !!(credentials as APIKeyCredentials).apiKey;
 }
@@ -59,14 +67,17 @@ export class AnonymousAuthenticationProvider extends BaseAuthenticationProvider
   static readonly type = 'anonymous';
 
   /**
-   * Defines HTTP authorization header that should be used to authenticate request.
+   * Defines HTTP authorization header that should be used to authenticate request. It isn't defined
+   * if provider should rely on Elasticsearch native anonymous access.
    */
-  private readonly httpAuthorizationHeader: HTTPAuthorizationHeader;
+  private readonly httpAuthorizationHeader?: HTTPAuthorizationHeader;
 
   constructor(
     protected readonly options: Readonly<AuthenticationProviderOptions>,
     anonymousOptions?: Readonly<{
-      credentials?: Readonly<UsernameAndPasswordCredentials | APIKeyCredentials>;
+      credentials?: Readonly<
+        ElasticsearchAnonymousUserCredentials | UsernameAndPasswordCredentials | APIKeyCredentials
+      >;
     }>
   ) {
     super(options);
@@ -76,7 +87,11 @@ export class AnonymousAuthenticationProvider extends BaseAuthenticationProvider
       throw new Error('Credentials must be specified');
     }
 
-    if (isAPIKeyCredentials(credentials)) {
+    if (credentials === 'elasticsearch_anonymous_user') {
+      this.logger.debug(
+        'Anonymous requests will be authenticated using Elasticsearch native anonymous user.'
+      );
+    } else if (isAPIKeyCredentials(credentials)) {
       this.logger.debug('Anonymous requests will be authenticated via API key.');
       this.httpAuthorizationHeader = new HTTPAuthorizationHeader(
         'ApiKey',
@@ -155,7 +170,7 @@ export class AnonymousAuthenticationProvider extends BaseAuthenticationProvider
    * HTTP header that provider attaches to all successfully authenticated requests to Elasticsearch.
    */
   public getHTTPAuthenticationScheme() {
-    return this.httpAuthorizationHeader.scheme.toLowerCase();
+    return this.httpAuthorizationHeader?.scheme.toLowerCase() ?? null;
   }
 
   /**
@@ -164,7 +179,9 @@ export class AnonymousAuthenticationProvider extends BaseAuthenticationProvider
    * @param state State value previously stored by the provider.
    */
   private async authenticateViaAuthorizationHeader(request: KibanaRequest, state?: unknown) {
-    const authHeaders = { authorization: this.httpAuthorizationHeader.toString() };
+    const authHeaders = this.httpAuthorizationHeader
+      ? { authorization: this.httpAuthorizationHeader.toString() }
+      : ({} as Record<string, string>);
     try {
       const user = await this.getUser(request, authHeaders);
       this.logger.debug(
@@ -173,7 +190,23 @@ export class AnonymousAuthenticationProvider extends BaseAuthenticationProvider
       // Create session only if it doesn't exist yet, otherwise keep it unchanged.
       return AuthenticationResult.succeeded(user, { authHeaders, state: state ? undefined : {} });
     } catch (err) {
-      this.logger.debug(`Failed to authenticate request : ${err.message}`);
+      if (LegacyElasticsearchErrorHelpers.isNotAuthorizedError(err)) {
+        if (!this.httpAuthorizationHeader) {
+          this.logger.error(
+            `Failed to authenticate anonymous request using Elasticsearch reserved anonymous user. Anonymous access may not be properly configured in Elasticsearch: ${err.message}`
+          );
+        } else if (this.httpAuthorizationHeader.scheme.toLowerCase() === 'basic') {
+          this.logger.error(
+            `Failed to authenticate anonymous request using provided username/password credentials. The user with the provided username may not exist or the password is wrong: ${err.message}`
+          );
+        } else {
+          this.logger.error(
+            `Failed to authenticate anonymous request using provided API key. The key may not exist or expired: ${err.message}`
+          );
+        }
+      } else {
+        this.logger.error(`Failed to authenticate request : ${err.message}`);
+      }
       return AuthenticationResult.failed(err);
     }
   }
diff --git a/x-pack/plugins/security/server/config.test.ts b/x-pack/plugins/security/server/config.test.ts
index a306e701e4e8d..f41e721db33a2 100644
--- a/x-pack/plugins/security/server/config.test.ts
+++ b/x-pack/plugins/security/server/config.test.ts
@@ -902,8 +902,9 @@ describe('config schema', () => {
           "[authc.providers]: types that failed validation:
           - [authc.providers.0]: expected value of type [array] but got [Object]
           - [authc.providers.1.anonymous.anonymous1.credentials]: types that failed validation:
-           - [credentials.0.password]: expected value of type [string] but got [undefined]
-           - [credentials.1.apiKey]: expected at least one defined value but got [undefined]"
+           - [credentials.0]: expected value to equal [elasticsearch_anonymous_user]
+           - [credentials.1.password]: expected value of type [string] but got [undefined]
+           - [credentials.2.apiKey]: expected at least one defined value but got [undefined]"
         `);
 
         expect(() =>
@@ -918,8 +919,9 @@ describe('config schema', () => {
           "[authc.providers]: types that failed validation:
           - [authc.providers.0]: expected value of type [array] but got [Object]
           - [authc.providers.1.anonymous.anonymous1.credentials]: types that failed validation:
-           - [credentials.0.username]: expected value of type [string] but got [undefined]
-           - [credentials.1.apiKey]: expected at least one defined value but got [undefined]"
+           - [credentials.0]: expected value to equal [elasticsearch_anonymous_user]
+           - [credentials.1.username]: expected value of type [string] but got [undefined]
+           - [credentials.2.apiKey]: expected at least one defined value but got [undefined]"
         `);
       });
 
@@ -973,8 +975,9 @@ describe('config schema', () => {
           "[authc.providers]: types that failed validation:
           - [authc.providers.0]: expected value of type [array] but got [Object]
           - [authc.providers.1.anonymous.anonymous1.credentials]: types that failed validation:
-           - [credentials.0.username]: expected value of type [string] but got [undefined]
-           - [credentials.1.apiKey]: types that failed validation:
+           - [credentials.0]: expected value to equal [elasticsearch_anonymous_user]
+           - [credentials.1.username]: expected value of type [string] but got [undefined]
+           - [credentials.2.apiKey]: types that failed validation:
             - [credentials.apiKey.0.key]: expected value of type [string] but got [undefined]
             - [credentials.apiKey.1]: expected value of type [string] but got [Object]"
         `);
@@ -993,8 +996,9 @@ describe('config schema', () => {
           "[authc.providers]: types that failed validation:
           - [authc.providers.0]: expected value of type [array] but got [Object]
           - [authc.providers.1.anonymous.anonymous1.credentials]: types that failed validation:
-           - [credentials.0.username]: expected value of type [string] but got [undefined]
-           - [credentials.1.apiKey]: types that failed validation:
+           - [credentials.0]: expected value to equal [elasticsearch_anonymous_user]
+           - [credentials.1.username]: expected value of type [string] but got [undefined]
+           - [credentials.2.apiKey]: types that failed validation:
             - [credentials.apiKey.0.id]: expected value of type [string] but got [undefined]
             - [credentials.apiKey.1]: expected value of type [string] but got [Object]"
         `);
@@ -1073,6 +1077,40 @@ describe('config schema', () => {
         `);
       });
 
+      it('can be successfully validated with `elasticsearch_anonymous_user` credentials', () => {
+        expect(
+          ConfigSchema.validate({
+            authc: {
+              providers: {
+                anonymous: {
+                  anonymous1: {
+                    order: 0,
+                    credentials: 'elasticsearch_anonymous_user',
+                  },
+                },
+              },
+            },
+          }).authc.providers
+        ).toMatchInlineSnapshot(`
+          Object {
+            "anonymous": Object {
+              "anonymous1": Object {
+                "credentials": "elasticsearch_anonymous_user",
+                "description": "Continue as Guest",
+                "enabled": true,
+                "hint": "For anonymous users",
+                "icon": "globe",
+                "order": 0,
+                "session": Object {
+                  "idleTimeout": null,
+                },
+                "showInSelector": true,
+              },
+            },
+          }
+        `);
+      });
+
       it('can be successfully validated with session config overrides', () => {
         expect(
           ConfigSchema.validate({
diff --git a/x-pack/plugins/security/server/config.ts b/x-pack/plugins/security/server/config.ts
index b46c8dc2178a4..cf9ab3a78ab71 100644
--- a/x-pack/plugins/security/server/config.ts
+++ b/x-pack/plugins/security/server/config.ts
@@ -150,6 +150,7 @@ const providersConfigSchema = schema.object(
       },
       {
         credentials: schema.oneOf([
+          schema.literal('elasticsearch_anonymous_user'),
           schema.object({
             username: schema.string(),
             password: schema.string(),
diff --git a/x-pack/test/security_api_integration/anonymous_es_anonymous.config.ts b/x-pack/test/security_api_integration/anonymous_es_anonymous.config.ts
new file mode 100644
index 0000000000000..3fc30c922b742
--- /dev/null
+++ b/x-pack/test/security_api_integration/anonymous_es_anonymous.config.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const anonymousAPITestsConfig = await readConfigFile(require.resolve('./anonymous.config.ts'));
+  return {
+    ...anonymousAPITestsConfig.getAll(),
+
+    junit: {
+      reportName: 'X-Pack Security API Integration Tests (Anonymous with ES anonymous access)',
+    },
+
+    esTestCluster: {
+      ...anonymousAPITestsConfig.get('esTestCluster'),
+      serverArgs: [
+        ...anonymousAPITestsConfig.get('esTestCluster.serverArgs'),
+        'xpack.security.authc.anonymous.username=anonymous_user',
+        'xpack.security.authc.anonymous.roles=anonymous_role',
+      ],
+    },
+
+    kbnTestServer: {
+      ...anonymousAPITestsConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...anonymousAPITestsConfig
+          .get('kbnTestServer.serverArgs')
+          .filter((arg: string) => !arg.startsWith('--xpack.security.authc.providers')),
+        `--xpack.security.authc.providers=${JSON.stringify({
+          anonymous: { anonymous1: { order: 0, credentials: 'elasticsearch_anonymous_user' } },
+          basic: { basic1: { order: 1 } },
+        })}`,
+      ],
+    },
+  };
+}
diff --git a/x-pack/test/security_api_integration/tests/anonymous/login.ts b/x-pack/test/security_api_integration/tests/anonymous/login.ts
index e7c876f54ee5a..559dc7cc78036 100644
--- a/x-pack/test/security_api_integration/tests/anonymous/login.ts
+++ b/x-pack/test/security_api_integration/tests/anonymous/login.ts
@@ -31,18 +31,24 @@ export default function ({ getService }: FtrProviderContext) {
     expect(cookie.maxAge).to.be(0);
   }
 
+  const isElasticsearchAnonymousAccessEnabled = (config.get(
+    'esTestCluster.serverArgs'
+  ) as string[]).some((setting) => setting.startsWith('xpack.security.authc.anonymous'));
+
   describe('Anonymous authentication', () => {
-    before(async () => {
-      await security.user.create('anonymous_user', {
-        password: 'changeme',
-        roles: [],
-        full_name: 'Guest',
+    if (!isElasticsearchAnonymousAccessEnabled) {
+      before(async () => {
+        await security.user.create('anonymous_user', {
+          password: 'changeme',
+          roles: [],
+          full_name: 'Guest',
+        });
       });
-    });
 
-    after(async () => {
-      await security.user.delete('anonymous_user');
-    });
+      after(async () => {
+        await security.user.delete('anonymous_user');
+      });
+    }
 
     it('should reject API requests if client is not authenticated', async () => {
       await supertest.get('/internal/security/me').set('kbn-xsrf', 'xxx').expect(401);
@@ -97,7 +103,9 @@ export default function ({ getService }: FtrProviderContext) {
 
         expect(user.username).to.eql('anonymous_user');
         expect(user.authentication_provider).to.eql({ type: 'anonymous', name: 'anonymous1' });
-        expect(user.authentication_type).to.eql('realm');
+        expect(user.authentication_type).to.eql(
+          isElasticsearchAnonymousAccessEnabled ? 'anonymous' : 'realm'
+        );
         // Do not assert on the `authentication_realm`, as the value differs for on-prem vs cloud
       });
 

From 44c436b8ad8bab89a9dccf53b496cf62a01d26b5 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 2 Dec 2020 09:42:42 +0100
Subject: [PATCH 27/28] [Lens] Use index pattern through service instead of
 reading saved object (#84432)

---
 .../indexpattern_datasource/datapanel.tsx     |  3 +-
 .../indexpattern_datasource/field_list.tsx    |  7 --
 x-pack/plugins/lens/server/plugin.tsx         |  2 +
 .../server/routes/existing_fields.test.ts     | 30 ++++----
 .../lens/server/routes/existing_fields.ts     | 71 ++++++++-----------
 .../plugins/lens/server/routes/field_stats.ts |  3 +-
 x-pack/plugins/lens/server/routes/index.ts    |  3 +-
 .../plugins/lens/server/routes/telemetry.ts   |  3 +-
 .../apis/lens/existing_fields.ts              | 20 ++++++
 9 files changed, 73 insertions(+), 69 deletions(-)

diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
index ad5509dd88bc9..5121714050c68 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
@@ -563,7 +563,8 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
                 '{availableFields} available {availableFields, plural, one {field} other {fields}}. {emptyFields} empty {emptyFields, plural, one {field} other {fields}}. {metaFields} meta {metaFields, plural, one {field} other {fields}}.',
               values: {
                 availableFields: fieldGroups.AvailableFields.fields.length,
-                emptyFields: fieldGroups.EmptyFields.fields.length,
+                // empty fields can be undefined if there is no existence information to be fetched
+                emptyFields: fieldGroups.EmptyFields?.fields.length || 0,
                 metaFields: fieldGroups.MetaFields.fields.length,
               },
             })}
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/field_list.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/field_list.tsx
index eb7730677d52a..9e89468200e2c 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/field_list.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/field_list.tsx
@@ -14,13 +14,6 @@ import { IndexPatternField } from './types';
 import { FieldItemSharedProps, FieldsAccordion } from './fields_accordion';
 const PAGINATION_SIZE = 50;
 
-export interface FieldsGroup {
-  specialFields: IndexPatternField[];
-  availableFields: IndexPatternField[];
-  emptyFields: IndexPatternField[];
-  metaFields: IndexPatternField[];
-}
-
 export type FieldGroups = Record<
   string,
   {
diff --git a/x-pack/plugins/lens/server/plugin.tsx b/x-pack/plugins/lens/server/plugin.tsx
index a8f9bef92349c..5a55b34cbcdff 100644
--- a/x-pack/plugins/lens/server/plugin.tsx
+++ b/x-pack/plugins/lens/server/plugin.tsx
@@ -7,6 +7,7 @@
 import { Plugin, CoreSetup, CoreStart, PluginInitializerContext, Logger } from 'src/core/server';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { Observable } from 'rxjs';
+import { PluginStart as DataPluginStart } from 'src/plugins/data/server';
 import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
 import { setupRoutes } from './routes';
 import {
@@ -23,6 +24,7 @@ export interface PluginSetupContract {
 
 export interface PluginStartContract {
   taskManager?: TaskManagerStartContract;
+  data: DataPluginStart;
 }
 
 export class LensServerPlugin implements Plugin<{}, {}, {}, {}> {
diff --git a/x-pack/plugins/lens/server/routes/existing_fields.test.ts b/x-pack/plugins/lens/server/routes/existing_fields.test.ts
index c877e69d7b0dd..0a3e669ba8538 100644
--- a/x-pack/plugins/lens/server/routes/existing_fields.test.ts
+++ b/x-pack/plugins/lens/server/routes/existing_fields.test.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { IndexPattern } from 'src/plugins/data/common';
 import { existingFields, Field, buildFieldList } from './existing_fields';
 
 describe('existingFields', () => {
@@ -71,25 +72,20 @@ describe('existingFields', () => {
 
 describe('buildFieldList', () => {
   const indexPattern = {
-    id: '',
-    type: 'indexpattern',
-    attributes: {
-      title: 'testpattern',
-      type: 'type',
-      typeMeta: 'typemeta',
-      fields: JSON.stringify([
-        { name: 'foo', scripted: true, lang: 'painless', script: '2+2' },
-        { name: 'bar' },
-        { name: '@bar' },
-        { name: 'baz' },
-        { name: '_mymeta' },
-      ]),
-    },
-    references: [],
+    title: 'testpattern',
+    type: 'type',
+    typeMeta: 'typemeta',
+    fields: [
+      { name: 'foo', scripted: true, lang: 'painless', script: '2+2' },
+      { name: 'bar' },
+      { name: '@bar' },
+      { name: 'baz' },
+      { name: '_mymeta' },
+    ],
   };
 
   it('supports scripted fields', () => {
-    const fields = buildFieldList(indexPattern, []);
+    const fields = buildFieldList((indexPattern as unknown) as IndexPattern, []);
     expect(fields.find((f) => f.isScript)).toMatchObject({
       isScript: true,
       name: 'foo',
@@ -99,7 +95,7 @@ describe('buildFieldList', () => {
   });
 
   it('supports meta fields', () => {
-    const fields = buildFieldList(indexPattern, ['_mymeta']);
+    const fields = buildFieldList((indexPattern as unknown) as IndexPattern, ['_mymeta']);
     expect(fields.find((f) => f.isMeta)).toMatchObject({
       isScript: false,
       isMeta: true,
diff --git a/x-pack/plugins/lens/server/routes/existing_fields.ts b/x-pack/plugins/lens/server/routes/existing_fields.ts
index 844c7b16e1eaa..aef8b1b3d7076 100644
--- a/x-pack/plugins/lens/server/routes/existing_fields.ts
+++ b/x-pack/plugins/lens/server/routes/existing_fields.ts
@@ -6,10 +6,12 @@
 
 import Boom from '@hapi/boom';
 import { schema } from '@kbn/config-schema';
-import { ILegacyScopedClusterClient, SavedObject, RequestHandlerContext } from 'src/core/server';
+import { ILegacyScopedClusterClient, RequestHandlerContext } from 'src/core/server';
 import { CoreSetup, Logger } from 'src/core/server';
+import { IndexPattern, IndexPatternsService } from 'src/plugins/data/common';
 import { BASE_API_URL } from '../../common';
-import { IndexPatternAttributes, UI_SETTINGS } from '../../../../../src/plugins/data/server';
+import { UI_SETTINGS } from '../../../../../src/plugins/data/server';
+import { PluginStartContract } from '../plugin';
 
 export function isBoomError(error: { isBoom?: boolean }): error is Boom {
   return error.isBoom === true;
@@ -28,7 +30,7 @@ export interface Field {
   script?: string;
 }
 
-export async function existingFieldsRoute(setup: CoreSetup, logger: Logger) {
+export async function existingFieldsRoute(setup: CoreSetup<PluginStartContract>, logger: Logger) {
   const router = setup.http.createRouter();
 
   router.post(
@@ -47,11 +49,18 @@ export async function existingFieldsRoute(setup: CoreSetup, logger: Logger) {
       },
     },
     async (context, req, res) => {
+      const [{ savedObjects, elasticsearch }, { data }] = await setup.getStartServices();
+      const savedObjectsClient = savedObjects.getScopedClient(req);
+      const esClient = elasticsearch.client.asScoped(req).asCurrentUser;
       try {
         return res.ok({
           body: await fetchFieldExistence({
             ...req.params,
             ...req.body,
+            indexPatternsService: await data.indexPatterns.indexPatternsServiceFactory(
+              savedObjectsClient,
+              esClient
+            ),
             context,
           }),
         });
@@ -80,6 +89,7 @@ export async function existingFieldsRoute(setup: CoreSetup, logger: Logger) {
 async function fetchFieldExistence({
   context,
   indexPatternId,
+  indexPatternsService,
   dslQuery = { match_all: {} },
   fromDate,
   toDate,
@@ -87,16 +97,14 @@ async function fetchFieldExistence({
 }: {
   indexPatternId: string;
   context: RequestHandlerContext;
+  indexPatternsService: IndexPatternsService;
   dslQuery: object;
   fromDate?: string;
   toDate?: string;
   timeFieldName?: string;
 }) {
   const metaFields: string[] = await context.core.uiSettings.client.get(UI_SETTINGS.META_FIELDS);
-  const { indexPattern, indexPatternTitle } = await fetchIndexPatternDefinition(
-    indexPatternId,
-    context
-  );
+  const indexPattern = await indexPatternsService.get(indexPatternId);
 
   const fields = buildFieldList(indexPattern, metaFields);
   const docs = await fetchIndexPatternStats({
@@ -104,51 +112,32 @@ async function fetchFieldExistence({
     toDate,
     dslQuery,
     client: context.core.elasticsearch.legacy.client,
-    index: indexPatternTitle,
-    timeFieldName: timeFieldName || indexPattern.attributes.timeFieldName,
+    index: indexPattern.title,
+    timeFieldName: timeFieldName || indexPattern.timeFieldName,
     fields,
   });
 
   return {
-    indexPatternTitle,
+    indexPatternTitle: indexPattern.title,
     existingFieldNames: existingFields(docs, fields),
   };
 }
 
-async function fetchIndexPatternDefinition(indexPatternId: string, context: RequestHandlerContext) {
-  const savedObjectsClient = context.core.savedObjects.client;
-  const indexPattern = await savedObjectsClient.get<IndexPatternAttributes>(
-    'index-pattern',
-    indexPatternId
-  );
-  const indexPatternTitle = indexPattern.attributes.title;
-
-  return {
-    indexPattern,
-    indexPatternTitle,
-  };
-}
-
 /**
  * Exported only for unit tests.
  */
-export function buildFieldList(
-  indexPattern: SavedObject<IndexPatternAttributes>,
-  metaFields: string[]
-): Field[] {
-  return JSON.parse(indexPattern.attributes.fields).map(
-    (field: { name: string; lang: string; scripted?: boolean; script?: string }) => {
-      return {
-        name: field.name,
-        isScript: !!field.scripted,
-        lang: field.lang,
-        script: field.script,
-        // id is a special case - it doesn't show up in the meta field list,
-        // but as it's not part of source, it has to be handled separately.
-        isMeta: metaFields.includes(field.name) || field.name === '_id',
-      };
-    }
-  );
+export function buildFieldList(indexPattern: IndexPattern, metaFields: string[]): Field[] {
+  return indexPattern.fields.map((field) => {
+    return {
+      name: field.name,
+      isScript: !!field.scripted,
+      lang: field.lang,
+      script: field.script,
+      // id is a special case - it doesn't show up in the meta field list,
+      // but as it's not part of source, it has to be handled separately.
+      isMeta: metaFields.includes(field.name) || field.name === '_id',
+    };
+  });
 }
 
 async function fetchIndexPatternStats({
diff --git a/x-pack/plugins/lens/server/routes/field_stats.ts b/x-pack/plugins/lens/server/routes/field_stats.ts
index 29e2416b74618..e0f1e05ed970d 100644
--- a/x-pack/plugins/lens/server/routes/field_stats.ts
+++ b/x-pack/plugins/lens/server/routes/field_stats.ts
@@ -11,10 +11,11 @@ import { CoreSetup } from 'src/core/server';
 import { IFieldType } from 'src/plugins/data/common';
 import { ESSearchResponse } from '../../../../typings/elasticsearch';
 import { FieldStatsResponse, BASE_API_URL } from '../../common';
+import { PluginStartContract } from '../plugin';
 
 const SHARD_SIZE = 5000;
 
-export async function initFieldsRoute(setup: CoreSetup) {
+export async function initFieldsRoute(setup: CoreSetup<PluginStartContract>) {
   const router = setup.http.createRouter();
   router.post(
     {
diff --git a/x-pack/plugins/lens/server/routes/index.ts b/x-pack/plugins/lens/server/routes/index.ts
index 01018d8cd7fe5..b1d7e7ca8bc17 100644
--- a/x-pack/plugins/lens/server/routes/index.ts
+++ b/x-pack/plugins/lens/server/routes/index.ts
@@ -5,11 +5,12 @@
  */
 
 import { CoreSetup, Logger } from 'src/core/server';
+import { PluginStartContract } from '../plugin';
 import { existingFieldsRoute } from './existing_fields';
 import { initFieldsRoute } from './field_stats';
 import { initLensUsageRoute } from './telemetry';
 
-export function setupRoutes(setup: CoreSetup, logger: Logger) {
+export function setupRoutes(setup: CoreSetup<PluginStartContract>, logger: Logger) {
   existingFieldsRoute(setup, logger);
   initFieldsRoute(setup);
   initLensUsageRoute(setup);
diff --git a/x-pack/plugins/lens/server/routes/telemetry.ts b/x-pack/plugins/lens/server/routes/telemetry.ts
index 306c631cd78a7..820e32509923e 100644
--- a/x-pack/plugins/lens/server/routes/telemetry.ts
+++ b/x-pack/plugins/lens/server/routes/telemetry.ts
@@ -8,10 +8,11 @@ import Boom from '@hapi/boom';
 import { CoreSetup } from 'src/core/server';
 import { schema } from '@kbn/config-schema';
 import { BASE_API_URL } from '../../common';
+import { PluginStartContract } from '../plugin';
 
 // This route is responsible for taking a batch of click events from the browser
 // and writing them to saved objects
-export async function initLensUsageRoute(setup: CoreSetup) {
+export async function initLensUsageRoute(setup: CoreSetup<PluginStartContract>) {
   const router = setup.http.createRouter();
   router.post(
     {
diff --git a/x-pack/test/api_integration/apis/lens/existing_fields.ts b/x-pack/test/api_integration/apis/lens/existing_fields.ts
index 08806df380f38..6eddaac50fda5 100644
--- a/x-pack/test/api_integration/apis/lens/existing_fields.ts
+++ b/x-pack/test/api_integration/apis/lens/existing_fields.ts
@@ -102,26 +102,46 @@ const metricBeatData = [
   '_id',
   '_index',
   'agent.ephemeral_id',
+  'agent.ephemeral_id.keyword',
   'agent.hostname',
+  'agent.hostname.keyword',
   'agent.id',
+  'agent.id.keyword',
   'agent.type',
+  'agent.type.keyword',
   'agent.version',
+  'agent.version.keyword',
   'ecs.version',
+  'ecs.version.keyword',
   'event.dataset',
+  'event.dataset.keyword',
   'event.duration',
   'event.module',
+  'event.module.keyword',
   'host.architecture',
+  'host.architecture.keyword',
   'host.hostname',
+  'host.hostname.keyword',
   'host.id',
+  'host.id.keyword',
   'host.name',
+  'host.name.keyword',
   'host.os.build',
+  'host.os.build.keyword',
   'host.os.family',
+  'host.os.family.keyword',
   'host.os.kernel',
+  'host.os.kernel.keyword',
   'host.os.name',
+  'host.os.name.keyword',
   'host.os.platform',
+  'host.os.platform.keyword',
   'host.os.version',
+  'host.os.version.keyword',
   'metricset.name',
+  'metricset.name.keyword',
   'service.type',
+  'service.type.keyword',
   'system.cpu.cores',
   'system.cpu.idle.pct',
   'system.cpu.iowait.pct',

From 30f8e41d45a88c9e1289af1548ac106625f7732a Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 2 Dec 2020 10:06:25 +0100
Subject: [PATCH 28/28] [Lens] Show color in flyout instead of auto (#84532)

---
 .../xy_visualization/color_assignment.ts      | 51 +++++++++++-
 .../public/xy_visualization/visualization.tsx | 65 ++-------------
 .../xy_visualization/xy_config_panel.test.tsx | 83 +++++++++++++++++++
 .../xy_visualization/xy_config_panel.tsx      | 45 ++++++++--
 4 files changed, 180 insertions(+), 64 deletions(-)

diff --git a/x-pack/plugins/lens/public/xy_visualization/color_assignment.ts b/x-pack/plugins/lens/public/xy_visualization/color_assignment.ts
index 68c47e11acfc0..e5764eaf0e8c0 100644
--- a/x-pack/plugins/lens/public/xy_visualization/color_assignment.ts
+++ b/x-pack/plugins/lens/public/xy_visualization/color_assignment.ts
@@ -5,9 +5,11 @@
  */
 
 import { uniq, mapValues } from 'lodash';
-import { PaletteOutput } from 'src/plugins/charts/public';
+import { PaletteOutput, PaletteRegistry } from 'src/plugins/charts/public';
 import { Datatable } from 'src/plugins/expressions';
-import { FormatFactory } from '../types';
+import { AccessorConfig, FormatFactory, FramePublicAPI } from '../types';
+import { getColumnToLabelMap } from './state_helpers';
+import { LayerConfig } from './types';
 
 const isPrimitive = (value: unknown): boolean => value != null && typeof value !== 'object';
 
@@ -87,3 +89,48 @@ export function getColorAssignments(
     };
   });
 }
+
+export function getAccessorColorConfig(
+  colorAssignments: ColorAssignments,
+  frame: FramePublicAPI,
+  layer: LayerConfig,
+  sortedAccessors: string[],
+  paletteService: PaletteRegistry
+): AccessorConfig[] {
+  const layerContainsSplits = Boolean(layer.splitAccessor);
+  const currentPalette: PaletteOutput = layer.palette || { type: 'palette', name: 'default' };
+  const totalSeriesCount = colorAssignments[currentPalette.name].totalSeriesCount;
+  return sortedAccessors.map((accessor) => {
+    const currentYConfig = layer.yConfig?.find((yConfig) => yConfig.forAccessor === accessor);
+    if (layerContainsSplits) {
+      return {
+        columnId: accessor as string,
+        triggerIcon: 'disabled',
+      };
+    }
+    const columnToLabel = getColumnToLabelMap(layer, frame.datasourceLayers[layer.layerId]);
+    const rank = colorAssignments[currentPalette.name].getRank(
+      layer,
+      columnToLabel[accessor] || accessor,
+      accessor
+    );
+    const customColor =
+      currentYConfig?.color ||
+      paletteService.get(currentPalette.name).getColor(
+        [
+          {
+            name: columnToLabel[accessor] || accessor,
+            rankAtDepth: rank,
+            totalSeriesAtDepth: totalSeriesCount,
+          },
+        ],
+        { maxDepth: 1, totalSeries: totalSeriesCount },
+        currentPalette.params
+      );
+    return {
+      columnId: accessor as string,
+      triggerIcon: customColor ? 'color' : 'disabled',
+      color: customColor ? customColor : undefined,
+    };
+  });
+}
diff --git a/x-pack/plugins/lens/public/xy_visualization/visualization.tsx b/x-pack/plugins/lens/public/xy_visualization/visualization.tsx
index 872eb179e6a5c..f0dcaf589b1c4 100644
--- a/x-pack/plugins/lens/public/xy_visualization/visualization.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/visualization.tsx
@@ -10,24 +10,18 @@ import { render } from 'react-dom';
 import { Position } from '@elastic/charts';
 import { I18nProvider } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import { PaletteOutput, PaletteRegistry } from 'src/plugins/charts/public';
+import { PaletteRegistry } from 'src/plugins/charts/public';
 import { DataPublicPluginStart } from 'src/plugins/data/public';
 import { getSuggestions } from './xy_suggestions';
 import { LayerContextMenu, XyToolbar, DimensionEditor } from './xy_config_panel';
-import {
-  Visualization,
-  OperationMetadata,
-  VisualizationType,
-  AccessorConfig,
-  FramePublicAPI,
-} from '../types';
+import { Visualization, OperationMetadata, VisualizationType, AccessorConfig } from '../types';
 import { State, SeriesType, visualizationTypes, LayerConfig } from './types';
-import { getColumnToLabelMap, isHorizontalChart } from './state_helpers';
+import { isHorizontalChart } from './state_helpers';
 import { toExpression, toPreviewExpression, getSortedAccessors } from './to_expression';
 import { LensIconChartBarStacked } from '../assets/chart_bar_stacked';
 import { LensIconChartMixedXy } from '../assets/chart_mixed_xy';
 import { LensIconChartBarHorizontal } from '../assets/chart_bar_horizontal';
-import { ColorAssignments, getColorAssignments } from './color_assignment';
+import { getAccessorColorConfig, getColorAssignments } from './color_assignment';
 
 const defaultIcon = LensIconChartBarStacked;
 const defaultSeriesType = 'bar_stacked';
@@ -328,7 +322,11 @@ export const getXyVisualization = ({
   renderDimensionEditor(domElement, props) {
     render(
       <I18nProvider>
-        <DimensionEditor {...props} />
+        <DimensionEditor
+          {...props}
+          formatFactory={data.fieldFormats.deserialize}
+          paletteService={paletteService}
+        />
       </I18nProvider>,
       domElement
     );
@@ -375,51 +373,6 @@ export const getXyVisualization = ({
   },
 });
 
-function getAccessorColorConfig(
-  colorAssignments: ColorAssignments,
-  frame: FramePublicAPI,
-  layer: LayerConfig,
-  sortedAccessors: string[],
-  paletteService: PaletteRegistry
-): AccessorConfig[] {
-  const layerContainsSplits = Boolean(layer.splitAccessor);
-  const currentPalette: PaletteOutput = layer.palette || { type: 'palette', name: 'default' };
-  const totalSeriesCount = colorAssignments[currentPalette.name].totalSeriesCount;
-  return sortedAccessors.map((accessor) => {
-    const currentYConfig = layer.yConfig?.find((yConfig) => yConfig.forAccessor === accessor);
-    if (layerContainsSplits) {
-      return {
-        columnId: accessor as string,
-        triggerIcon: 'disabled',
-      };
-    }
-    const columnToLabel = getColumnToLabelMap(layer, frame.datasourceLayers[layer.layerId]);
-    const rank = colorAssignments[currentPalette.name].getRank(
-      layer,
-      columnToLabel[accessor] || accessor,
-      accessor
-    );
-    const customColor =
-      currentYConfig?.color ||
-      paletteService.get(currentPalette.name).getColor(
-        [
-          {
-            name: columnToLabel[accessor] || accessor,
-            rankAtDepth: rank,
-            totalSeriesAtDepth: totalSeriesCount,
-          },
-        ],
-        { maxDepth: 1, totalSeries: totalSeriesCount },
-        currentPalette.params
-      );
-    return {
-      columnId: accessor as string,
-      triggerIcon: customColor ? 'color' : 'disabled',
-      color: customColor ? customColor : undefined,
-    };
-  });
-}
-
 function validateLayersForDimension(
   dimension: string,
   layers: LayerConfig[],
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
index 99fbfa058a2de..7b84b990f963a 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.test.tsx
@@ -14,6 +14,8 @@ import { FramePublicAPI } from '../types';
 import { State } from './types';
 import { Position } from '@elastic/charts';
 import { createMockFramePublicAPI, createMockDatasource } from '../editor_frame_service/mocks';
+import { chartPluginMock } from 'src/plugins/charts/public/mocks';
+import { EuiColorPicker } from '@elastic/eui';
 
 describe('XY Config panels', () => {
   let frame: FramePublicAPI;
@@ -322,6 +324,8 @@ describe('XY Config panels', () => {
           accessor="bar"
           groupId="left"
           state={{ ...state, layers: [{ ...state.layers[0], seriesType: 'bar_horizontal' }] }}
+          formatFactory={jest.fn()}
+          paletteService={chartPluginMock.createPaletteRegistry()}
         />
       );
 
@@ -343,6 +347,8 @@ describe('XY Config panels', () => {
           accessor="bar"
           groupId="left"
           state={state}
+          formatFactory={jest.fn()}
+          paletteService={chartPluginMock.createPaletteRegistry()}
         />
       );
 
@@ -353,5 +359,82 @@ describe('XY Config panels', () => {
 
       expect(options!.map(({ label }) => label)).toEqual(['Auto', 'Left', 'Right']);
     });
+
+    test('sets the color of a dimension to the color from palette service if not set explicitly', () => {
+      const state = testState();
+      const component = mount(
+        <DimensionEditor
+          layerId={state.layers[0].layerId}
+          frame={{
+            ...frame,
+            activeData: {
+              first: {
+                type: 'datatable',
+                columns: [],
+                rows: [{ bar: 123 }],
+              },
+            },
+          }}
+          setState={jest.fn()}
+          accessor="bar"
+          groupId="left"
+          state={{
+            ...state,
+            layers: [
+              {
+                seriesType: 'bar',
+                layerId: 'first',
+                splitAccessor: undefined,
+                xAccessor: 'foo',
+                accessors: ['bar'],
+              },
+            ],
+          }}
+          formatFactory={jest.fn()}
+          paletteService={chartPluginMock.createPaletteRegistry()}
+        />
+      );
+
+      expect(component.find(EuiColorPicker).prop('color')).toEqual('black');
+    });
+
+    test('uses the overwrite color if set', () => {
+      const state = testState();
+      const component = mount(
+        <DimensionEditor
+          layerId={state.layers[0].layerId}
+          frame={{
+            ...frame,
+            activeData: {
+              first: {
+                type: 'datatable',
+                columns: [],
+                rows: [{ bar: 123 }],
+              },
+            },
+          }}
+          setState={jest.fn()}
+          accessor="bar"
+          groupId="left"
+          state={{
+            ...state,
+            layers: [
+              {
+                seriesType: 'bar',
+                layerId: 'first',
+                splitAccessor: undefined,
+                xAccessor: 'foo',
+                accessors: ['bar'],
+                yConfig: [{ forAccessor: 'bar', color: 'red' }],
+              },
+            ],
+          }}
+          formatFactory={jest.fn()}
+          paletteService={chartPluginMock.createPaletteRegistry()}
+        />
+      );
+
+      expect(component.find(EuiColorPicker).prop('color')).toEqual('red');
+    });
   });
 });
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
index a22530c5743b4..cd8a5993d3ecb 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
@@ -5,7 +5,7 @@
  */
 
 import './xy_config_panel.scss';
-import React, { useState } from 'react';
+import React, { useMemo, useState } from 'react';
 import { i18n } from '@kbn/i18n';
 import { Position } from '@elastic/charts';
 import { debounce } from 'lodash';
@@ -22,10 +22,12 @@ import {
   EuiToolTip,
   EuiIcon,
 } from '@elastic/eui';
+import { PaletteRegistry } from 'src/plugins/charts/public';
 import {
   VisualizationLayerWidgetProps,
   VisualizationToolbarProps,
   VisualizationDimensionEditorProps,
+  FormatFactory,
 } from '../types';
 import {
   State,
@@ -48,6 +50,7 @@ import { AxisSettingsPopover } from './axis_settings_popover';
 import { TooltipWrapper } from './tooltip_wrapper';
 import { getAxesConfiguration } from './axes_configuration';
 import { PalettePicker } from '../shared_components';
+import { getAccessorColorConfig, getColorAssignments } from './color_assignment';
 
 type UnwrapArray<T> = T extends Array<infer P> ? P : T;
 type AxesSettingsConfigKeys = keyof AxesSettingsConfig;
@@ -445,7 +448,12 @@ export function XyToolbar(props: VisualizationToolbarProps<State>) {
 }
 const idPrefix = htmlIdGenerator()();
 
-export function DimensionEditor(props: VisualizationDimensionEditorProps<State>) {
+export function DimensionEditor(
+  props: VisualizationDimensionEditorProps<State> & {
+    formatFactory: FormatFactory;
+    paletteService: PaletteRegistry;
+  }
+) {
   const { state, setState, layerId, accessor } = props;
   const index = state.layers.findIndex((l) => l.layerId === layerId);
   const layer = state.layers[index];
@@ -556,12 +564,37 @@ const ColorPicker = ({
   setState,
   layerId,
   accessor,
-}: VisualizationDimensionEditorProps<State>) => {
+  frame,
+  formatFactory,
+  paletteService,
+}: VisualizationDimensionEditorProps<State> & {
+  formatFactory: FormatFactory;
+  paletteService: PaletteRegistry;
+}) => {
   const index = state.layers.findIndex((l) => l.layerId === layerId);
   const layer = state.layers[index];
   const disabled = !!layer.splitAccessor;
 
-  const [color, setColor] = useState(getSeriesColor(layer, accessor));
+  const overwriteColor = getSeriesColor(layer, accessor);
+  const currentColor = useMemo(() => {
+    if (overwriteColor || !frame.activeData) return overwriteColor;
+
+    const colorAssignments = getColorAssignments(
+      state.layers,
+      { tables: frame.activeData },
+      formatFactory
+    );
+    const mappedAccessors = getAccessorColorConfig(
+      colorAssignments,
+      frame,
+      layer,
+      [accessor],
+      paletteService
+    );
+    return mappedAccessors[0].color;
+  }, [overwriteColor, frame, paletteService, state.layers, accessor, formatFactory, layer]);
+
+  const [color, setColor] = useState(currentColor);
 
   const handleColor: EuiColorPickerProps['onChange'] = (text, output) => {
     setColor(text);
@@ -596,9 +629,9 @@ const ColorPicker = ({
     <EuiColorPicker
       data-test-subj="indexPattern-dimension-colorPicker"
       compressed
-      isClearable
+      isClearable={Boolean(overwriteColor)}
       onChange={handleColor}
-      color={disabled ? '' : color}
+      color={disabled ? '' : color || currentColor}
       disabled={disabled}
       placeholder={i18n.translate('xpack.lens.xyChart.seriesColor.auto', {
         defaultMessage: 'Auto',